Data Protection and Use

To provide clear guidance for how personal information can and can't be used in the social sector.

New Zealanders need confidence that their privacy is not breached, and their safety and wellbeing is not compromised when dealing with government and organisations within the social sector. 

There are a wide range of laws, guidelines and codes of practice that inform how and when personal information is collected, used and shared in the social sector. They can be hard to navigate which can cause confusion about what is and isn’t appropriate with respect to using peoples’ personal information.

We are developing a policy to help everyone to easily understand what's appropriate, what's not, and how to do things safely when personal information has a role to play. We are calling this the Data Protection and Use Policy.

In 2018, we ran an engagement process to find out what people think needs to be included in the Policy. We published the findings from this engagement in a report titled ‘What you told us’.

Findings from the engagement being used to inform the policy

The findings of the engagement on the protection and use of data have confirmed the major areas set out for the policy to address as appropriate. We’re using the findings to ensure that we develop a draft policy that addresses a range of concerns, is practical and applicable to a diverse sector.

Overview of the Data Protection and Use Policy

The Policy is being developed to address each of the topics identified during the engagement.

The scope of the policy is to:

  • Ensure those receiving social services have a better understanding about how their personal information is collected and used;
  • Clarify when personal identifiable information is needed and what types of personal information should be used for what purpose;
  • Build understanding of what protocols, structures and measures need to be in place to protect personal information;
  • Equip the social sector to work together using information to improve services and make better decisions for New Zealanders; 
  • Build understanding, trust, and confidence around the collection, storage and analysis of information.

What do we mean by a “policy”?

The Policy will be a combination of principles and guidelines. It will be supported by a ‘toolkit’ which will be developed over time, to support and enable the social sector to easily understand what‘s appropriate and how to safely work with personal information.

What’s the next step in the process to develop the Data Protection and Use Policy?

We anticipate that we will run some further engagement, or a ‘check in’ period in the first half of this year to give people an opportunity to review and submit feedback on specific Policy elements. Further detail will be published on this website once Cabinet has considered the draft Policy.

Further information about the Policy is included in the FAQs page.

Programme Timeline

Here are the key steps in the process to develop the Data Protection and Use Policy.

Early 2018  Design of the engagement process
May – Sept 2018  Engagement phase (Your voice, your data, your say)
Oct – Nov 2018  Collaborative policy design – sector representatives
 Nov 2018  Findings  published
 Jan – March 2019  Refinement of draft policy framework and potential toolkit structure
 Mid-March 2019  Draft Data Protection and Use Policy to be presented to Cabinet*
Post March 2019   Engagement (check-in) on the draft Policy framework*
Mid 2019   Final Data Protection and Use Policy to be presented to Cabinet*
Post Cabinet paper   Implementation planning

 *Subject to confirmation


If you have any questions, please email us.


Export PDF