Purpose, protocol and process for sharing personal information

What you need to know when sharing personal information.

You can share most information if:

  • you have a clear and specific purpose that is in the interest of the person
  • you develop a privacy protocol
  • you follow the right process.

1. Purpose: You need a clear and specific purpose to share personal information

The purpose must have two components: why you are sharing the information and how it will benefit or be in the interest of the person. 

Examples of a clear and specific purpose include:

  • providing an iwi mentoring programme to lift achievement for Māori students
  • supporting children and young people to transition to a new school or service
  • developing a register of learning support needs across the Kāhui Ako to coordinate resources so that children and young people can access the right support.

Once you have a clear and specific purpose, you need to decide whether individuals must be identified for this purpose.  If not, use aggregate data or NSNs. Your Kāhui Ako should consider this carefully and record why they think it is necessary to share personal information.

While there could be many benefits to the person, it is also important to think about whether sharing the information could disadvantage them.  For example, parents are often concerned that their child will be labelled as ‘a trouble-maker’ for future schools. 

2. Protocol: Develop a Kāhui Ako privacy protocol

A privacy protocol should set the parameters for how you will use and protect information. To share any kind of information, the Kāhui Ako must have procedures in place. Iwi, community groups and other organisations that are working in partnership with the Kāhui Ako can also sign up to the privacy protocol. Otherwise separate privacy protocols will need to be developed for working with these groups.

The objective of the privacy protocol is to form a common and transparent understanding of the policies and procedures that all members of the Kāhui Ako will follow to protect personal information. The privacy protocol will give parents and whānau, boards of trustees and services’ boards or committees the assurance that information will be kept secure. 

Many Kāhui Ako will already have a privacy protocol for dealing with aggregate data and information gathered during recruitment processes. This privacy protocol can be updated to include the sharing of personal information. The Kāhui Ako privacy protocol is usually an appendix to the memorandum of agreement.

School boards of trustees and services’ boards or committees signing a memorandum of agreement will be agreeing to the privacy protocol as well. You should also consider making the privacy protocol available on an internet site for parents and caregivers to give greater assurance about how the Kāhui Ako will protect personal information.


3. Process: Consider how sensitive the information is

The way information is shared depends on how sensitive the information is and if any harm could result to a person if the information was lost or passed on. 

The more sensitive the information, the more controls need to be in place, which means following different processes depending on the sensitivity of the information the Kāhui Ako wants to share.

Sensitivity scale and examples of information type

Non-sensitive and sensitive information can be shared within a Kāhui Ako if the right processes are followed

Highly sensitive information such as details relating to sexual health, counselling and existence of abuse cannot be shared with your Kāhui Ako group. Seek consent to share only with people who need to know.

You must inform the appropriate agencies immediately if you think a child or young person may be at risk of harm, even if it means sharing highly sensitive information without consent.

The following diagram shows examples of types of information across the sensitivity scale and the processes that need to be in place before sharing that information.


Remember when sharing information

  • Include sharing of aggregate data in a privacy protocol.
  • Inform parents and caregivers about sharing other information at the less sensitive end of the spectrum (eg achievement, attendance, engagement) in a privacy statement.
  • Seek consent to share sensitive information (eg learning support, health or disability information, external agency involvement, mental health).
  • Do not share highly sensitive information with your Kāhui Ako group. Seek consent to share with specific people who need to know.

4. Follow this checklist when sharing information

The checklist below summarises the process to follow when sharing personal information.

Step by step checklist for sharing personal information

Flow diagram showing step by step process for sharing information

5. Share highly sensitive information when a child, young person or student is at risk of harm

Highly sensitive information should not be shared across a Kāhui Ako group.

If a child, young person or student is at risk of harm, the school or service must share the information immediately with the agencies who can best respond, eg Oranga Tamariki, the Police or a mental health crisis response team.

In limited cases, the school or service may, with the appropriate consent, share highly sensitive information with specific people need to know to help or support the child, young person or student, eg pastoral care workers at a school they are transitioning to.

6. Involve the board or committee in signing off the privacy protocol

Remember, boards of trustees and services’ boards or committees are signing Memorandum of Agreement documents. It is important they understand this information and know how, when and why the Kāhui Ako is sharing information.

The memorandum of agreement is signed on the establishment of a Kāhui Ako and may require adjustment to add a privacy protocol. The board of trustees, as the legal entity, must approve and sign the new memorandum of agreement

School boards of trustees and services’ boards and committees will be involved if there is a privacy breach that affects the children, young people, students or staff at their school. They need to be assured that processes are in place to minimise the risk of a privacy breach. Because of their legal role, they need to know they are protected by the appropriate privacy protocols and associated processes (as outlined in this guidance).”

Last reviewed: Has this been useful? Give us your feedback