Privacy Act 2020: Resources for schools and early learning services
This page gives an overview of the Privacy Act 2020 for schools, kura, and early learning services and provides links to guidance and resources about privacy.
- About the Privacy Act 2020 and what it covers
- Key responsibilities under the Privacy Act
- More resources
About the Privacy Act and what it covers
The Privacy Act 2020 came into force on 1 December 2020, replacing the Privacy Act 1993. It is one of the key documents that sets out how all agencies, including the Ministry, schools, and early learning services, handle personal information.
Personal information doesn’t need to mention someone’s name to be covered by the Privacy Act. Examples of personal information include:
- Financial information such as bank details and salary details.
- Demographic information like ethnicity, age and gender.
- Health information such as medical notes, medications, counselling notes and disability information.
- Staff information, like teachers’ qualifications and work history.
- Biometrics, including photos, CCTV footage, phone and Teams recordings.
- Website analytics, like location and device data collected by website cookies.
Health information has additional protection under the Health Information Privacy Code.
Key responsibilities under the Privacy Act
Privacy Officers
Under the Privacy Act, every school, kura, early learning service, and kōhanga reo should have a privacy officer. This is the person responsible for encouraging and making sure everyone complies with the Privacy Act.
Your responsibilities: Privacy Officers – Office of the Privacy Commissioner(external link)
Transparency
It’s important to make sure people know what information is being collected about them, how it will be used and who it will be shared with. Information collected from children and young people needs particular care. Making sure your enrolment and consent forms all have clear and up-to-date privacy statements can help you meet your obligations, as well as only collecting information that’s strictly necessary – not just ‘nice to know.’ There are also special considerations around the use of CCTV footage to make sure this way of collecting people’s information is fair and reasonable.
Privacy and CCTV – Office of the Privacy Commissioner(external link)
Keeping information safe
All agencies have an obligation to carefully look after the personal information it holds to avoid it getting lost, misplaced, used by, or disclosed to the wrong person. Steps you can take include using 2-factor authentication, good password practices, checking that only the right people can access records, and using secure destruction bins for disposing hard copies of information.
Using 2-factor authentication – information for teachers and staff
Storage and security of information – Office of the Privacy Commissioner(external link)
Thinking carefully about using new technologies
Consider any possible risks and how you might manage them before using personal information in new systems or tools, particularly where AI might be involved. A Privacy Impact Assessment can help with this process, and schools and kura can also refer to the Ministry’s Safer Technologies for Schools (ST4S) initiative to inform decisions around the software you use.
Privacy Impact Assessment Toolkit – Office of the Privacy Commissioner(external link)
Safer Technology for Schools website
Privacy breaches
The Privacy Act requires all agencies to notify the Office of the Privacy Commissioner of any breaches that may cause serious harm, such as physical harm, financial fraud, family violence or emotional harm. Failure to do so might result in a fine so it’s important to have a process for when things go wrong. Early learning services are also required to notify the Ministry of any notifiable privacy breaches under current licensing criteria.
Your responsibilities: Privacy breaches – Office of the Privacy Commissioner(external link)
Rights to access and request correction of personal information
The Privacy Act gives all individuals the right to ask for information about themselves, and for it to be corrected if it’s wrong. Making sure you keep accurate and up-to-date records can help make this process easier.
Your privacy rights – Office of the Privacy Commissioner(external link)
Access to personal information – Office of the Privacy Commissioner(external link)
Using and sharing information
In most cases, you can only use information for the purpose it was collected, and there are restrictions around who you can share it with. It’s important to know that it’s ok to share information when it’s necessary to keep someone safe, as long as it’s shared with the right people, such as Oranga Tamariki or the Police.
Sharing information in early childhood services
Sharing information in schools
Learning support – sharing information guide
Other resources
New Zealand Board Association
The NZBA provides resources and support to school boards, including privacy resources.
Information, privacy and copyright – NZSTA(external link)
Privacy ABC for Schools
Privacy ABC for Schools is a free online training resource created by the Office of the Privacy Commissioner for schools, but it’s also useful for early learning providers. It gives an overview of privacy rights and responsibilities and covers topics such as sharing photos on social media.
Privacy ABC for Schools – Office of the Privacy Commissioner(external link)
AskUs
This is a knowledge base of questions and answers maintained by the Office of the Privacy Commissioner and where you can also submit your own privacy questions.
AskUs – Office of the Privacy Commissioner(external link)
More information
This information is intended to provide high-level guidance. For more detailed support we recommend you contact either the Office of the Privacy Commissioner or the New Zealand School Board Association - formerly the School Trustees Association (NZSTA).
Contact us – Office of the Privacy Commissioner(external link)
Get in contact – NZSTA(external link)
Last reviewed: Has this been useful? Give us your feedback