Skip to main content

What DPUP is

The Data Protection and Use Policy (DPUP) describes what ‘doing the right thing’ looks like when you collect or use people’s personal information.

DPUP is for all New Zealanders, particularly agencies and the people who use their services.

DPUP uses the term ‘agency’ to refer to government agencies, non-governmental organisations and other providers of services.

DPUP’s key concepts

DPUP puts people first. It’s about respectful, trusted and transparent use of people’s personal information.

DPUP provides good-practice advice about collecting and using people’s information. It recommends practices that in some places go beyond the law, and in those situations says clearly why it does so. This is because when information is no longer ‘personal’ in terms of the law, it may remain deeply personal and sensitive to the communities it comes from, describes, or is about.

DPUP supports agencies to:

  • be clear about the vital importance of purpose when collecting and using people’s personal information
  • help people to understand what’s happening with their information and what choices they have
  • make it easy for people to see and request correction of their information
  • work together for better insights and outcomes.

Although DPUP is not mandatory, agencies are encouraged to adopt it in a way that makes the most sense for their agency, their work and their communities.

Cabinet endorsed DPUP in November 2019.

Introduction to DPUP

This 3.5-minute video explains DPUP’s key concepts, who it is for, and how it was developed.

Video transcript

[Audio]

Data.


[Visual]

The word data is typed on the screen followed by a full stop.


[Audio]

It can be easy to forget that behind the virtual world of numbers...


[Visual]

The scene zooms in on the full stop at the end of the word ‘Data’. This full stop starts to move upwards in front of other dots, forming a line of data. More lines join, in motion.


[Audio]

...and variables lies something very personal.


[Visual]

On ‘personal’, 1 of the dots stops moving and another dot bumps into it.


[Audio]

Us.


[Visual]

As the narrator speaks the word ‘Us’ the 2 dots join to form a heart. The heart pulses and beats.


[Audio]

He tāngata, the people.


[Visual]

Two people are formed from the heart.


[Audio]

The Data Protection and Use Policy exists to help those who help others,


[Visual]

Zoom in between the 2 people. The cover of the Policy becomes visible. It opens up to reveal a spread with 2 hands on either side.


[Audio]

...understand what ‘doing the right thing’ looks like, when collecting and using data...


[Visual]

As the spread fills the whole frame, the hands come to life and shake as the narrator says ‘doing the right thing’.


[Audio]

...from the people they serve.


[Visual]

The top hand releases brilliant ‘seeds’ of data down towards the lower hand­. Some trickle down like sand, some hover in space.


[Audio]

Because it’s essential to ensure the information of all people in Aotearoa is collected,


[Visual]

We zoom into this data seed ‘matrix’ so the hands disappear. The camera moves through space dodging though the data seeds. Pause on a data seed to show a person in a data seed.


[Audio]

...stored, accessed and shared in ways that are respectful, trusted and transparent.


[Visual]

The data seed with a person inside it, holding a baby, pans to a seed with a wharenui. The wharenui fills the frame. The roof, sides and floor of the wharenui morph into a trinity knot, symbolising trust. The 3 rounded shapes then morph and collect into a circle which in turn morphs into a lightbulb.


[Audio]

The Policy has been developed under the kaupapa of togetherness...


[Visual]

The light-bulb moves up, flashes then zooms out to show the lightbulb above 3 heads.


[Audio]

...and so places emphasis on relationships, not rules.


[Visual]

Focus goes to the middle person who is now encapsulated in a circle. Other circles containing people pop up around them, with lines showing relationships.


[Audio]

It recognises that data is not owned by the people or organisations who collect and use it,


[Visual]

Zoom in on one of the ‘relationship’ circles to reveal it is a small terrarium, a protective small glass dome containing the seeds of data. Two more terrariums are added to the scene, slid in from each side.


[Audio]

...but that they share a responsibility for its care and correct use.


[Visual]

A hand comes and gently lifts the lid from the terrarium in the middle, as the seeds sink down into the soil below.


[Audio]

Every action taken, and decision made with data,


[Visual]

We see the seeds below the ground and we zoom in on one. It cracks open and begins to sprout beneath the ground.


[Audio]

...should be with the following question in mind,


[Visual]

The sprout grows from the dark up into the light.


[Audio]

...“How does this contribute toward the wellbeing of the individual or community?”


[Visual]

More plants grow up around it. The scene shifts, focusing on the sun above the growing plants, and then downwards to a map of Aotearoa New Zealand.


[Audio]

If your work is within the social sector, supporting the wellbeing of New Zealanders,


[Visual]

We keep tracking up to see the sun behind the plants. Track down to see the plants are replaced by a map of New Zealand­. Zoom into a house on the map.


[Audio]

...then the information in this Policy has been created with people like you,


[Visual]

House rearranges into whiteboard showing 3 interlinked circles.


[Audio]

...for you — and the people you are serving.


[Visual]

The whiteboard rearranges into hospital. The doors of the hospital slide open.


[Audio]

In particular, if you work at the frontline collecting data,


[Visual]

Zoom into the hospital to reveal a person behind a front desk, a person approaches and hands them a terrarium of data.


[Audio]

...are part of a funding organisation,


[Visual]

Three hands are shown, palms up.


[Audio]

...or work to develop insights about the social sector —


[Visual]

The 3 hands are withdrawn and replaced by a hand with a jigsaw piece of data.


[Audio]

...the Policy delivers practical, capability-building guidance...


[Visual]

The hand pans to a computer with a jigsaw piece missing. The hand holding the jigsaw piece of data reappears and puts the jigsaw piece in place, completing the computer screen. Zoom in to the dots on the computer.


[Audio]

...to help you recognise your role as kaitiaki,


[Visual]

Zoom in fast to a section of the dots that are in a ‘step’ format­. Legs enthusiastically skip up the steps and land on the top dot. Pan up to see the face and body of the social sector person holding documents.


[Audio]

...and empower people with choice, respect and clear communication...


[Visual]

As if they are all standing around a circle below, different people rotate into frame, holding their own terrariums with data seeds.


[Audio]

...when it comes to their information.


[Visual]

Lands on last person holding their terrarium with data seeds.


[Audio]

We heard from over one thousand voices across the sector,


[Visual]

The last person forms a speech bubble. Pan away to multiple speech bubbles in the air in 4 different colours.


[Audio]

...where 4 main themes were identified...


[Visual]

The speech bubbles swirl in the air.


[Audio]

...that would benefit from clear guidance.


[Visual]

The speech bubbles reorganise into lines of colours: teal, purple, blue and green.


[Audio]

These have been presented within the Policy as the 4 Guidelines:


[Visual]

The speech bubbles, sorted according to colour, fall into 4 separate bags.


[Audio]

Purpose Matters is all about the why.


[Visual]

Zoom in on the first bag. A circle on the front of the bag turns around flips from ‘1’ to read ‘Purpose Matters’ and quickly becomes the dot in a question mark.


[Audio]

Transparency and Choice discusses engagement and empowerment.


[Visual]

Zoom back in on the dot of the question mark rotates and the text changes to ‘Transparency and Choice’. The circle splits into 2 speech bubbles which slide out on either side.


[Audio]

Access to Information outlines people’s rights,


[Visual]

The 2 speech bubbles merge back into one circle. The circle rotates and changes to the text ‘Access to Information’. The circle rotates and becomes a set of keys.


[Audio]

...and Sharing Value enables insights and collaboration.


[Visual]

The keys rotate into a circle with the text: ‘Sharing Value’. And petals of a flower blossom around it.


[Audio]

Watch the 4 additional videos in this series to find out more about each Guideline.


[Visual]

A play icon appears within the flower as the petals rotate out of view and 3 more play icons pop out, all colour coded. We zoom into one of the icons as a gateway to the next scene.


[Audio]

To help you adopt and implement the guidelines within this Policy,


[Visual]

A cursor hovers and clicks on the icon, which turns into a computer screen.


[Audio]

...an online toolkit has been created.


[Visual]

Zoom into the computer screen which turns into a door and door handle on the screen. A welcome mat reads: ‘Haere mai’. Zoom into the front door.


[Audio]

This will be a rich, central, resource centre...


[Visual]

The front door turns into a play icon.


[Audio]

...housing videos, factsheets, checklists, agreement examples, case studies and templates,


[Visual]

The icon rotates into the different symbols and lands on a template / document symbol.


[Audio]

...as the Social Wellbeing Agency and other agencies begin using the Policy in their work.


[Visual]

Zoom back out of the storehouse, front door and out of the computer screen.


[Audio]

This Policy is our policy together...


[Visual]

It flips to portrait and becomes the policy document which is held above a person’s head.


[Audio]

...Mahitahitanga...


[Visual]

Pan down, as the policy is brought down in front of a person, holding it to her chest.


[Audio]

...and as it is woven and applied within each individual organisation,


[Visual]

Pan out from the person to 3 people, each holding the policy.


[Audio]

...the collective value for the social sector and the people,


[Visual]

Pan out further to 5 people, holding the policy. Plants are depicted behind them.


[Audio]

...whānau and communities it serves, is grown.


[Visual]

Pan stops revealing full picture of people and plants.


[Audio]

Start today.


[Visual]

Pan up from people, through the sky to the website text: digital.govt.nz/dpup.


[Audio]

Respectful. Trusted. Transparent.


[Visual]

Data flows in the air and the New Zealand Government and and Department of Internal Affairs logos appear.

Personal and non-personal information

DPUP uses the terms ‘personal information’ and ‘non-personal information’.

  • Personal information is information that does, or could be used to, identify individual people.
  • Non-personal information does not identify individual people, and cannot be used to, even if it is combined with other information.

DPUP states when its advice applies to personal information, non-personal information, or both. It also uses the terms ‘data’ and ‘information’ interchangeably.

DPUP’s structure

DPUP consists of 5 Principles and 4 Guidelines. These make up the policy. It also includes practical guidance that wraps around the policy, so agencies can use it in their work.

The Principles focus on values and behaviours. The Guidelines bring the Principles to life by explaining good practice in critical areas that make the most difference. This has a significant impact on people’s trust and confidence.

Although the Principles and Guidelines are different, they overlap and this is intentional.

DPUP Principles

These define a common set of values and behaviours. They help agencies to provide people with respectful and transparent interactions and practices.

Because the Principles have people and their wellbeing at the centre, the focus for agencies is on relationships, rather than rules. It’s a way of working that respects people, their information and their stories.

The Principles were developed to respect and acknowledge cultural considerations. A range of Māori stakeholders contributed to the Principles, and their names and meanings.

The 5 Principles are:

He Tāngata

  • Focus on improving people’s lives — individuals, children and young people, whānau, iwi and communities.
  • Strive to create positive outcomes from any collection, sharing or use of data and information.
  • Use checks and balances, and ensure that the information collected or used is reasonably necessary for the purpose.

He Tāngata Principle

Manaakitanga

  • Respect and uphold the mana and dignity of the people, whānau, communities or groups who share their data and information.
  • Recognise and incorporate diverse cultural interests, perspectives and needs.
  • Include and involve service users whenever possible.
  • Incorporate people’s views when they have a specific interest in what is done with their information.

Manaakitanga Principle

Mana Whakahaere

  • Empower people by giving them choices and enabling their access to and use of their data and information.
  • Where possible, give people choices and respect the choices they make.
  • Give people easy access to and oversight of their information wherever possible.

Mana Whakahaere Principle

Kaitiakitanga

  • Act as a steward in a way that people understand and trust.
  • Recognise you are a kaitiaki rather than an owner of people’s information.
  • Be open and transparent — support people’s interest or need to understand.
  • Keep data and information safe and secure and respect its value.
  • If there’s a privacy breach, act quickly and openly.

Kaitiakitanga Principle

Mahitahitanga

  • Work as equals to create and share valuable knowledge.
  • Work with other agencies to create and share value together.
  • Carefully share relevant information so people get the support they want and need.
  • Grow collective knowledge and improve services through 2-way sharing of non-personal information.

Mahitahitanga Principle

Read the DPUP Principles

DPUP Guidelines

These key activities describe good practice and ways to apply the Principles to an agency’s everyday business. The Guidelines help agencies to understand and apply good practice, including many key aspects of the Privacy Act 2020, in relation to these activities.

Agencies need to apply the Guidelines in a way that makes sense for the:

  • type of work they do
  • people they work for
  • range and sensitivity of information they hold about people.

The 4 Guidelines include:

Purpose Matters

  • Be clear about the purpose of collecting or using people’s information. Collect only what is needed.
  • Consider how using people’s information might affect their wellbeing and their trust in those using it.

Purpose Matters Guideline

Transparency and Choice

  • Be transparent and help people understand why their information is needed and what happens with it.
  • As much as possible, support their choices about what they want to share and how they want it used.

Transparency and Choice Guideline

Access to Information

  • Be proactive about supporting people to understand what information is held about them, their rights to access it and ask for corrections to be made.
  • Look for ways to make this easy and safe for service users.

Access to Information Guideline

Sharing Value

  • Work together to ensure information used to create insights is relevant and usefully describes real experiences.
  • Share insights to help grow knowledge and support wellbeing.

Sharing Value Guideline

Read the DPUP Guidelines 

Practical guidance

The practical guidance under ‘Before you start to use DPUP’ and ‘Use DPUP in your work’ includes information, examples and resources to support you in applying DPUP in your everyday work.

The guidance helps you to:

  • develop a good understanding of DPUP
  • plan for adopting DPUP in your organisation
  • apply DPUP in your work.

Before you start to use DPUP

Use DPUP in your work

Contact us

If you have questions about DPUP, or want a PDF of the policy, email gcpo@dia.govt.nz.

Utility links and page information

Was this page helpful?
Thanks, do you want to tell us more?

Do not enter personal information. All fields are optional.

Last updated