Skip to main content

How the DPUP Guidelines and Principles support each other

While the Data Protection and Use Policy (DPUP) Principles describe values and behaviours, the Guidelines offer detailed advice on key topics that are relevant to different situations and roles.

When to use the guidelines

The guidelines provide good practice advice when working with people's information, including:

  • deciding what and when to collect
  • how to support people’s understanding of what happens with their information
  • helping people understand and use their rights
  • ensuring that communities are involved in the development and use of insights that may affect them.

When to use the Purpose Matters Guideline

When collecting or using information that is or was about people

This Guideline should be used when an agency is deciding whether to collect or use information that is or was about people who use services.

From a privacy perspective, questions of purpose generally come up in relation to the use of personal information. However, questions of purpose can also arise when personal information has been de-identified or anonymised.

Because the Privacy Act 2020 regulates what is done with personal information (not non-personal information) its legal controls do not apply to de-identified or anonymised information. However, ethical and other issues can still arise.

For these reasons, this Guideline is relevant to the collection and use of:

  • personal information
  • non-personal information that, prior to de-identification, was personal information.
Examples of when de-identified information may still be inappropriate to use
  • Personal information, in the form of information about identifiable individuals, may be removed from a dataset that was collected for a given purpose. However, if the information is culturally sensitive or otherwise of interest to Māori, using it even in de-identified form for another purpose without involving Māori may not be appropriate.
  • Personal information may be removed from the description of a serious offence against a child or another vulnerable member of society, resulting in there being no reasonable prospect of the child or other vulnerable person being identified. That does not necessarily mean it's ethically appropriate to use the information for any other purpose, particularly when publication is involved.

Purpose Matters Guideline

When to use the Transparency and Choice Guideline

When deciding how to inform people about the collection and use of their information and giving them choice

Use this Guideline when deciding how to help service users understand why their information needs to be collected, how it will be used and what rights and choices they have.

The Guideline applies to agencies collecting information:

  • directly from service users, including non-governmental organisations and other service delivery organisations
  • through other agencies and organisations.

This Guideline is mostly about people’s understanding and rights in relation to their personal information. However, people often think of information they have supplied, or is about them, as personal even when it has been de-identified or anonymised and is being used in a non-personal form.

For this reason, the Guideline recommends practices relating to the use of this type of information as well. The relevant sections of the Guideline make it clear when those additional recommended actions are not required by the Privacy Act 2020.

Transparency and Choice Guideline

When to use the Access to Information Guideline

When defining processes that ensure people's information can be easily accessed

This Guideline is for people involved in:

  • collecting, storing or recording personal information collected from or about service users
  • identifying or designing methods and practices to ensure that information is readily available if and when service users ask about it
  • managing or designing services that service users regularly use, for example digital and face-to-face channels, during which they may voice an interest in their information.

The practices described in this Guideline may sometimes be carried out by people outside of the areas of responsibility identified above.

In these situations, the responsibility to enable and apply those practices may sit with people in a range of different roles, who will need to know about and understand this Guideline.

Access to Information Guideline

When to use the Sharing Value Guideline

When working together for better insights and outcomes

This Guideline is for people involved in collecting or using personal or non-personal information for these purposes:

  • managing funding and contracting processes between service providers and funders
  • carrying out analytical or research activities to support policy or service development
  • developing or enabling research or analytical capability through the development of datasets
  • understanding the operational performance or effectiveness of services and programmes.

This Guideline generalises these sorts of purposes as being activities which focus on the production of ‘insights’ (as defined in DPUP terminology).

While this Guideline is only concerned with sharing insights in the form of non-personal information, it includes considerations that relate to collection of personal information for developing those insights.

Sharing Value Guideline

How the Guidelines relate to each other

Elements of each Guideline inform the other Guidelines.

How Purpose Matters informs the other 3 guidelines

To be clear about the purposes of collecting personal information, only collect what’s needed and consider how collection and use could affect people's wellbeing. Agencies need to:

  • help people understand why their information is needed and what their rights are. The purpose of collection is a key aspect of what agencies need to tell people when collecting their personal information
    Transparency and Choice Guideline
  • help people understand their rights of access, have control over their information where possible, and make it easy for them to exercise their rights. Understanding the purposes of collection, in the context of the intended outcomes and methods of processing, can influence how people are given access to their information and how they can request that inaccuracies be corrected
    Access to Information Guideline
  • work together to develop valuable insights from information collected from or about service users and share the value of those insights with others. Involving others in the design and implementation of intended collection and use processes may influence how the purposes of collection are formulated and communicated to people and how much information needs to be collected.
    Sharing Value Guideline

How Transparency and Choice informs the other 3 guidelines

When collecting information from people, help them understand why it’s being collected, how that might help them or people in similar circumstances, and what rights they have to access and request changes. Provide them with choices whenever possible and:

  • identify if there are any negative consequences to the outcome (for example, people not using a service because they’re worried about what might happen to their information) and enable choices where possible.
    Purpose Matters Guideline
  • consider ways to enable people to understand and exercise their rights to access and request correction of their personal information.
    Access to Information Guideline
  • make sure that when information is collected to improve outcomes, service users can be given examples of where and how this will occur or has occurred.
    Sharing Value Guideline

How Access to Information informs the other 3 guidelines

Help people to understand what personal information is held about them, how to access it, request correction of it and, where possible, correct it themselves, by:

  • understanding why it’s important to be clear about the purpose information is collected for, and how to do that. Service users can only ensure information is accurate and relevant to the purpose of collection if they are given a reasonable understanding of what information is held about them, and why it is held.
    Purpose Matters Guideline
  • acknowledging that a service user should be enabled to understand, and what rights and choices they should be informed about when information is collected from them, including the rights discussed in this Guideline.
    Transparency and Choice Guideline
  • understanding the importance of collaborating with people who have a rich knowledge of the information and the people it represents to achieve the best outcomes. This sets an expectation that when information is collected to improve outcomes for service users, they can be given examples of where and how this has occurred, if they express any interest in what is happening with their information.
    Sharing Value Guideline

How Sharing Value informs the other 3 guidelines

Work together and be inclusive to ensure that information used to create insights is relevant and usefully describes real experiences. The Sharing Value Guideline supports the other Guidelines by helping agencies to:

How the Guidelines work with the Principles

Because the Guidelines flow in part from the DPUP Principles, it's useful to read the Guidelines with the 5 Principles in mind.

How to use Purpose Matters with the Principles

The Principles can help identify considerations that are relevant to understanding and framing purposes for collecting and using information about people, even where these considerations may exceed minimum legal requirements.

He Tāngata

Are purposes of collection and use clearly focused on positive outcomes (whether for individuals, groups or wider society) and is the information to be collected or used necessary to achieve those outcomes?

He Tāngata Principle

Manaakitanga

Is the collection or use of people’s information for particular purposes sufficiently respectful of them or the cultures, communities or groups to which they belong? Does it support or detract from their wellbeing?

Manaakitanga Principle

Mana Whakahaere

To what extent, given the purposes of collecting personal information, can an agency allow people to opt out of providing their information?

Mana Whakahaere Principle

Kaitiakitanga

How, as a kaitiaki of people’s information, can the purposes of collecting or using that information be framed in a manner that is easy to explain to people and that fosters their understanding and trust in what is being done with their information?

Kaitiakitanga Principle

Mahitahitanga

To what extent can involving others help to formulate and double-check if proposed collections and uses of people's information are appropriate?

Mahitahitanga Principle

How to use Transparency and Choice with the Principles

The Principles can help identify considerations that are relevant to providing people with choices where possible and helping them to understand what happens with their information.

He Tāngata

Will service users understand that providing their information is either useful or necessary to help them, or may help people in similar circumstances?

He Tāngata Principle

Manaakitanga

What actions can be taken to uphold people’s mana by involving them in defining useful steps to take to improve understanding of their choices?

Manaakitanga Principle

Mana Whakahaere

How can people be empowered to make decisions by knowing what their choices are and the value of those choices?

Mana Whakahaere Principle

Kaitiakitanga

As kaitiaki of people’s personal information, how can agencies keep track of and communicate how the information in their care is used and the improved outcomes it enables?

Kaitiakitanga Principle

Mahitahitanga

How can agencies work together, for example funders and service providers, to improve transparency and provide clear information about and support for choices for all those involved?

Mahitahitanga Principle

How to use Access to Information with the Principles

The Principles can help identify considerations for enabling people to access their information.

He Tāngata

How can service users understand the link between the information stored about them and the ways in which it is intended to be used?

He Tāngata Principle

Manaakitanga

How can agencies acknowledge and uphold people’s mana by considering what information is recorded about them, how it is recorded and how they can access it?

Manaakitanga Principle

Mana Whakahaere

How can people be empowered by ensuring their needs and wishes about accessing their information are understood, captured and addressed?

Mana Whakahaere Principle

Kaitiakitanga

How can kaitiaki of the information contribute to service users’ understanding of how information about them is held and enable easy access to their information?

Kaitiakitanga Principle

Mahitahitanga

How can agencies work together to enable service users’ rights of access and be responsive to their requests for access and correction?

Mahitahitanga Principle

How to use Sharing Value with the Principles

The Principles can help identify considerations that are relevant to sharing insights with people working on related outcomes, including service users themselves.

He Tāngata

What insights will help to improve outcomes for people?

He Tāngata Principle

Manaakitanga

In doing this work, what actions can agencies do to enhance the mana of people involved in the delivery or use of relevant services?

Manaakitanga Principle

Mana Whakahaere

How can agencies recognise and respect people as the source of information and ensure they understand, and have input into, the value of insights derived from their information?

Mana Whakahaere Principle

Kaitiakitanga

As kaitiaki of the data what might the people involved in delivering or using services want from the outputs of the work?

Kaitiakitanga Principle

Mahitahitanga

By involving others who work on related outcomes what additional value could be created by working together?

Mahitahitanga Principle

Utility links and page information

Was this page helpful?
Thanks, do you want to tell us more?

Do not enter personal information. All fields are optional.

Last updated