Sharing personal information

If you collect, hold or use personal information, you must comply with the Privacy Act 2020. Learn about sharing information regarding specific children or young people.

Level of compliance Main audience Other


  • All early learning services
  • Service managers
  • Parents, caregivers and whānau

What is personal information?

Personal information is information that can identify a person.

Ask: "Could someone identify an individual based on the information I am providing?" If the answer is yes, it is personal information.

Even if you don’t use a child’s full name, any information that provides enough detail for someone to work out or guess their identity is personal information.

This includes:

  • a child’s name
  • contact details
  • behaviours
  • attendance record
  • achievement record
  • National Student Numbers (NSNs)
  • a child's initials alongside other specific details
  • doing a case study that contains enough detail that the individual can be identified.

Information sharing provisions are also included in other legislation that is relevant to the education sector, including the Oranga Tamariki Act 1989 and the Family Violence Act 2018.

Types of personal information you can share

Sometimes personal information will be formally recorded in a register, database or other format. At other times people may bring it to the table for discussion.

It is important that you share only relevant information when considering what learning support a child or young person needs. The types of information you may need to make decisions about appropriate support could include:

  • name, gender and ethnicity, to identify support that reflects the child’s identity and culture
  • date of birth and/or year level, to identify support that is appropriate to their age
  • family circumstances, but only where these are directly relevant to the child’s learning support needs
  • the kind of support required
  • current services/supports being provided
  • additional learning need, for example, dyslexia, autism spectrum.

Get permission before sharing personal information

You can share personal information if you have the person’s agreement (or their parent’s or guardian’s if they are unable to give it themselves). The exception is if there is an immediate risk of harm.

Where appropriate, you should also consider the young person’s own views. There is no legal age at which you must seek consent directly from the young person, but you should think about whether or not they are capable of deciding for themselves.

When you are seeking agreement you should inform the person:

  • why you want to share information (the purpose)
  • what information you plan to share
  • who you plan to share it with
  • how you will keep it safe.

If any of this changes, you should go back again to get their agreement to share their information.

Let the person know if you have agreed as a group that we may use information on the register for the purpose of administration and analysis, for example to find out about the overall numbers of children requiring specific types of support.

This will allow us to plan ahead for numbers of staff and specialists and other services and types of support.

Consent does not need to be written, but you will need to record that it has been given and note any specific views about how information is shared, for example if there are specific people or organisations the information should not be shared with.

Someone can withdraw consent at any time. You will need to make sure that you can respond quickly to remove the information.

Personal information needs to be protected

If you are sharing personal information, it is vital that everyone who has access to it takes steps to keep the information safe and secure.

Here are some suggestions for how to protect the personal information:

  • Restrict access to the information to people who need to see it.
  • If information needs to be discussed in a meeting, take copies along rather than sending them in advance. Collect them in at the end and ensure they are destroyed (for example, shredded or put in a secure document destruction bin).
  • Password-protect all files emailed or uploaded to shared drives.
  • Provide the password for protected files separately (over the phone, via text message or in person).
  • Use a password-protected (encrypted) USB stick or an iron key if you are transporting personal information.
  • Do not talk about personal information with or within hearing range of people who shouldn’t know about it.
  • Do not leave printed material or laptops with personal information unattended.

What happens if a service needs to be offered

In some cases, the group will decide that a service is the best response for an individual child or a group of children. Then the organisation who provides this service (for example, the Ministry of Education), needs to seek informed consent to that service being provided.

There are governing codes that professionals in this situation need to be aware of. If the service is a health service, it falls under the Health Information Privacy Code and the Code of Health and Disability Consumers’ Rights.

Professionals such as psychologists and speech language therapists also have professional codes of ethics that include privacy and confidentiality and will guide how they deal with personal information.

Last reviewed: Has this been useful? Give us your feedback