Skip to content

What is personal information and the Privacy Act?

Data can contain values that identify a specific individual. This is called 'personal information' in New Zealand but is sometimes referred to as Personal Identifiable Information (PII). The Privacy Act 1993 controls how 'agencies' collect, use, disclose, store and give access to personal information. The Privacy Act applies to almost every person, business or organisation in New Zealand.

Learning outcomes

  • Recognise personal information in your data.
  • Understand how the Privacy Act applies to personal information.

Personal information

The Office of the Privacy Commissioner develops and promotes a culture in which personal information is protected and respected. They define what is considered to be personal information, and provide guidance surrounding the Privacy Act, its principles and other privacy codes.

This includes data such as:

  • Names
  • Phone numbers
  • Email addresses
  • Other observations where an individual is identified.

Note: where the above data is already public knowledge then this is ok to include in an open dataset. For example, the dataset of Marriage Celebrants on data.govt.nz includes contact details for these people, however, this data is public knowledge and already released elsewhere publicly (reading over the Privacy Act Principles helps to clarify any exemptions such as this). 

Privacy Act

The Privacy Act consists of 12 Principles which apply to data in New Zealand:

  • Principle 1: Purpose of collection of personal information
  • Principle 2: Source of personal information
  • Principle 3: Collection of information from subject
  • Principle 4: Manner of collection of personal information
  • Principle 5: Storage and security of personal information
  • Principle 6: Access to personal information
  • Principle 7: Correction of personal information
  • Principle 8: Accuracy, etc., of personal information to be checked before use
  • Principle 9: Agency not to keep personal information for longer than necessary
  • Principle 10: Limits on use of personal information
  • Principle 11: Limits on disclosure of personal information
  • Principle 12: Unique identifiers.

Detailed guidance


Top