What DPUP is
The Data Protection and Use Policy (DPUP) describes what ‘doing the right thing’ looks like when you collect or use people’s personal information.
DPUP is for all New Zealanders, particularly agencies and the people who use their services.
DPUP uses the term ‘agency’ to refer to government agencies, non-governmental organisations and other providers of services.
Read the 1-page DPUP overview
- Data Protection and Use Policy — an overview
- Data Protection and Use Policy — an overview (PDF 127KB)
- Data Protection and Use Policy — an overview (PPTX 1.2MB)
DPUP’s key concepts
DPUP puts people first. It’s about respectful, trusted and transparent use of people’s personal information.
DPUP provides good-practice advice about collecting and using people’s information. It recommends practices that in some places go beyond the law, and in those situations says clearly why it does so. This is because when information is no longer ‘personal’ in terms of the law, it may remain deeply personal and sensitive to the communities it comes from, describes, or is about.
DPUP supports agencies to:
- be clear about the vital importance of purpose when collecting and using people’s personal information
- help people to understand what’s happening with their information and what choices they have
- make it easy for people to see and request correction of their information
- work together for better insights and outcomes.
Although DPUP is not mandatory, agencies are encouraged to adopt it in a way that makes the most sense for their agency, their work and their communities.
Cabinet endorsed DPUP in November 2019.
Introduction to DPUP
This 3.5-minute video explains DPUP’s key concepts, who it is for, and how it was developed.
Video transcript
[Audio]
Data.
[Visual]
The word data is typed on the screen followed by a full stop.
[Audio]
It can be easy to forget that behind the virtual world of numbers...
[Visual]
The scene zooms in on the full stop at the end of the word ‘Data’. This full stop starts to move upwards in front of other dots, forming a line of data. More lines join, in motion.
[Audio]
...and variables lies something very personal.
[Visual]
On ‘personal’, 1 of the dots stops moving and another dot bumps into it.
[Audio]
Us.
[Visual]
As the narrator speaks the word ‘Us’ the 2 dots join to form a heart. The heart pulses and beats.
[Audio]
He tāngata, the people.
[Visual]
Two people are formed from the heart.
[Audio]
The Data Protection and Use Policy exists to help those who help others,
[Visual]
Zoom in between the 2 people. The cover of the Policy becomes visible. It opens up to reveal a spread with 2 hands on either side.
[Audio]
...understand what ‘doing the right thing’ looks like, when collecting and using data...
[Visual]
As the spread fills the whole frame, the hands come to life and shake as the narrator says ‘doing the right thing’.
[Audio]
...from the people they serve.
[Visual]
The top hand releases brilliant ‘seeds’ of data down towards the lower hand. Some trickle down like sand, some hover in space.
[Audio]
Because it’s essential to ensure the information of all people in Aotearoa is collected,
[Visual]
We zoom into this data seed ‘matrix’ so the hands disappear. The camera moves through space dodging though the data seeds. Pause on a data seed to show a person in a data seed.
[Audio]
...stored, accessed and shared in ways that are respectful, trusted and transparent.
[Visual]
The data seed with a person inside it, holding a baby, pans to a seed with a wharenui. The wharenui fills the frame. The roof, sides and floor of the wharenui morph into a trinity knot, symbolising trust. The 3 rounded shapes then morph and collect into a circle which in turn morphs into a lightbulb.
[Audio]
The Policy has been developed under the kaupapa of togetherness...
[Visual]
The light-bulb moves up, flashes then zooms out to show the lightbulb above 3 heads.
[Audio]
...and so places emphasis on relationships, not rules.
[Visual]
Focus goes to the middle person who is now encapsulated in a circle. Other circles containing people pop up around them, with lines showing relationships.
[Audio]
It recognises that data is not owned by the people or organisations who collect and use it,
[Visual]
Zoom in on one of the ‘relationship’ circles to reveal it is a small terrarium, a protective small glass dome containing the seeds of data. Two more terrariums are added to the scene, slid in from each side.
[Audio]
...but that they share a responsibility for its care and correct use.
[Visual]
A hand comes and gently lifts the lid from the terrarium in the middle, as the seeds sink down into the soil below.
[Audio]
Every action taken, and decision made with data,
[Visual]
We see the seeds below the ground and we zoom in on one. It cracks open and begins to sprout beneath the ground.
[Audio]
...should be with the following question in mind,
[Visual]
The sprout grows from the dark up into the light.
[Audio]
...“How does this contribute toward the wellbeing of the individual or community?”
[Visual]
More plants grow up around it. The scene shifts, focusing on the sun above the growing plants, and then downwards to a map of Aotearoa New Zealand.
[Audio]
If your work is within the social sector, supporting the wellbeing of New Zealanders,
[Visual]
We keep tracking up to see the sun behind the plants. Track down to see the plants are replaced by a map of New Zealand. Zoom into a house on the map.
[Audio]
...then the information in this Policy has been created with people like you,
[Visual]
House rearranges into whiteboard showing 3 interlinked circles.
[Audio]
...for you — and the people you are serving.
[Visual]
The whiteboard rearranges into hospital. The doors of the hospital slide open.
[Audio]
In particular, if you work at the frontline collecting data,
[Visual]
Zoom into the hospital to reveal a person behind a front desk, a person approaches and hands them a terrarium of data.
[Audio]
...are part of a funding organisation,
[Visual]
Three hands are shown, palms up.
[Audio]
...or work to develop insights about the social sector —
[Visual]
The 3 hands are withdrawn and replaced by a hand with a jigsaw piece of data.
[Audio]
...the Policy delivers practical, capability-building guidance...
[Visual]
The hand pans to a computer with a jigsaw piece missing. The hand holding the jigsaw piece of data reappears and puts the jigsaw piece in place, completing the computer screen. Zoom in to the dots on the computer.
[Audio]
...to help you recognise your role as kaitiaki,
[Visual]
Zoom in fast to a section of the dots that are in a ‘step’ format. Legs enthusiastically skip up the steps and land on the top dot. Pan up to see the face and body of the social sector person holding documents.
[Audio]
...and empower people with choice, respect and clear communication...
[Visual]
As if they are all standing around a circle below, different people rotate into frame, holding their own terrariums with data seeds.
[Audio]
...when it comes to their information.
[Visual]
Lands on last person holding their terrarium with data seeds.
[Audio]
We heard from over one thousand voices across the sector,
[Visual]
The last person forms a speech bubble. Pan away to multiple speech bubbles in the air in 4 different colours.
[Audio]
...where 4 main themes were identified...
[Visual]
The speech bubbles swirl in the air.
[Audio]
...that would benefit from clear guidance.
[Visual]
The speech bubbles reorganise into lines of colours: teal, purple, blue and green.
[Audio]
These have been presented within the Policy as the 4 Guidelines:
[Visual]
The speech bubbles, sorted according to colour, fall into 4 separate bags.
[Audio]
Purpose Matters is all about the why.
[Visual]
Zoom in on the first bag. A circle on the front of the bag turns around flips from ‘1’ to read ‘Purpose Matters’ and quickly becomes the dot in a question mark.
[Audio]
Transparency and Choice discusses engagement and empowerment.
[Visual]
Zoom back in on the dot of the question mark rotates and the text changes to ‘Transparency and Choice’. The circle splits into 2 speech bubbles which slide out on either side.
[Audio]
Access to Information outlines people’s rights,
[Visual]
The 2 speech bubbles merge back into one circle. The circle rotates and changes to the text ‘Access to Information’. The circle rotates and becomes a set of keys.
[Audio]
...and Sharing Value enables insights and collaboration.
[Visual]
The keys rotate into a circle with the text: ‘Sharing Value’. And petals of a flower blossom around it.
[Audio]
Watch the 4 additional videos in this series to find out more about each Guideline.
[Visual]
A play icon appears within the flower as the petals rotate out of view and 3 more play icons pop out, all colour coded. We zoom into one of the icons as a gateway to the next scene.
[Audio]
To help you adopt and implement the guidelines within this Policy,
[Visual]
A cursor hovers and clicks on the icon, which turns into a computer screen.
[Audio]
...an online toolkit has been created.
[Visual]
Zoom into the computer screen which turns into a door and door handle on the screen. A welcome mat reads: ‘Haere mai’. Zoom into the front door.
[Audio]
This will be a rich, central, resource centre...
[Visual]
The front door turns into a play icon.
[Audio]
...housing videos, factsheets, checklists, agreement examples, case studies and templates,
[Visual]
The icon rotates into the different symbols and lands on a template / document symbol.
[Audio]
...as the Social Wellbeing Agency and other agencies begin using the Policy in their work.
[Visual]
Zoom back out of the storehouse, front door and out of the computer screen.
[Audio]
This Policy is our policy together...
[Visual]
It flips to portrait and becomes the policy document which is held above a person’s head.
[Audio]
...Mahitahitanga...
[Visual]
Pan down, as the policy is brought down in front of a person, holding it to her chest.
[Audio]
...and as it is woven and applied within each individual organisation,
[Visual]
Pan out from the person to 3 people, each holding the policy.
[Audio]
...the collective value for the social sector and the people,
[Visual]
Pan out further to 5 people, holding the policy. Plants are depicted behind them.
[Audio]
...whānau and communities it serves, is grown.
[Visual]
Pan stops revealing full picture of people and plants.
[Audio]
Start today.
[Visual]
Pan up from people, through the sky to the website text: digital.govt.nz/dpup.
[Audio]
Respectful. Trusted. Transparent.
[Visual]
Data flows in the air and the New Zealand Government and and Department of Internal Affairs logos appear.
Personal and non-personal information
DPUP uses the terms ‘personal information’ and ‘non-personal information’.
- Personal information is information that does, or could be used to, identify individual people.
- Non-personal information does not identify individual people, and cannot be used to, even if it is combined with other information.
DPUP states when its advice applies to personal information, non-personal information, or both. It also uses the terms ‘data’ and ‘information’ interchangeably.
DPUP’s structure
DPUP consists of 5 Principles and 4 Guidelines. These make up the policy. It also includes practical guidance that wraps around the policy, so agencies can use it in their work.
The Principles focus on values and behaviours. The Guidelines bring the Principles to life by explaining good practice in critical areas that make the most difference. This has a significant impact on people’s trust and confidence.
Although the Principles and Guidelines are different, they overlap and this is intentional.
DPUP Principles
These define a common set of values and behaviours. They help agencies to provide people with respectful and transparent interactions and practices.
Because the Principles have people and their wellbeing at the centre, the focus for agencies is on relationships, rather than rules. It’s a way of working that respects people, their information and their stories.
The Principles were developed to respect and acknowledge cultural considerations. A range of Māori stakeholders contributed to the Principles, and their names and meanings.
The 5 Principles are:
DPUP Guidelines
These key activities describe good practice and ways to apply the Principles to an agency’s everyday business. The Guidelines help agencies to understand and apply good practice, including many key aspects of the Privacy Act 2020, in relation to these activities.
Agencies need to apply the Guidelines in a way that makes sense for the:
- type of work they do
- people they work for
- range and sensitivity of information they hold about people.
The 4 Guidelines include:
Practical guidance
The practical guidance under ‘Before you start to use DPUP’ and ‘Use DPUP in your work’ includes information, examples and resources to support you in applying DPUP in your everyday work.
The guidance helps you to:
- develop a good understanding of DPUP
- plan for adopting DPUP in your organisation
- apply DPUP in your work.
Contact us
If you have questions about DPUP, or want a PDF of the policy, email dataethics@stats.govt.nz.
Utility links and page information
Last updated
