Resources and learning

Education providers hold a lot of personal information about learners.

On this page:

Download a PDF of the guidance on this page (PDF, 296KB).

Holding only the information that you need (or are required to retain) and securely disposing of information you don’t reduces the risk of unauthorised access, use or disclosure that may result in or contribute to a privacy breach.

It’s also important that decisions you make about learners are informed by accurate and up to date information. Ensuring you dispose of information that is inaccurate or out of date helps ensure you make robust and fair decisions about your learners. For example, using out of date or incorrect information to inform a disciplinary decision can led to an unfair outcome and have long lasting impacts for both you and the learner.

Relevant information privacy principles

The Privacy Act 2020 (the Privacy Act) sets rules about how long an education provider can retain learner’s personal information. The relevant information privacy principle (IPP) is:

Principle 9: don’t keep personal information longer than necessary

An education provider that holds personal information must not keep that information for longer than is required for the purposes for which the information may lawfully be used.

For state and state integrated schools, or any non-government organisation or private business providing services on behalf of a government department (e.g. the Ministry of Education) the retention and disposal requirements set out in the Public Records Act 2005 will override IPP9.

Relationship between the Privacy Act 2020 and the Public Records Act 2005

The Public Records Act 2005 applies to public offices and sets the rules around what information held by a public office must be retained, and for how long. Under the Public Records Act, schools (state and state integrated) are public offices and must comply with the rules set out in that Act.

A non-government organisation (NGO) or private business that provides services on behalf of a public office (e.g. an NGO providing learning support services to learners on behalf of a state or state integrated school or the Ministry of Education) will be required to comply with the Public Records Act with respect to the public records it holds as a result of providing those services.

NGOs or private businesses that are simply funded by a government agency but are not providing services on behalf of the government, are not required to comply with the Public Records Act in relation to the records held as a result of providing those services.

If you are an NGO or a private business providing services under a contractual arrangement and are unsure whether you are required to comply with the Public Records Act check with the contracting agency.

IPP9 of the Privacy Act 2020 requires that personal information is not kept longer than is required for the purposes for which the information can be lawfully used. For the purposes of IPP9, lawful purposes for use can be wider than the purpose for which information was originally obtained.

Any records containing personal information about a learner that don’t fall under the rules set out in the Public Records Act 2005, must be retained and disposed of according to IPP9.

What does retention and disposal mean?

Retention

Retention is the systematic process of storing and managing a learner’s information for a specified period of time making sure that information is accessible and secure until it is no longer required or can legally be disposed of.

Disposal

Disposal is the process by which an agency or organisation manages records longer required for its functions.

Disposal includes:

securely destroying or deleting information
transfer of information to Archives New Zealand (for state and state integrated schools’
discharging information to the care of an organisation (e.g. a library, marae committee) or an individual (requires school board presiding member sign off).

State and state integrated schools

State and state integrated schools are required to comply with both the Public Records Act 2005 and the Privacy Act IPP9 requirements.

The key is knowing what Act applies when and what you are required to do under each.

When the Public Records Act applies

The Public Records Act 2005 is the primary legislation governing the retention and disposal of learner information. It applies to state and state integrated schools and covers school records.

Private schools and charter schools are not subject to the Public Records Act 2005 but must comply with the Privacy Act requirements for retention and disposal of a learner’s personal information.

School records include learner records, correspondence, accounts, assessments and tests, school reports, meeting minutes and photos and videos of learners. Most of the information you created or receive as part of operating your school and delivering education to your learners will be a school record.

In practice most records held by a school will be covered by the Public Records Act. However, there are a couple of limited exceptions:

work produced by a learner (where there is a reasonable expectation that the work will be returned to the learner)
special collections e.g. contents of a school library
unsolicited material received by a school but not related to its functions e.g. informational brochures.

School Records Retention and Disposal Schedule

Requirements for the retention and disposal of school records is set out in the School Records Retention and Disposal schedule (the Schedule). The Schedule includes information about how long to keep school records, why they are kept for that period, and what needs to happen to those records when they are no longer required.

Read more information about the process for transferring records to Archives NZ or discharging records.

When information privacy principle (IPP) 9 applies

Where personal information about a learner is not a school record or related to one of the limited exceptions, then the requirements of IPP9 will apply to the retention and disposal of that information.

When the retention period under the Public Records Act ends, the authorised disposal action can be undertaken. For any records being kept longer than the authorised retention period, the requirements of IPP9 will apply, meaning that the personal information can only be retained if you have a lawful purpose to use it.

ECE services

ECE services are generally not public offices, so they don’t fall under the Public Records Act retention and disposal rules.

ECE services provided by a public office (e.g. a university or polytechnic) will likely be required to comply with the Public Records Act 2005 if they are providing the ECE service on behalf of the public office.

Instead, ECE services must comply with the following:

Education (Early Childhood Services) Regulations 2008.
ECE Funding Handbook requirements.
ECE Licencing Criteria.
IPP9 of the Privacy Act 2020.

The ECE service funding or licencing requirements apply to categories of records that cover all information, not just personal information about your learners. The categories include:

funding and audit records (e.g. attendance, enrolment and fee/payment records)
health and safety records (e.g. accident and incident reports and illness and medication records)
licencing compliance records (e.g. policies, governance records and complaints).

It’s important that you understand the information retention and disposal requirements set out in the regulations, licencing criteria, and funding handbook.

When information privacy principle (IPP) 9 applies

Where personal information about a learner is not covered by retention requirements set out in the ECE regulations, ECE licencing criteria or funding requirements IPP9 will apply to the retention and disposal of that information.

Personal information that is not covered by the ECE service funding or licencing requirements may include:

Information Category	Examples
Learning and Development Records	Teacher observations, assessment notes and internal progress tracking. Draft teaching plans that include personal information about learners.
Parent Communication Records	Learning stories, photos, videos and artwork. Teacher observations, assessment notes and internal progress tracking. Draft teaching plans that include personal information about learners.
Health and Wellbeing Information (additional to that covered in the ECE service funding or licencing requirements)	Information parents may share about allergies, developmental needs or family circumstances. Custody orders or information about family court matters.
Operational/Temporary Records	Consent forms for trips or activities. Internal memos or teacher notes about a child’s behaviour.

Create a retention and disposal schedule

A retention and disposal schedule can help you manage your learner information. It can help make sure you are complying with your funding and licencing requirements and not retaining learner information longer than is necessary.

Your schedule should include your obligations set out in the ECE Licencing Criteria, the ECE Funding Handbook, the requirements of the Education (Early Childhood Services) Regulations 2008, and then what information is then subject to IPP9 requirements.

The following is an example of a retention and disposal template you could use to get you started.

Record type	Record description	Record purpose	Legal requirement to retain	Retention period
Learner Record	Enrolment records	Enrolment agreements are used by the Ministry of Education to verify the days/sessions that each child is enrolled for and expected to attend	ECE Funding Handbook 6-1 ECE Licencing Requirement to collect information in enrolment forms (GMA 10)	ECE Funding Handbook 6-1 retention requirement: 7 years after child leaves the service
Learner Record	Attendance records	Attendance records are used by the Ministry of Education to verify that children have attended the service as claimed and to identify that absence rules have been applied correctly	ECE Funding Handbook 6-3	ECE Funding Handbook 6-3 retention requirement:
Learner Record	Incident/Accident reports	All practicable steps are taken to get immediate medical assistance for a child who is seriously injured or becomes seriously ill, and to notify a parent of what has happened	ECE Licencing Requirement HS27 to have records available for inspection	IPP9 Privacy Act - securely delete records when no longer required for a lawful purpose
Learner Record	Learner stories			IPP9 Privacy Act – securely delete when no longer required for lawful purpose

References to the Funding Handbook, Licencing Criteria, and GMA are correct at time of publication (March 2026). Please check the Ministry of Education or Education Review Office for updates.

Non-government organisations (NGOs) and service providers

Non-government organisations (NGOs) and private businesses are not public offices, so they don’t fall under the Public Records Act retention and disposal rules. Instead, NGOs and private business must comply with IPP9 of the Privacy Act.

Providing services on behalf of a public office

Where an NGO or private business is providing services to a learner on behalf of a public office (e.g. on behalf of a state or state-integrated school or the Ministry of Education) then the records collected and held as a result of providing those services will be public records and subject to the requirements of the Public Records Act 2005.

Care records

Archives NZ has issued a temporary care records protection instruction.

The temporary protection instruction applies to care records created, received or held by public offices. Its purpose is to protect State care records while work is undertaken to review the retention and disposal of State care records.

The effect of the temporary protection instruction means that all State care records must be retained. They must not be disposed of, altered or destroyed without the permission of Archives NZ (you can still transfer care records to Archives NZ).

The temporary protection instruction also applies to records relating to work non-government organisations (NGOs) have carried out on behalf of government organisations covered by the temporary protection instruction.

For more information about Care Records see:

Archive NZ is currently reviewing the retention and disposal settings for care records. You should check the Archives NZ care record webpage for updates on managing care records.

Retention and disposal in practice

This section provides some common examples of retaining or disposing of information in the education sector.

The Care Records Temporary Protection Instruction must be considered when considering retention and disposal of Care Records.

This means that some information that could be disposed of under existing retention and disposal requirements may need to be retained to meet the requirements of the Care Records Temporary Protection Instruction.

Example: Learner’s own work created in the classroom

During the year work created by the learners is displayed in the classroom. This work includes artwork, short stories and poems, and crafts.

In general, a learner’s own work (e.g. classwork, artwork, assignments) is not considered a school record – they are created by the learner as part of their day-to-day learning. If the work identifies the learner (e.g. contains the learner’s name or other identifying information) it will be considered personal information and subject to the requirements of IPP9.

When tidying up a classroom at the end of term, or end of the year, it is a good idea to ask your learners (or their parents in the case of younger learners) whether they would like their work returned to them. If they don’t want the work returned, then you can securely dispose of it.

Example: Learner assessment information

Work submitted by a learner for formal assessment (e.g. exams, internal assessments, portfolios) is considered the learner’s own work. Where there is an expectation that the work will be returned to the learner, then the work submitted by the learner will not be a school record.

If the work is required to be retained as evidence of the assessment results, then the work would be considered a school record and must be retained for the period specified in the School Records – Retention and Disposal Schedule.

The results of the assessment (e.g. marking and any comments made by the marker) are school records and must be retained for the period specified in the School Records – Retention and Disposal Schedule.

Quick Reference Guide: Retaining and disposing of information

Download a printable A3 PDF of this reference guide (PDF, KB).

	Schools	ECE Services	Non-Government Organisations (NGOs)	Private Businesses
Public Records Act status	State and state integrated schools are public offices	ECE services are not public offices	NGOs are not public offices (but may hold public records if they are providing services on behalf of a public office)	Private businesses are not public offices (but may hold public records if they are providing services on behalf of a public office)
Governing legislation and associated requirements	Public Records Act 2005 (applies to school records) IPP9 Privacy Act 2020 (applies to non-school records)	Privacy Act 2020 (IPP9) Education (Early Childhood Services) Regulations 2008 Licencing Criteria for Early Childhood Education and Care Services 2008 (the ECE Licencing Criteria) ECE Funding Handbook	Privacy Act 2020 (IPP9) Public Records Act 2005 will apply to any public records held as a result of providing services on behalf of a public office	Privacy Act 2020 (IPP9) Public Records Act 2005 will apply to any public records held as a result of providing services on behalf of a public office
Disposal authority	Must follow School Records Retention and Disposal Authority (Archives NZ) for managing school records Non-school records must be disposed of when no longer required for lawful purposes	No disposal authority required ECE services must set their own retention periods that comply with Privacy Act and ECE Licencing Criteria and ECE Funding Handbook requirements	No disposal authority required NGOs must comply with Privacy Act 2020 (IPP9) Public Records Act 2005 will apply to any public records held as a result of providing services on behalf of a public office	No disposal authority required Private businesses must comply with Privacy Act 2020 (IPP9) Public Records Act 2005 will apply to any public records held as a result of providing services on behalf of a public office
Disposal method	Secure disposal of school and non-school records required Keep disposal register for school records	Secure disposal required Keep disposal register for school records	Secure disposal required Public Records Act 2005 disposal requirements will apply to any public records held as a result of providing services on behalf of a public office	Secure disposal required Public Records Act 2005 disposal requirements will apply to any public records held as a result of providing services on behalf of a public office
Retention	Retain school records in approved document management systems	Retain learner information required by ECE Licencing Criteria and ECE Funding Handbook in approved document management systems	Retain learner information only as long as necessary Public Records Act 2005 retention requirements will apply to any public records held as a result of providing services on behalf of a public office	Retain learner information only as long as necessary Public Records Act 2005 retention requirements will apply to any public records held as a result of providing services on behalf of a public office