Resources and learning

Being transparent about how you collect, use, and share personal information is a requirement of the Privacy Act.

On this page:

Download a PDF of the guidance on this page (PDF, 504KB).

Transparency also helps you build trust and confidence in the way your organisation manages personal information. It also helps ensure learners are aware of their privacy rights and how they can exercise those rights.

Informing learners (or their parents where appropriate) about collecting their information is not a ‘one and done’ thing. Each time you collect personal information you need to think about how you inform them and what that communication should look like.

Relevant information privacy principles

The Privacy Act 2020 sets rules about when and how an education provider is required to inform learners when collecting their personal information.

The relevant information privacy principles (IPPs) are:

Principle 3: Collection of information from an individual

When an education provider collects personal information directly from a learner you must take steps that are reasonable in the circumstances to inform the learner of:

the fact that information is being collected
the purpose for which the information is being collected
the intended recipients of the information
the name and address of the education provider collecting and holding the information
if the collection of information is required by law, the particular law under which the information is required, and whether the supply of information is voluntary or mandatory
the consequences, if any, of not supplying the information
the rights of access to and correction of the information supplied.

Principle 3A: Indirect collection (applicable from 1 May 2026)

When an education provider collects personal information from someone other than the learner (e.g. their parents or another person), you must take steps that are reasonable in the circumstances to inform the learner of:

the fact that information is being collected
the purpose for which the information is being collected
the intended recipients of the information
the name and address of the education provider collecting and holding the information
if the collection of information is required by law, the particular law under which the information is required
the rights of access to and correction of the information supplied.

When do the notification requirements apply?

IPP3 applies when you collect personal information directly from a learner.

Being transparent about your collections builds trust. If you are transparent about how you manage a learner’s personal information, then they will be more likely to share their information with you.

The reality is that education providers collect a significant amount of personal information about learners from their parents (or guardians) under exceptions to IPP 2. This means that the requirements of IPP3 won’t apply where you have collected a learner’s personal information from their parent or guardian or someone else.

IPP3A applies when you collect personal information about a learner from someone else (e.g. a learner’s parent, legal guardian).

When IPP3 and IPP3A applies: flow chart

Download a printable PDF version of this flowchart (PDF, 204 KB).

Flowchart for determining how IPP3 and IPP3A applies to collection of personal information.

How to inform learners and parents

IPP3 and IPP3A require that you inform the individual whose information you are collecting about the collection. However, in the education sector this may not be straightforward due to the age and capacity of your learners, and the fact that in many cases you will be collecting information about your learners from their parents.

IPP3 and IPP3A require education providers to take all steps, that are reasonable in the circumstances, to ensure a learner is aware that the information is being collected. For younger learners, or learners that don’t have the ability to fully understand, informing the learners’ parents would be a reasonable step for you to take to ensure this requirement is met.

For your older learners, some may not be able to fully understand what the notification requirements of IPP3 and IPP3A mean for them and their personal information. Therefore, in those circumstances, it would be a reasonable step to inform the learner’s parents so that they can help make sure the learner fully understands the purpose of the collection, whether they have to provide the information or not, and their rights to access and correct that information.

In some cases, you will be collecting personal information about the learner and their parents e.g. information collected from parents through the enrolment process. When this occurs:

IPP3 requirements will apply to the collection of information about the parents
and
IPP3A requirements will apply to the information about the learner.

What to tell learners and parents

The following sections break down the requirements of IPP 3 and IPP 3A and help you work through the things you should think about to ensure you are informing learners (or their parents where appropriate) appropriately.

Purpose

You must have a lawful purpose for collecting personal information about a learner and the information you are collecting must be reasonably necessary for you to achieve that purpose.

IPP3 and IPP3A require you to inform learners (and their parents where appropriate) about why you are collecting their personal information e.g. the purpose of collection.

Learners (and their parents where appropriate) should be able to easily understand what information you are collecting, why you are collecting it and what you are going to use it for.

Parent example - Health form - Medication information for primary school camp

We are collecting information about medication requirements your child may have to ensure they receive their medications appropriately and to help us effectively manage your child’s health and wellbeing while they are attending our school camp.

We collect this information to ensure we meet our obligations under the Education and Training Act 2020, the Health and Safety at Work Act 2015, the Children’s Act 2014 and other relevant legislation.

Information Required: Information about any medications your child will need to take, whether your child requires assistance to take their medication(s) and what this assistance involves, and any relevant information about the medical condition we need to be aware of to manage your child’s health and wellbeing appropriately while at the school camp.

The information you provide about your child will only be used for the specified purpose above.

Learner example - Term 1 In-class orientation survey for year 9 learners

Purpose statement: The first term at secondary school can feel a bit scary. There are a lot of new things to learn, and a new school environment to get used to. The purpose of this wellbeing survey is help us (your teachers) make sure you are settling in well and know where you can go to get help and assistance if you need it. It also helps us to make sure our orientation activities are helpful to learners beginning their secondary school journey.

Information Required: Your name, your thoughts on our orientation activities, your ideas about how we could improve those activities, and whether you would like or need further support or help settling in.

Intended recipients

You must inform learners (or their parents where appropriate) who will have access to the information you are collecting and how they will use it. This includes information about an organisation that may be collecting the information on your behalf, and other organisations that you may share the information with and why.

Parent example - Health form - Medication information for primary school camp

Who we may share your child’s information with: Your child’s medications information will be shared with our Camp Managers so that they are aware and informed and can assist your child appropriately if required. In the case of a medical event, we may need to share your child’s health information with healthcare providers to ensure appropriate medical assistance is provided.

Learner example - In-class survey

The information you provide in this survey will be seen by your teacher. Your feedback about the orientation activities will be provided to the principal and other school staff. Don’t worry though, they won’t be told who provided the feedback. If you have requested additional support or help settling in, your teacher will share your name with the appropriate person who can help you.

Authorised or required by law

IPP3 and IPP3A require you to inform learners (or their parents where appropriate) whether the collection of their personal information is authorised or required by law.

Where the collection is authorised or required by law and you are collecting that information directly from the learner, you must also inform the learner (or their parents where appropriate) whether the provision of the requested information is mandatory or voluntary.

Example - Collection of learner information required by law

The Education and Training Act 2020 requires schools and ECE services to collect specified information about learners at the time of enrolment i.e. the collection of this information is required by law.

Learners (and their parents where appropriate) should be informed that:

the collection is required by the Education and Training Act 2020
the information that the school or ECE services is required to collect
what that information will be used for and who it may be shared with
whether the provision of information requested is mandatory or voluntary
any consequences of not providing the mandatory information

The learner’s right to request access to and correction of their personal information including the process by which they can make those requests.

For more information about mandatory information requirements under the Education and Training Act see Enrolment section later in this chapter.

Consequences if information isn’t provided

When you are collecting information directly from a leaner, you must also inform the learner (or their parents where appropriate) of any consequences of not providing the information (e.g. enrolment won’t be progressed, funding for a service may not be available, the learner may not be able to participate in an activity).

Access and correction rights

Learners (and their parents where appropriate) must be advised of their access (IPP6) and correction rights (IPP7) under the Privacy Act. You must inform a learner (or their parents where appropriate):

that they can request access to, or correction of, the personal information at anytime
and
the process by which they can make an access or correction request.

Parent example - Health form - Medication information for primary school camp

Your rights and how you can exercise them: As your child’s representative, you can exercise your child’s right to request access to and correction of the personal information we are collecting from you.

You can make an access or correction request on behalf of your child by emailing [insert email address] or contacting us by phone [insert phone number].

Learner Example - In-class survey

You can always ask to see any personal information that the school holds about you. You can also ask us to correct any information that is wrong. Just ask your teacher and they will help you.

When do I need to inform learners/parents?

You should always try to inform them before you collect their personal information.

If that is not possible, then you need to inform them as soon as practicable after the information is collected.

When you aren’t required to inform learners and parents

There are some situations where you don’t need to inform a learner (or their parents where appropriate) about the collection of their information. IPP3 and IPP3A exceptions relevant to the education sector include:

if you have recently informed the learner of the same collection, of the same information or information of the same kind
if you reasonably believe that not informing the learner would not prejudice their interests
that compliance would prejudice the purposes of the collection
that compliance is not reasonably practicable in the circumstances
that the information being collected will not be used in a form where the learner can be identified
that the information being collected will be used for statistical or research purposes and will be published in a form where the learner isn’t identified.

Example - Recently informed learner of collection

A school runs an in-class survey each month asking learners in years 10 – 13 to provide feedback on the lunches provided by the school. When the survey was first introduced, the school principal informed the learners about the purpose of the survey covering all the requirements of IPP3.

Does the school principal need to notify the learners every time the survey is completed?

As the learners have already been informed about the survey and the survey collects the same information from the same students each month, the school principal does not need to notify the learners each time. However, as the survey is voluntary and some learners may not complete the survey regularly it is good practice to make sure the learners know where they can go to get information about the survey.

Age-appropriate communication

When you are collecting information from learners (e.g. through an in-class learner wellbeing survey) you need to ensure that you are informing them about the collection of their personal information and how it will be used, in a way that they will understand.

This may mean you need to develop different communication content and delivery methods for learners of different ages and abilities.

If your learners don’t understand what information is being collected, why it is being collected and how it will be used, the means of collection could be considered unfair.

Example - Informing a learner when undertaking disciplinary investigations

When investigating an allegation of learner misconduct, you will be collecting personal information about the learner– for example, what they did, when they did it, who they were with, what they saw, what they heard, or why they may have done or not done something.

Disciplinary processes are a stressful time for all involved, especially for a learner. IPP4 requires you to take extra care when collecting information from learners and ensure the way in which you collect their information is fair and doesn’t intrude to an unreasonable extent into their personal affairs. Making sure the learner (or their parents where appropriate) understands why you are collecting their information and how it will be used in the investigation process helps to ensure the way you are collecting the information is fair.

When collecting information from a learner as part of an investigation process things you should consider include:

Is the learner of sufficient age to understand what an investigation is, and the potential consequences of providing or not providing the information being requested? You need to ensure the learner understands why the information is being collected and what you will do with it.
Will you need to interview other people as part of the investigation? If so, you will need to let the learner know this. If during the investigation you identify additional people that need to be interviewed, you should let the learner (or their parents where appropriate) know.
Will you need to share the information provided by the learner with other parties as part of the investigation? If so, make it clear what information will be shared with whom or what purpose.
Whether the collection of the information may create a risk to the learner’s wellbeing and safety.

You will also need to ensure you appropriately inform other people you will collecting personal information from as part of the disciplinary process.

We recommend that you have disciplinary interview specific privacy statements prepared prior and have them readily available so that you can tailor them to the specific circumstances of the investigation. This means you can take the time to get them right and are not having to create them under pressure when a disciplinary situation arises.

Using third parties to collect information

If you use a third-party provider to collect information from learners (or their parents) you are still responsible for ensuring that the requirements of the Privacy Act are met. This includes the requirement to inform learners (or their parents where appropriate) about the collection.

It should be clear to learners (and their parents where appropriate) that the third-party provider is collecting the information on your behalf. If the third-party provider will be using the information for its own purposes this secondary use must be lawful and clearly communicated to the learner (or their parents where appropriate), and they should be given the option to opt out of providing the information.

If you use a third-party provider that collects information about learners on a regular basis to support your operations (e.g. payroll, external IT services, google classrooms) you can inform learners and their parents of these services and the information they collect, use and share through your privacy policy.

If want to use a third-party provider to collect information on a one-off basis e.g. to undertake a survey, you should ensure that you provide the-third party provider with your collection-specific privacy statement that they must then use when they are collecting the information from your learners (and their parents where appropriate).

Informing learners and parents in practice

There are several ways that you can inform learners (or their parents where appropriate) about how you are collecting, using and sharing their information.

These include (but are not limited to):

your privacy policy
privacy statements
enrolment forms
entry display notices.

Example: Your privacy policy

A privacy policy documents how you manage and protect all personal information you collect, use, and share – it is a key privacy governance document.

A privacy policy is generally broader and more detailed than a privacy statement. While a privacy statement may be specific to a particular collection of information, a privacy policy covers all personal information you hold.

A privacy policy generally includes information beyond that which is required by IPP 3 or IPP 3A. For example, a privacy policy should include:

the business systems you use to collect and store personal information
more detailed information about your security measures
what information you hold is considered confidential information
information about how sensitive information is managed
a cookie policy
how privacy complaints and breaches are handled.

Having a privacy policy shows both learners and their parents that you understand your privacy obligations, and what you are doing to ensure personal information is protected appropriately. Ensuring your learners and their parents are aware of, and can readily access, your privacy policy is a good way to keep them informed and building trust and confidence in how you protect and respect personal information.

Your staff also need to be aware of and understand your privacy policy. This awareness helps to ensure personal information is collected appropriately and isn’t inadvertently used or shared for unauthorised purposes. Staff who know and understand why and how their organisation collects, uses and shares personal information will be in a better position to identify poor privacy practices, and will be able to provide meaningful assurance to learners (or their parents where appropriate) that their personal information will be protected and respected.

If you update your privacy policy, it is good practice to let your learners, and their parents, and your staff know. For example, a school or ECE service can use existing newsletters or parent communication channels to let them know the privacy policy has been updated and how they can access it. If you are a service provider, you can email your clients and provide a link to your updated privacy policy.

Example: Privacy statements

Privacy statements, sometimes referred to as privacy notices, are more often used for specific collections of personal information.

You can have both an overarching privacy policy that covers how you collect, use and share personal information more generally, and you can develop and use tailored privacy statements for specific collections of personal information.

A privacy statement is a good way to provide learners (or their parents where appropriate) with the more detailed, collection-specific information necessary for them to make an informed decision about providing you with their personal information in those specific circumstances. You can also refer to your privacy policy in your collection-specific privacy statement – this will enable learners (and their parents) see how the specific collection aligns with your organisation’s general privacy practices.

Privacy statements need to be complete, accurate and up to date – people should be able to trust and rely on the information in your privacy statements when making privacy related decisions. As with your privacy policy, if you update your privacy statements, it is good practice to let your learners, and their parents, and your staff know.

Use our online privacy statement generator.

Example: Enrolment forms

Enrolment forms are used to collect information about a learner to support the process of enrolling a learner in an ECE service, school or with a service provider. In most cases, enrolment information will be collected from a learner’s parents (or guardian).

Only information necessary for the purposes of enrolling a learner should be collected through your enrolment form. What information is necessary will depend on your organisation’s circumstances.

For example:

an ECE service may require specific information to be provided to ensure it meets its licencing requirements
a school that provides lunches may require specific information about a learner’s food-related medical conditions
a private school may require specific information to enable relevant enrolment assessments to be undertaken
a specialist school may require specific information to determine whether the learner is eligible and what their needs are
a school may require specific information from a learner where the Ministry of Education has directed an enrolment under the Education and Training Act 2020.

Every enrolment form should include a privacy statement informing learners (or their parents where appropriate) about why the information is being collected, what the information will be used for, and what information may be shared with other organisations. This privacy statement should be specific to the information being collected through the enrolment form.

Your enrolment form privacy statement will need to inform learners (and their parents) what information will be shared with other people (e.g. Ministry of Education, other education agencies, other government agencies, and service providers) and why. Enrolment forms are also a good opportunity to inform learners (and their parents) of your general privacy policy – you can do this by adding a link to your organisation’s privacy policy in your enrolment form.

Schools

Schools are required to share specific information about learners with the Ministry of Education. This information is stored in a system called ENROL.

The Ministry has an ENROL Privacy Statement that you can use as part of your enrolment form documentation. The ENROL privacy statement sets out what information the Ministry collects, what it uses the information for, how it keeps the information safe and how information in ENROL can be accessed and corrected.

Read the ENROL privacy statement.

ECE services

ECE services are required to share specific information about learners with the Ministry of Education. This information is stored in a system called ELI. The Ministry requires all ECE services to include specific wording relating to ELI and the Ministry’s collection of learner information in their privacy statements.

Service providers

Service providers, particularly those receiving referrals directly from a school or ECE service, will need to inform learners and their parents at the time of enrolment into the service about any information that will be shared (and why) with the learner’s school or ECE service.

Example: Entry display notices (for CCTV cameras)

If you operate CCTV cameras, entry display notices are a good way to inform learners, their parents and other visitors that CCTV cameras are operating and are being monitored.

Entry display notices should be strategically placed in prominent entry locations e.g. property and building entry points and carparks. Displaying multiple notices is a good way to ensure maximum visibility and awareness – especially if your CCTV cameras are discreet or located in areas where people would not normally expect to be under surveillance e.g. bathroom or changing room areas. If your CCTV captures audio this should also be clearly stated on your entry display notice.

Things to consider when using entry display notices for CCTV cameras include:

The notices should be visible and clearly readable.
They should include details of the organisation operating the system, the purpose of its use, and who to contact should a person have concerns.
They should be appropriate in size in relation to their placement and who will be looking for it. If it needs to be seen by younger learners, it needs to be placed at a height level at which they can see and read it.

Your organisation’s privacy policy should include the use of CCTV cameras and provide more detailed information on why your organisation uses CCTV cameras including how it uses the camera footage, who it might be shared with and how you keep the footage safe.

If you use a service provider to manage and monitor your CCTV cameras and footage, you should include this in your privacy policy.

For more general information about the use of CCTV see: