Privacy for agencies

Two women work at a laptop. One is standing. Before you use personal information, check that it’s accurate, up-to-date, complete, relevant and not misleading. Incorrect information isn't of any use to you and could lead you to making poor decisions about the person involved that can impact on them and their rights and result in privacy complaints.

Read about the accuracy of personal information in principle eight.

Only use information for the purpose you collected it

You should generally only use personal information for the same purpose you told the person about when you collected it. Not doing that risks losing the trust of people whose information you’ve used without their knowledge or permission.

However, there are also some situations where you might be able to use personal information for another purpose. That includes:

When you have the permission of the person the information is about.
If it’s directly related to the purpose for which you gathered the information.
If you’re a public sector organisation and it’s necessary to uphold or enforce the law.

Other people or organisations may want to use personal information you have collected through your organisation, rather than collecting it themselves. Read about the reasons you might need or want to share information.

Read about reasons for sharing (disclosing) information.

Disposing of personal information

Dispose of personal information securely so that no-one can retrieve it. For example:

Delete cloud storage services and drop box facilities.
Wipe USB sticks before disposing of them.
Open and check desk drawers for files before you give them away.
Use shredders and secure destruction services.
Wipe hard drives from machines – including photocopiers – before you sell or decommission them.
Delete back-up files as well as originals.