Privacy Act Policy

Adopted 17th June 2019
Next review date:  February 2028  (Reviewed Triennially) 

Policy Statement
The KingsGate School Board acknowledges its legal obligation to comply with the Privacy Act 2020 in all aspects of the collection, use, storage, and disclosure of personal information concerning employees, students, and other members of the school community. The school is committed to ensuring that personal information is handled with integrity, transparency, and respect for individual privacy rights.

This policy aims to:
Promote and protect individuals' privacy in accordance with the law.
Ensure appropriate collection, use, and disclosure of personal information.
Provide individuals with the right to access and correct their personal information held by the school.

Guidelines
Privacy Officer
The Principal will act as the Privacy Officer for KingsGate School.
The Privacy Officer is responsible for ensuring compliance with the Privacy Act 2020, advising staff on privacy matters, and responding to information requests or concerns.

Collection and Use of Personal Information
Personal information will only be collected when necessary for the school's educational, administrative, or legal purposes.
Individuals will be informed of the purpose for collecting their information and how it will be used.
Information will only be used for the purpose it was collected, unless otherwise required by law.

Storage and Security of Personal Information
Personal information will be stored securely, whether in physical or electronic format, to prevent unauthorised access, loss, or misuse.
Staff members must handle student and employee information confidentially and ensure it is accessed only on a need-to-know basis.

Access and Correction of Information
Individuals have the right to access the personal information held by the school.
Individuals have the right to request corrections if any information is inaccurate, incomplete, or outdated.
Requests for access or corrections must be made in writing to the Privacy Officer, who will process them under Principles 6 and 7 of the Privacy Act 2020.

Disclosure of Personal Information
Personal information will not be disclosed to third parties without consent, except where required by law (e.g., child protection, health and safety, law enforcement).
If personal information must be shared with external agencies, the school will ensure appropriate safeguards are in place.

Privacy Training and Procedures
The school will develop and maintain procedures to ensure staff members understand their privacy responsibilities.
Training on privacy principles and obligations will be provided during staff induction and as part of ongoing professional development.

Breach Management
Any suspected or actual privacy breaches (e.g., unauthorised access, loss, or disclosure of personal information) must be reported immediately to the Privacy Officer.
The school will assess and respond to privacy breaches per the Privacy Act 2020 and notify affected individuals and the Office of the Privacy Commissioner if required.

Legislative and Policy Alignment
This policy aligns with the following laws and guidelines:
Privacy Act 2020 (Guiding legislation for the collection, use, and disclosure of personal information)
Education and Training Act 2020 (Student records and data protection)
Official Information Act 1982 (Access to government-held information)
Health Information Privacy Code 2020 (Protecting health-related personal data)
Te Tiriti o Waitangi (Ensuring equitable privacy protections for Māori students and whānau)