Document your information sharing activities

Information sharing is a key function for government agencies. It’s good practice to document your information sharing activities. In some cases, you’re required to have an information sharing agreement in place.

Documenting your information sharing activity:

• ensures agencies are on the same page — why they are sharing, what they are sharing and how they are sharing
• makes sure agencies are aware of their responsibilities and obligations
• demonstrates that agencies have taken a privacy-by-design approach to information sharing practices and have carefully considered the purpose of the sharing activity and the personal information required to achieve that purpose
• creates transparency and builds public trust and confidence in how agencies share personal information
• enables regular reviews to be scheduled and undertaken.

Types of agreements

There are different types of agreements that can be used to document information sharing. The 3 main types of agreements are:

• information sharing agreement
• approved information sharing agreement (AISA)
• information matching agreement.

Some agencies may also have a relationship agreement that sets out how the agencies have agreed to work together. These agreements are not information sharing agreements. However, information sharing may eventually be required to support the delivery of the agreed joint deliverables and outcomes.

Relationship agreement

Information sharing agreement

An information sharing agreement is the most common type of agreement used by agencies when sharing information.

The purpose of an information sharing agreement (sometimes referred to as a memorandum of understanding) is to document:

• the purpose of the sharing
• what information is being shared
• who the information is being shared with
• the legal authority enabling the sharing
• the controls that have been put in place to ensure the information is shared safely and used appropriately.

An information sharing agreement does not itself authorise the sharing of information. The sharing must be authorised or permitted by legislation (for example, the Oranga Tamariki Act, the Family Violence Act, the Privacy Act, or an agency’s own primary legislation).

Develop an information sharing agreement

Approved information sharing agreement (AISA)

An approved information sharing agreement (AISA) is created under the Privacy Act.

An AISA authorises information sharing activity within New Zealand for the purpose of delivering public services, where that activity might not normally be permitted under the information privacy principles (IPPs). An AISA cannot change how IPP6 and IPP7 operate.

Privacy Act 2020 and the Privacy Principles — Office of the Privacy Commissioner

AISAs can permit information sharing between different types of agencies. However, a public sector agency must be the ‘lead agency’ to ensure full public accountability.

The process to develop an AISA can be complex and lengthy especially when there are multiple agencies involved. Consider other sharing solutions that could resolve the information problem before creating an AISA.

Help with developing an AISA

The Government Chief Privacy Officer (GCPO) can assist you with the development of an AISA. If you believe that your information sharing activity requires an AISA — contact us early to talk through the process at gcpo@dia.govt.nz.

The Office of the Privacy Commissioner has guidance to help agencies work through the process of developing an AISA:

Approved information sharing agreements (AISAs) — Office of the Privacy Commissioner

A list of current AISAs is available on the Privacy Commissioner’s website.

Information matching agreement

Information matching involves the comparison of one set of records with another, generally to find records in both sets of data that relate to the same person.

All information matching, as defined in the Privacy Act, is authorised under a legislative provision in an agency’s legislation. Each of these information matches requires agencies to have an information matching agreement. Since they can often lead to adverse consequences for people, they are governed by specific rules in the Privacy Act about issues such as information retention, notification to affected people and reporting.

No new matching agreements

The Privacy Act 2020 provides that no new information matching agreement provisions can be created. However, information matching agreements finalised under the Privacy Act 1993 can continue in force under the Privacy Act 2020. Your agency may still operate under some of these agreements.

Changes to matching agreements

Minor amendments to an information matching agreement may be approved by the Privacy Commissioner. Where substantive changes are required, the parties to the information matching agreement will need to create a new AISA to continue the information matching.

Information matching provisions — Office of the Privacy Commissioner

Relationship agreement

A relationship agreement is used when agencies want to document how they will work together to achieve joint outcomes.

Relationship agreements are not information sharing agreements. They usually set out much more general principles about how the agencies want to work together.

However, information sharing might eventually be required to enable the agencies to work together to deliver agreed outcomes.

Share information

If information sharing is required, develop specific documentation that details how that sharing will work and append it to the relationship agreement.

If you’re sharing information from the start, document the sharing when you first create the relationship agreement.

Share information in the future

If you think that you may need to share information in the future but are not ready to do so yet — you will not be able to detail how the sharing will work yet. Instead, we strongly recommend that the:

• relationship agreement contains a clause requiring all information sharing to be documented in information sharing agreements
• information sharing agreement is appended to the relationship agreement.

Download and print this guidance

A PDF of this guidance is available to download and print.

Types of information sharing agreements [PDF 276KB]