Privacy in Education — What Teachers and Students Should Check

A practical NZ-focused guide to understanding privacy rights, checking what data school tools collect, and knowing what to do when something does not feel right.

Student and educator privacy in New Zealand schools involves a set of overlapping obligations — the Privacy Act, the Education and Training Act, and the expectations set by the Office of the Privacy Commissioner. These are not abstract compliance requirements. They describe what should happen in practice when a school adopts a new digital tool, shares student information with a third party, or stores records about a student’s learning or wellbeing (1)(2).

This guide gives both teachers and students a practical starting point for understanding those obligations and acting on them.

Why privacy in schools deserves specific attention

Schools handle sensitive information as part of daily operations. When that information moves through digital tools — particularly cloud platforms, AI-assisted marking tools, communication apps, or learning platforms — it is easy to lose sight of where the data actually goes and who can see it.

Children and young people are entitled to a higher standard of privacy protection in digital contexts. That expectation applies to schools and the tools they choose to use.

What privacy law actually requires in NZ schools

The Privacy Act 2020 applies to all organisations, including schools. The key obligations for school staff include:

• collecting only the personal information needed for a genuine educational purpose
• storing it securely and limiting who can access it
• not sharing it with third parties without a clear basis and, where required, consent
• correcting or removing it when appropriate
• being able to explain why it is being collected if asked

The Education and Training Act 2020 adds layer-specific requirements around student records, enrolment information, and the handling of learning data (4)(5).

For students, your rights include asking what information is held about you, why it is held, and who has access to it. You can also ask for inaccurate information to be corrected.

Questions to ask before using a new school tool

Before a school or class adopts a new digital tool, these questions should be answerable:

• Does the tool privacy notice explain what data it collects and why?
• Is the data stored in New Zealand or in a jurisdiction with equivalent privacy protections?
• Does the tool provider use student data for anything beyond providing the service — including model training or analytics?
• Who at the school can access the data, and how is access controlled?
• What happens to the data if the school stops using the tool?

If the answers are unclear, treat that as a reason to pause and investigate before committing.

The Office of the Privacy Commissioner provides a Privacy Impact Assessment template that schools and kura can adapt to evaluate new digital tools before adopting them (2).

Privacy tools available in New Zealand

The Office of the Privacy Commissioner offers practical resources that schools can use directly:

• Privacy tools for agencies — includes checklists and guidance for evaluating privacy risk when adopting new technology (1)
• Privacy Impact Assessment template — a structured template applicable to school tool evaluation (2)
• Access to personal information guidance — what individuals can ask for when they want to know what information is held about them (6)
• Children’s Privacy Project — provides context for why school-specific privacy standards matter beyond general compliance (3)

What to do if you think student data has been mishandled

If you are a student and you think your personal information has been shared, stored, or used incorrectly:

1. Tell a trusted adult — a parent, caregiver, or teacher you feel comfortable with.
2. Ask the school directly — you have the right to know what information is held and why.
3. Make a complaint to the Privacy Commissioner if the school has not resolved your concern — this is free and available at privacy.org.nz (7). Do not assume it will sort itself out — mishandled student data can affect future opportunities and wellbeing.

If you are a teacher and you become aware that a tool provider has mishandled student data:

1. Document what you know about the incident, including dates, what data was involved, and what the tool provider has said.
2. Notify your school leadership or designated privacy officer.
3. Report the incident to the Privacy Commissioner through their online complaints process (7).
4. Review whether the tool should continue to be used and document the decision.

Practical privacy habits for teachers

These habits reduce the risk of accidental privacy breaches in daily teaching:

• Do not store student assessment data in unencrypted spreadsheets or personal cloud accounts
• Use school-provided platforms for student communications rather than personal messaging apps
• Be cautious about sharing student work samples publicly — even de-identified examples need care
• Review the privacy settings of any new tool before introducing it to a class
• Ask the IT or leadership team to confirm tool compliance before adopting something new for sensitive tasks

Practical privacy habits for students

You do not have to wait for teachers to manage this:

• Check the privacy settings on any app or platform you use for schoolwork — especially if you signed in with a personal account
• Be cautious about sharing your school email address with apps or websites outside of your school’s approved tools
• If an app asks for more access than it needs — for example, access to your contacts or location when it only needs to store documents — ask a teacher before agreeing
• If something feels wrong — for example, an app is sharing your work publicly without asking — tell a teacher or parent

Knowledge check

Test your understanding of privacy rights in NZ schools with these questions. Remember to click on each question to reveal the answer.

Q1: A new learning app your school adopted asks you to agree that submitted work can be used to improve the company's AI model. Your teacher did not mention this. What does this mean for you?

Answer: You have the right to question this before agreeing. Under the Privacy Act 2020 (4), personal information should only be used for the purpose it was collected for — not repurposed without disclosure. Submitting work through a school tool does not automatically mean you have agreed to AI training use. Ask your teacher or school leadership to clarify the terms, and do not agree until you understand what you are consenting to. You can also ask whether a Privacy Impact Assessment was done before the tool was adopted (2).

Q2: You want to know what information your school holds about you and who can access it. What are your rights in New Zealand?

Answer: You have the right to ask. Under the Privacy Act 2020 (4), you can request access to personal information held about you and ask for it to be corrected if inaccurate. You can make this request directly to your school. If the school does not respond adequately, you can complain to the Privacy Commissioner at privacy.org.nz — at no cost (6)(7).

Q3: A student notices that a school platform is publicly displaying first names and year levels alongside submitted work. What should they do?

Answer: Report it to a teacher or the school’s privacy officer immediately. This may constitute a privacy breach under the Privacy Act 2020 (4). Students are entitled to have their personal information handled carefully, and publicly displaying identifying information without consent is a breach of that obligation. The school has a duty to address it quickly and may need to notify the Privacy Commissioner depending on the severity (7).

Sources and references

[1] New Zealand. Office of the Privacy Commissioner. (2025). Privacy tools for agencies. https://www.privacy.org.nz/responsibilities/privacy-tools-for-agencies/

[2] New Zealand. Office of the Privacy Commissioner. (2025). Privacy Impact Assessments. https://www.privacy.org.nz/responsibilities/privacy-impact-assessments/

[3] New Zealand. Office of the Privacy Commissioner. (2025). Children’s Privacy Project. https://www.privacy.org.nz/focus-areas/children-and-young-people-policy-project/

[4] New Zealand. Parliament. (2020). Privacy Act 2020. https://www.legislation.govt.nz/act/public/2020/0031/latest/whole.html

[5] New Zealand. Parliament. (2020). Education and Training Act 2020. https://www.legislation.govt.nz/act/public/2020/0041/latest/whole.html

[6] New Zealand. Office of the Privacy Commissioner. (2025). Your rights. https://www.privacy.org.nz/your-rights/

[7] New Zealand. Office of the Privacy Commissioner. (2025). Children’s privacy guidance for the education sector. https://www.privacy.org.nz/resources-and-learning/a-z-topics/protecting-children-and-young-peoples-privacy/childrens-privacy-guidance-for-the-education-sector/

What to do next

• Check Cyber safety basics for New Zealand educators for the broader educator safety pathway.
• Read Using AI Tools Safely for School and Teaching if you or your school are using AI-assisted tools.
• Follow the student pathway at Digital safety basics for students in New Zealand.