Data Use Agreement Template for New Zealand

A Data Use Agreement is a legally binding contract that governs how organizations share, access, and use data in New Zealand. This document establishes the framework for data sharing arrangements while ensuring compliance with New Zealand's privacy laws and protecting the interests of all parties involved.

When do you need this document?

You need a Data Use Agreement whenever your organization plans to share data with external parties for specific purposes. This includes research collaborations where universities or research institutions need access to commercial or government datasets, healthcare providers sharing patient information for treatment or research purposes, and technology companies providing data processing services. Commercial organizations frequently require these agreements when sharing customer data with partners, vendors, or subsidiaries. Government agencies also use these agreements when collaborating with private sector organizations or sharing data across different departments. The document is particularly crucial when the data contains personal information, commercially sensitive data, or when cross-border transfers are involved.

Key legal considerations

Your Data Use Agreement must clearly define the scope of permitted data uses and establish robust security measures to protect the information. The agreement should specify which individuals or systems can access the data, how long the data can be retained, and what happens to the data after the agreement expires. You need to include detailed provisions about data breach notification procedures, liability allocation between parties, and indemnification clauses. The document must address data localization requirements, particularly if data will be stored or processed outside New Zealand. Consider including audit rights that allow the data provider to verify compliance with the agreement terms. Termination clauses should specify how data must be returned or destroyed when the relationship ends.

Legal requirements in New Zealand

Under the Privacy Act 2020, your Data Use Agreement must ensure that any personal information sharing complies with the privacy principles, including having a lawful basis for collection and use. The agreement must address cross-border data transfer requirements if data will leave New Zealand, ensuring adequate privacy protections exist in the destination country. For health information, you must also comply with the Health Information Privacy Code 2020, which imposes additional restrictions on health data sharing. The Electronic Transactions Act 2002 allows for electronic execution of the agreement, but you should ensure proper authentication and record-keeping. The Contractual Remedies Act 1979 governs the enforcement and remedies available for breach of contract terms. If your data sharing involves consumer information, the Fair Trading Act 1986 may apply to prevent misleading or deceptive conduct regarding data use practices.