14Data custody and control safeguards

14 Data custody and control safeguards

14 Data custody and control safeguards

(1) A data provider and data recipient must ensure that the government sector data that is shared is maintained and managed in compliance with any legal requirements concerning its custody and control (including, for example, requirements under the Government Information (Public Access) Act 2009 or State Records Act 1998) that are applicable to them.

(2) If a data recipient that arranges for a person or body (other than another government sector agency) to conduct data analytics work using government sector data with which it has been provided, the head of the data recipient is to ensure that appropriate contractual arrangements are in place before the data is provided to ensure that the person or body deals with the data in compliance with any requirements of the privacy legislation, the State Records Act 1998 and any Government data security policies that are applicable to the data recipient.

Note—

See, also, the offences in Part 6 of the Crimes Act 1900 in connection with unauthorised access to, or the modification or impairment of, data held in computers.