Māori data, privacy and governance

Why the Privacy Act isn’t the whole picture

The Privacy Act protects individuals. It asks whether information about an identifiable person was collected, used, stored and shared properly.

Māori data is wider than that. It includes information about whānau, hapū and iwi as collectives, and about Māori language, culture, resources, environments and taonga. Information that identifies no individual can still cause harm to a group, for example small-area statistics that stigmatise a community, or research that uses mātauranga without consent.

Māori data sovereignty is the idea that Māori have inherent rights and interests in how Māori data is collected, owned and used. Te Mana Raraunga, the Māori Data Sovereignty Network, has set out principles for this, built on concepts including rangatiratanga (authority), whakapapa (relationships), whanaungatanga (obligations), kotahitanga (collective benefit), manaakitanga (reciprocity) and kaitiakitanga (guardianship). For the public sector, Te Kāhui Raraunga has published a Māori Data Governance Model.

The regulator is paying attention

• The Privacy Commissioner’s guidance on generative AI expects agencies to engage with Māori about potential risks and impacts to the taonga of their information.
• The second phase of the Commissioner’s 2026 inquiry into the Manage My Health breach is examining whether the breach had a disproportionate impact on any group, particularly Northland Māori.

Both signal that the Commissioner expects organisations to think beyond individual harm.

Practical steps

1. Know where Māori data is. In your personal information inventory, flag datasets that include iwi affiliation or ethnicity, data collected from or about Māori communities, and data about whenua, te reo or mātauranga.

2. Engage at the start. Before a new project or system that uses Māori data, talk to the communities it affects, or to iwi and Māori partners you already work with. Ask what they want from it, what concerns them, and how they want to be involved in decisions.

3. Share governance. For significant datasets, give Māori a real role in decisions about access and use, such as seats on a data governance group, or a data use agreement with an iwi partner.

4. Assess collective harm. Add a question to your privacy impact assessment: could this use or release harm a group, even if no individual is identified? Pay particular attention to small numbers, location data and research.

5. Think about where it’s stored. Many Māori organisations prefer data stored in Aotearoa, and some expect it. If you use overseas cloud services, be ready to explain where data goes and why.

6. Share the benefit. If Māori data helps you build a service, win funding or publish research, ask how the people it came from benefit.

7. Respond to breaches with the collective in mind. If a breach affects a particular community, notify individuals as the law requires, and also consider engaging with iwi or community leaders about the impact and response.

8. Build capability. Train staff who handle Māori data, and support Māori staff without loading all the responsibility onto them.

Where to learn more

Start with Te Mana Raraunga’s principles and Te Kāhui Raraunga’s governance model. For public sector agencies, the Government Chief Data Steward’s guidance also applies.