Recommendation 1.

Principles about what data can be added to the Data Asset in the future

Principles say how things should be done.

The National Disability Data Asset Council makes sure the government uses the Data Asset in a way that helps people with disability.

We call them the Council for short.

The Council wrote principles to help guide decisions about what data should and should not be added to the Data Asset in the future.

The Council are finalising the principles. The principles will be on the National Disability Data Asset website in the middle of 2025.

Recommendation 2.

Collection notices for data providers

A data provider collects information about people.

A collection notice is given to people to tell them:

• what data will be collected about them
• why data needs to be collected
• how the data will be used.

We gave data providers words at the end of 2024 to use on their collection notices.

Recommendation 3.

Managing the risk of re-identifying data - review of processes

We made a set of rules to stop people finding people’s names or knowing who the data is about.

This means that we have a way to check if we are keeping data private and safe.

The first review of these rules will be done by July 2025.

Recommendation 4.

Managing the risk of re-identifying data – rules for what is shared

We made rules that:

• stop people finding people’s names or knowing who the data is about
• keep data safe when we give people access to the Data Asset.

These rules say how:

• data is shared
• we make sure that people cannot be known from the information in the Data Asset
• data is checked before it can leave the safe computer system
• we keep all data private.

Recommendation 5.

Managing data breaches

A data breach is when data or private information is:

• shared when it should not be
• stolen from a computer system.

We made a plan that says what should be done if there is a data breach.

Recommendation 6.

Develop a Compliance Framework

We made a Compliance Framework.

This is a way to check that the rules to keep data safe and private are followed.