Responding to Digital Incidents
See Computer Security and Cybersafety for our procedures for managing cyberattacks, data breaches, or other computer security threats.
Incidents involving digital technology may negatively affect the learning environment or impact the emotional or physical safety of our kura community. Paparoa Street School responds appropriately if there is reason to believe that our digital technology and online safety policy has been breached or an incident involving digital technology has occurred (Education and Training Act 2020, Health and Safety at Work Act 2015, Harmful Digital Communications Act 2015). We also respond to concerns and incidents that take place outside kura but have an impact on the kura community.
We encourage anyone who may have concerns or information about a digital incident to inform the kura. We act immediately to minimise distress and harm, safeguard the safety and wellbeing of those affected, and help to resolve the matter as soon as possible. Digital incidents may vary in their nature and severity, and may involve ākonga, kaimahi, and/or others. Appropriate kaimahi manage digital incidents according to the situation, in consultation with kaiārahi matua and the poari matua, as appropriate. This may include clarifying roles and responsibilities to ensure the most effective response.
Responding to a digital incident
Our kura may need to respond to a wide range of digital incidents, including breaches to our digital technology use agreements, 
online bullying, personal information breaches, and inappropriate content. How we respond depends on the nature of the incident and whether ākonga, kaimahi, and/or other members of our kura community are involved. We are guided in our response by the Digital Technology: Safe and responsible use in schools guide created by the Ministry of Education and Netsafe (see Resources below).
Online bullying (or "cyberbullying'") and harassment is when digital technology is used to bully or harass. Online bullying and harassment can be anonymous, and can take place on social media, messaging apps, or in other formats. It can take the form of sending messages (email/text/instant), making posts, or publishing content that intends to harm. It may include spreading rumours, and/or sharing private images, screenshots, or personal information without someone's consent. Also see Bullying and Harassment.
If the kura believes a digital incident has occurred, we:
- determine what has happened, who is involved, and who owns the digital technology/content involved in the incident
- assess the nature of the incident
We assess the nature of the incident to determine whether it can be addressed within kura policies and procedures or may have legal ramifications. Netsafe notes that most legal issues that kura will manage are governed by the Harmful Digital Communications Act 2015 and the Privacy Act 2020 but there are often multiple possible offences depending on the severity and specifics of each incident. See Netsafe's summary of legislation relating to digital technology for more information 
- maintain the integrity of digital devices, the information stored on them, and any online content that may be required as evidence
- seek support and report incidents as appropriate
Support can be sought from a variety of sources, including Netsafe, the New Zealand School Boards Association (NZSBA), the Ministry of Education, or a lawyer with specialist knowledge in this area.
Netsafe provides helpful online resources about keeping people safe online, and also provides advice and support to schools and kura under a contract with the Ministry of Education. They can assist with working out if a digital incident relates to the Harmful Digital Communications Act 2015 or another online safety area and can provide guidance.
Netsafe and the police share a role in managing breaches of the Harmful Digital Communications Act 2015. Netsafe is the approved agency for resolving reports related to alleged breaches of the 10 communication principles of the Harmful Digital Communications Act 2015. The act also includes criminal offences which the police manage. If a criminal law has been broken, the police should be contacted. See Harmful Digital Communications (Police) and What is the HDCA? (Netsafe)
Breaches of the Privacy Act 2020 that have caused or are likely to cause serious harm must be notified to the Privacy Commissioner within 72 hours of becoming aware of it and to any affected people as soon as practically able. See Privacy Breaches
- use the safe harbour process and/or seek legal advice as necessary if the kura was the online content host
Online content hosts that allow other users to post any form of digital message (e.g. comments or videos), may be legally responsible for the content posted.
Sections 23–25 in the Harmful Digital Communications Act 2015 outline the safe harbour provision and complaints.
Kura that follow the safe harbour process are protected from legal responsibility and the possibility of prosecution for the content on their site.
The Ministry of Justice outlines seven specific steps that must be followed for safe harbour, and notes that you can only claim safe harbour if you follow these steps and make it easy for people to contact you with complaints about content posted by another person – it must be easy for people to find your contact details on your digital platform and easy for them to make a complaint that contains the information outlined in the Act.
Ministry of Justice: Safe harbour provisions
- determine how/when/whether to release information about the incident to the wider community and the media.
If ākonga are involved in a digital incident we may follow our Behaviour Management, Bullying and Harassment, and Surrender and Retention of Personal Digital Devices policies as appropriate. We contact and collaborate with parents/caregivers and whānau as needed. If ākonga at another kura are also involved with the digital incident we work with the other kura to resolve the situation and support our kura communities.
If kaimahi or other members of the kura community are involved in a digital incident we may follow our Kaimahi Conduct, Concerns and Complaints Policy, Kura Community Conduct Expectations, and Bullying and Harassment policies and procedures, as appropriate.
Our kura processes for privacy and confidentiality are followed at all times. See Privacy.
Privacy refers to the right to have personal information protected. The Privacy Act 2020 outlines how personal information must be collected, stored, used, shared, and disposed. For more information, see Privacy Policy.
Confidentiality refers to the responsibility to ensure personal information is kept secret. Confidential information may be shared if it is in the best interests of the ākonga. See Sharing Ākonga Personal Information with External Agencies.
Support
We respond to concerns and incidents with care and caution. For ākonga, this includes pastoral care and connections to external support, as needed. For kaimahi, this may include access to an employee assistance programme or external support. Also see Responding to Ākonga Wellbeing Concerns and Kaimahi Wellbeing and Safety.
We recognise that a digital incident can be traumatic for ākonga, kaimahi, and our kura community and may require us to activate our crisis management plan. After the incident is resolved, the kura continues to monitor the wellbeing of those affected and provides ongoing support as appropriate.
Recording and storing information
We record full details of the incident (including all decisions and actions taken) in our school management system. This includes documenting concerns, conversations, incidents, contact with parents/caregivers or external agencies, advice received, actions taken (including rationale), and any follow-up, support, or monitoring plans.
The kura debriefs the incident to assess how processes could be improved and how we can prevent similar incidents.
Related policies
Legislation
- Education and Training Act 2020
- Harmful Digital Communications Act 2015
- Privacy Act 2020
- Crimes Act 1961
- Films, Videos, and Publications Classification Act 1993
- Defamation Act 1992
- Human Rights Act
- Harassment Act
Resources
: Term 4 2025, Term 1 2023, Term 2 2020
The release history is a record of changes made to a SchoolDocs Core topic as the result of an internal or scheduled review. The date indicates when a change was made. If you have a customised topic, it may not have received the updates described. Release history links are kept for five years, then archived.
