This is an HTML version of an attachment to the Official Information request 'Role-based access controls and audit oversight'.





[IN-CONFIDENCE - RELEASE EXTERNAL] 
 
 
26/02/2026 
Phillip Fry  
[FYI request #33483 email] 
Tēnā koe Phillip 
OIA: [GEMS-46484] – SMART – data governance 
Thank you for your email of 10 January 2026 to the Ministry of Education (the Ministry), 
subsequently clarified on 28 January 2026, requesting the following information relating to 
governance and oversight of access to student data within the Student Monitoring, Assessment 
and Reporting Tool (SMART)
:  
1.  Copies of any formal access control documentation relied upon by the Ministry for 
SMART, including: 
•  role-based access control (RBAC) specifications or access matrices; and 
•  documentation describing differences in data access between user roles (e.g. 
teachers, principals, Ministry staff, Janison staff, and subcontractors). 
2.  Documentation describing whether SMART data access for each role is: 
•  identifiable at the individual student level, or 
•  restricted to aggregated or de-identified views. 
3.  Copies of any formal policies or assurance documents describing audit logging and 
monitoring of access to SMART data, including: 
•  who can view audit logs; and 
•  how inappropriate access or misuse is detected and managed. 
This request is limited to formal, authoritative documents and does not seek informal 
correspondence or draft material. 

Your request has been considered under the Official Information Act 1982 (the Act).  
Wellington National Office, 1 The Terrace, Levels 5 to 14, Wellington 6011 
PO Box 1666, Wellington 6140, DX SR51201 Phone: +64 4 463 8000  
[IN-CONFIDENCE - RELEASE EXTERNAL] 



[IN-CONFIDENCE - RELEASE EXTERNAL] 
 
The Ministry needs to extend the timeframe for responding to your request, pursuant to section 
15A(1)(b) of the Act, as consultations necessary to make a decision on the request are such that a 
proper response cannot reasonably be made within the original time limit. You can now expect to 
receive a response to your request on or before 26 March 2026, which is an extension of 20 
working days. If we are able to respond sooner thant this, we will of course do so.  
You have the right to ask an Ombudsman to investigate our decision to extend the timeframe for 
responding to this request, in accordance with section 28 of the Act. You can do this by writing to 
[email address] or Office of the Ombudsman, PO Box 10152, Wellington 6143. 
Nāku noa, nā 
 
 
Tess Firth 
Senior Advisor Official and Parliamentary Information 
Government, Executive and Ministerial Services 
OIA: [GEMS-46484]   
[IN-CONFIDENCE - RELEASE EXTERNAL]