If you are asked by a student management system (SMS) supplier to supply a copy of your current SMS’s database don’t. At present a supplier is known to be doing this so that they can demonstrate their system with your data.
The Privacy Act has a number of principles. Principle 11 is summarised thus by Consumer NZ:
Principle 11: Limits on disclosure of personal information.
The information must not be disclosed except in certain situations. These include where the disclosure is directly related to the purpose for which the information was collected, where the source of the information is a publicly available publication, and where the disclosure is authorised by the individual concerned.
So, if you are in the unfortunate situation of having sent data you must immediately notify the SMS supplier that the sending of the database should not have happened for the described purpose – i.e. “Data Import Trial”.
Make clear that the data sent to the supplier must be removed immediately from any database (including backups) in which it is stored. You must be sent written confirmation that this has happened.
Obviously if you do decide to purchase and use the new software you can supply your database for data conversion purposes.
Also, The Education Act makes special provision for information to be made available to certain government agencies as for example, in relation to loans and allowances.