The Student Identifiers Registrar must assign a student identifier to an individual on application by or on behalf of the individual if the Registrar is satisfied of the individual's identity and that the individual does not already have a student identifier.

Generally, anyone who collects personal information about an individual to apply for an identifier for the individual must destroy the information as soon as practicable after it is no longer needed for that purpose.

On request by an individual, or an organisation or body involved with vocational education and training, the Registrar may verify that an identifier is the individual's student identifier, or give the individual's student identifier.

Anyone (including the Registrar) who keeps a record of student identifiers must protect it from misuse and unauthorised access and disclosure.

Collection, use and disclosure of an individual's student identifier without the individual's consent is prohibited, unless it is authorised. This Part authorises collection, use and disclosure by the Registrar for certain purposes or by others to deal with unlawful acts or to help law enforcement.

The Information Commissioner may deal with breaches of the rules about destroying personal information, protecting records of student identifiers and unauthorised collection, use and disclosure of student identifiers as interferences with privacy under the Privacy Act 1988 .