From 1 May 2026, changes to the New Zealand Privacy Act will introduce a new Information Privacy Principle (IPP 3A), which affects how businesses collect personal information indirectly (that is, from someone other than the individual themselves).
If you operate a business which collects personal information in the course of carrying on business in New Zealand, this alert is relevant to you.
What’s changing?
Where personal information is collected indirectly, organisations will need to take reasonable steps to notify the individual, as soon as reasonably practicable, of matters including:
- that their personal information has been collected;
- the purpose of the collection;
- who the information may be shared with;
- the identity of the agency collecting and holding the information;
- whether the collection is authorised or required by law; and
- their rights to access and correct the information.
Who is affected?
This change may affect businesses that operate in New Zealand and receive personal information indirectly, including:
- job applicants (for example, police or reference checks);
- employees; and
- customers or clients.
The new notification obligation only applies to personal information collected indirectly on or after 1 May 2026.
Are there any exceptions?
Yes. IPP 3A does not apply in certain circumstances, including where the individual has already been notified, the information is publicly available, notification is not reasonably practicable, or notification would prejudice the purpose of collection or pose a risk to health, safety or trade secrets.
What should businesses be doing now?
We recommend affected clients review their current practices ahead of 1 May 2026, including:
- identifying whether any personal information is collected from third parties;
- reviewing contracts and arrangements involving receipt of third‑party personal information;
- updating privacy statements, notices and internal policies; and
- putting processes in place to ensure timely notification where required.
If you would like assistance reviewing your privacy practices, policies or contractual arrangements for New Zealand compliance, please feel free to get in touch with our Commercial Team.