IPP3A requirements to come into force on 1 May 2026
New Zealand’s recently passed Privacy Amendment Act 2025 includes the new Information Privacy Principle 3A (IPP3A), which requires businesses or organisations collecting personal information from somebody other than the person themselves to inform that person, subject to some exceptions.
“Telling people when you’re collecting information about them supports open and transparent collection practices and helps people better understand where and how their information is being used,” said Michael Webster, privacy commissioner, in a media release from the Office of the Privacy Commissioner (OPC).
According to the media release, IPP3A requires agencies that have indirectly collected personal information to take reasonable steps to inform the individual involved about:
OPC emphasised that all organisations should have their systems ready to meet the new requirements by 1 May 2026, when IPP3A will come into force.
In the media release, Webster said the changes seek to improve transparency and assist New Zealanders in exercising their privacy rights.
“The passing of the Privacy Amendment Act helps support that transparency for New Zealanders,” Webster said.
OPC noted that various practical exceptions to IPP3A seek to help businesses and organisations apply the new rule in context. OPC added that the already existing IPP3 requires agencies to notify the person concerned if they directly collect personal information from them.
In its media release, OPC said it consulted on draft guidance for agencies earlier this 2025. OPC added that it plans to publish this guidance on IPP3A requirements on its website later this year.
OPC shared that it is also reviewing the Codes of Practice issued under the Privacy Act to determine any necessary amendments to incorporate IPP3A.
“This reform helps keep our privacy law in line with other countries like Australia, the UK and Europe,” Webster said in OPC’s media release. “There are other pressing privacy reforms that I will continue to advocate for with the government of the day.”
“This change helps align New Zealand’s privacy law with international best practice and supports the country’s ongoing EU adequacy status, which facilitates the free flow of personal data from the European Union to New Zealand,” said an insight from Hudson Gavin Martin. “IPP3A also brings New Zealand into line with the Australian legal position.”
“For any New Zealand businesses handling personal data, particularly those which regularly rely on information gathered via third parties, it will be important to review current data collection practices and procedures for compliance with IPP 3A,” added an insight from Bell Gully.
“Agencies will need to review what personal information they currently collect from third parties and other indirect sources and potentially update their privacy statements to comply with IPP 3A,” stated an insight from Simpson Grierson.
An insight from Anthony Harper stressed that businesses would need to consider the consequent implications regarding notification obligations, policy updates, training and governance, and contractual and vendor arrangements.
