New Zealand’s privacy landscape is set to undergo a significant shift with the passage of the Privacy Amendment Act, which introduces a new Information Privacy Principle (IPP 3A). This reform is the most substantial update since the Privacy Act 2020, and it takes effect on 1 May 2026.

From direct to indirect collection: closing the gap

Currently, under IPP 3, agencies that collect personal information directly from individuals are required to notify them about key details. This includes the purpose of collection, who will hold the information, and the individual’s rights to access and correct their data.

However, in practice, personal information is often obtained indirectly – through third parties, contractors, business partners, or publicly available sources. Until now, the law has not explicitly required agencies to notify individuals in these circumstances. IPP 3A closes this gap, extending the notification duty to cover information collected from sources other than the individual concerned.

What agencies must communicate under IPP 3A

From May 2026, organisations will need to take reasonable steps to notify affected individuals when collecting their personal information indirectly. This notice must cover:

• • the lawful purpose of the collection,

• • the name and address of the collecting agency,

• • who will receive or hold the information,

• • any legal authority that supports the collection, and

• • the individual’s rights to access and correct their personal information.

The intent is to ensure individuals remain informed about how their data is obtained and used, regardless of the collection pathway.

Recognising practical limits: exceptions under IPP 3A

The new law acknowledges that mandatory notification is not always feasible or meaningful. To balance transparency with practicality, IPP 3A outlines several exceptions, including where:

• • the individual has already been made aware of the collection,

• • providing notice would not meaningfully benefit the individual, or

• • the information will be used in a way that does not identify the individual.

These carve-outs reflect a pragmatic approach, ensuring compliance obligations do not become unnecessarily burdensome while still advancing the principle of openness.

Implications for organisations

The introduction of IPP 3A represents a shift towards proactive transparency and accountability in New Zealand’s privacy regime. For many organisations, it will require:

• • Reviewing information flows — understanding where and how personal information is obtained from third parties.

• • Updating policies and procedures — embedding notification steps into data handling practices.

• • Training staff and contractors — ensuring those involved in data collection are aware of the new requirements.

• • Engaging with third parties — clarifying responsibilities in contractual arrangements where information is shared or collected indirectly.

Why this matters

As public expectations around privacy continue to evolve, transparency is becoming not only a regulatory obligation but also a driver of trust and confidence. By notifying individuals when their information is collected indirectly, agencies demonstrate respect for autonomy and reinforce accountability in their data practices.

The lead-up to May 2026 provides an important window for organisations to assess their current practices and prepare for compliance. Those who take early steps will not only reduce risk but also strengthen their reputation as responsible custodians of personal information.