New privacy information principle now in force

New privacy information principle now in force

An important change to New Zealand's privacy laws about the indirect collection of personal information is now in force.

The Privacy Amendment Act 2005 introduced a new information privacy principle 3A (IPP 3A), which came into force on 1 May 2026.

IPP 3A changes an agency's obligations when it collects personal information indirectly. Collecting personal information indirectly means that the agency collects the personal information from someone other than the person concerned.

Under the Privacy Act 2020, an "agency" is defined broadly as any person or body of persons-corporate or unincorporated-in the public or private sector that collects, holds, uses, or discloses personal information. This includes government agencies, schools, hospitals, businesses and community and social service and welfare organisations.

Under IPP 3A, if an agency collects someone's personal information indirectly, that agency is required to notify them. IPP 3A applies to all personal information agencies collect indirectly, from any source. This means that whether the agency collecting the information gets it indirectly from a person or another agency, it will still need to tell the person concerned unless an exception applies.

Exceptions to IPP 3A include the personal information already being publicly available (e.g., in a book, newspaper, public register or website), or if the agency that collected the information in the first place has already advised the person concerned.

The collection of information from sources other than the individual concerned was highlighted as a gap in our privacy system by the European Union during its assessment of New Zealand's EU "adequacy status".

EU adequacy means New Zealand businesses can receive personal information from the European Union without implementing individual contractual agreements. The Amendment Act is designed to support New Zealand to retain its adequacy status.

The Office of the Privacy Commissioner has developed guidance on IPP 3A which is available on its website(external link).

For background on the development of the Privacy Amendment Act, including Cabinet papers and the Regulatory Impact Statement, visit the Ministry of Justice website.

← Back to the news