IPP3A – From May 2026, what changes for you?

From 1 May 2026, a new Information Privacy Principle will apply in New Zealand. IPP3A will be added to the Privacy Act 2020 and requires businesses that collect personal information indirectly, not directly from the individual, to notify the person concerned.

What must be notified?

If you collect information indirectly, you must take reasonable steps, as soon as practicable, to make sure the person knows:

• that their information has been collected

• the purpose for the collection

• the intended recipients (specific recipients, not just a class)

• the name and address of the collecting and holding agency

• any law authorising or requiring the collection

• their rights to access and correct their information.

When does it apply?

IPP3A applies to all indirect collections made on or after 1 May 2026. It will not apply to information collected before that date.

How long do I have to make the notification?

Notification must be made as soon as reasonably practicable after collection. What is 'reasonable' depends on the circumstances. Sometimes this will mean immediate notification, for example during an online process. The OPC guidance also gives an example where notification is expected within three months. For each indirect collection, you will need to assess the timeframe and document your justification.

Does it apply to processors?

No. If your business is acting as a service provider or processor on behalf of another agency, you are not responsible for notification. The duty sits with the agency that decides how and why the information is collected and used.

Are there exceptions?

Yes. There are a range of situations where notification will not be required, many of them carried over from IPP3. IPP3A also adds some new exceptions that apply specifically to indirect collections. I will cover these in detail, with examples, in my next post.

How wide is this?

The scope is broad. IPP3A could apply to information such as credit reports, emergency contact details, referral letters, photographs, CCTV images, information drawn from social media or public registers, customer information purchased from a data broker, and referee details provided in recruitment.

IPP3A represents more than a technical change. It signals a move toward stronger transparency and accountability. Agencies that prepare early will be better placed to meet their new obligations and to build trust by showing individuals exactly how their information is being used.

If your business collects information from third parties, now is the time to get ready. At O’Brien Legal we can help you with the strategy for managing IPP3A, update your contracts and privacy notices, and ensure you have the right processes to document and justify any exceptions you rely on.

This is not legal advice. If you want legal advice on the implications for your business, please contact me directly.

IPP3A, Privacy Amendment Act 2025, Privacy Act 2020