On 23 September 2025, the Privacy Amendment Act received Royal assent, marking a significant milestone in the evolution of New Zealand’s privacy framework.

The headline reform of the Amendment Act, which amends the Privacy Act 2020, is the introduction of IPP 3A. IPP 3A requires agencies to notify individuals when their personal information is collected indirectly – that is, from a source other than the individual concerned.

This change has been in the making for over two years, and we’ve provided our thoughts on the various developments that have occurred over that period. Refer to our May 2025 article for our most recent update on the draft IPP 3A compliance guidance issued by the Office of the Privacy Commissioner.

Refresher of key changes

You can refer to our earlier update for a detailed summary of the implications of IPP 3A, or get in touch with us directly for advice on its application to your business.

In summary, the ‘need to knows’ for affected organisations are:

• IPP 3A will come into force on 1 May 2026, in respect of personal information collected on and from that date. Personal information collected before 1 May 2026 will not be impacted by IPP 3A.
• From 1 May 2026, the IPP 3 ‘notification’ requirements will extend to ‘indirect’ collection of personal information – that is, organisations must take reasonable steps to notify affected individuals of certain matters when collecting their personal information from a third party source. Currently, notification is only required if personal information is collected directly from the individual concerned.
• The matters that must be notified, as well as the circumstances in which notification is not required, are largely taken from IPP 3. Additional exceptions to notification have been introduced (for IPP 3A only) to address considerations relating to publicly available information, national security and international relations, commercial factors including trade secrets, and public health and safety. An important carve-out was also added following Select Committee review for galleries, libraries, archives, and museums, ensuring that public interest archiving is not unduly burdened by the new notification requirements.

The Amendment Act also introduces several technical changes to other parts of the Privacy Act, which took effect on 24 September 2025.

Get IPP 3A ready

With the 1 May 2026 commencement date confirmed, organisations should begin preparing for compliance. This could include:

• Mapping data flows: Identifying where personal information is collected indirectly and assessing whether notification is required.
• Reviewing privacy notices: Updating privacy statements to reflect indirect collection scenarios.
• Assessing contractual arrangements: Ensuring that your vendor and customer contracts support IPP 3A compliance.
• Engaging with OPC guidance: As discussed in our recent article, the Office of the Privacy Commissioner has released draft guidance on IPP 3A compliance and is conducting targeted engagement to support implementation.

Looking ahead

If you have questions about IPP 3A or would like support preparing for compliance, our privacy experts Hayley Miller, Campbell Featherstone, Güneş Haksever and Ashleigh Ooi are available to assist. We can help you review your current privacy practices, assess where IPP 3A applies, and update your privacy policies, collection notices, and third-party arrangements to meet the new notification requirements. We can also assist you in engaging with the Office of the Privacy Commissioner.

This article was written by Ashleigh Ooi, Senior Associate, in our Commercial, Technology and Privacy team.