The Privacy Amendment Bill (Bill), introduced in September 2023 (see our earlier analysis on the Bill and submission), has passed the Committee of the Whole House. Only two parliamentary stages remain before it becomes law.

As outlined in our previous alert, the Bill’s most notable reform is the introduction of Information Privacy Principle (IPP) 3A, which governs notification obligations when personal information is collected indirectly — that is, from someone other than the individual concerned. 

Although the Bill has not yet been enacted, Parliament has signalled that IPP3A will come into force on 1 May 2026. In anticipation, the Office of the Privacy Commissioner (OPC) released draft guidance on 29 April 2025 (Draft Guidance). The Draft Guidance is open for public consultation until 25 June 2025.

What is IPP3A? 

IPP3A imposes a new notification duty on agencies that collect personal information from third parties, rather than directly from the individual concerned. The intent is to enhance transparency and individual control over information that is not collected directly. Agencies must notify the individuals concerned in accordance with IPP3A unless a specific exception applies.

What is the Draft Guidance about?

The OPC offers practical direction on how agencies should comply with IPP3A, including:

• who must notify;
• the level of detail expected in notifications;
• when and how to notify; and
• when notification is not required.

Notification Requirements: Level of Detail

A key aspect of the Draft Guidance is that it sets out the Privacy Commissioner’s expectations for how agencies should meet IPP3A’s notification obligations. These expectations effectively shape the compliance benchmark and serve as a strong indicator of how the law will be interpreted and enforced in practice.

The OPC makes clear that generic or vague disclosures will not suffice. Agencies must:

• Specify what information has been collected, and from whom, using plain language.

Example: “ We have collected your contact details from your recruiter, X recruitment. ”

• Clearly articulate the purpose of collection in specific terms.

Example: “ We’ve collected your contact information to arrange an interview. ”

• Name the intended recipients — referring only to a type or class (for example, “credit reporting agency”) is inadequate.

Example: “ We may share your information with Equifax, Illion, or Centrix .”

• Identify the collecting agency, ideally with a link to its website.
• Explain access and correction rights, including how to exercise them.

In practice, this means many agencies will need to review — and likely revise — their existing privacy statements, policies, and processes to meet these new expectations.

Service Providers

If personal information is held by a third-party provider on behalf of a client, the client remains responsible for notification (consistent with section 11 of the Privacy Act). The OPC confirms that IPP3A does not apply to service providers holding information for or on behalf of their customers, because the service providers are not collecting relevant information or using it for their own purposes. In these cases, the principal agency (the customer) is therefore responsible for complying with any notification obligations (whether under IPP3 or IPP3A).

Exceptions

Notification under IPP3A is not required where specific statutory exceptions apply. The most commonly applicable exceptions include:

• Individual already notified (IPP3A(3)) : Where the individual has already been made aware of all the matters in IPP3A(1), including the identity of the collecting agency. This may occur where notification was given at the time of original collection. The collecting agency must have a documented evidentiary basis for reasonably believing this has occurred, and should not rely on assumptions.
• No prejudice to individual (IPP3A(4)(a)) : Applies where the agency believes, on reasonable grounds, that non-compliance would not prejudice the interests of the individual concerned. The OPC explains this generally means the individual would suffer no detriment or loss of important information from not being notified. A key threshold is the “no-surprises” test — if the individual would be surprised to learn their information was collected indirectly, the exception likely does not apply.
• Not reasonably practical (IPP3A(4)(e)) : This goes beyond inconvenience or cost — the burden must be clearly disproportionate. The more sensitive or extensive the data, the higher the bar.

Additional exceptions apply in more limited or specific contexts. These include situations where notification would undermine the purpose of collection (such as internal investigations); where it would pose a serious threat to public or individual safety; where the information is used solely for research or statistical purposes in a non-identifiable form; or where it supports archiving in the public interest and notification would seriously impair that function. Notification may also not be required if it would reveal a trade secret, unreasonably prejudice someone’s commercial position, interfere with legal or revenue-related proceedings, or compromise national security or international relations.

Agencies should maintain a documented basis for relying on an exception.

Duration of exceptions

Reliance on an exception is not indefinite. Agencies must periodically reassess whether the circumstances justifying non-notification still apply. If the basis for an exception falls away — for example, if contact details become available or the risk of harm subsides — then notification must occur as soon as reasonably practicable thereafter.

Even where an exception continues to apply, the OPC encourages agencies to consider voluntary notification, particularly where it supports transparency and trust without undermining the original purpose or creating risk.

Next steps

The OPC is seeking submissions on the Draft Guidance, with feedback due by 25 June 2025. Submissions can be sent directly to IPP3A@privacy.org.nz.

Agencies collecting personal information indirectly should begin reviewing their current practices — including privacy statements, internal processes, and third-party arrangements — to assess readiness for IPP3A. Where needed, updates should be scoped and scheduled to ensure compliance by the 1 May 2026 commencement date.

Find out more

If you have questions about IPP3A or would like support preparing for compliance, our privacy experts Hayley Miller, Campbell Featherstone, Güneş Haksever and Ashleigh Ooi are available to assist. We can help you review your current privacy practices, assess where IPP3A applies, and update your privacy policies, collection notices, and third-party arrangements to meet the new notification requirements. We can also assist in drafting or refining your submission to the OPC, should you wish to provide feedback on the Draft Guidance before the 25 June deadline.

This article was written by Erin Choi-Brown, a Law Graduate, and Güneş Haksever, a Senior Associate, from our Corporate and Commercial team.