New indirect collection notification obligations under the Privacy Act

The Privacy Amendment Act 2025 introduces a new Information Privacy Principle (IPP 3A), which comes into force on 1 May 2026. From that date, if your organisation collects personal information from someone other than the individual concerned, you must take reasonable steps to ensure the individual is aware of certain key matters - unless a statutory exception applies.

What’s indirect collection? 

Indirect collection is when personal information is obtained from a third party rather than directly from the individual.

Common examples include:

• Receiving information from another agency in order to deliver services
• Data-sharing partnerships (e.g. loyalty schemes or marketing collaborations)
• Job applicant information including reference or criminal record checking 

If the information didn’t come directly from the individual, IPP 3A is likely to apply.

What must individuals be told?

Agencies must take reasonable steps to ensure individuals are aware of:

• The fact their information has been collected
• The purpose of collection
• Who it may be shared with
• The agency collecting (and holding) the information
• Whether collection is authorised or required by law (if relevant)
• Their rights of access and correction

Notification must be given as soon as reasonably practicable after collection, unless the individual has already been made aware. What counts as “reasonable steps” will depend on the context, including the sensitivity of the information and potential impact on the individual.

Can you rely on a third party to provide notice?

You may address IPP 3A through contractual arrangements (for example, requiring another agency to include the required notice in its privacy statement, if they have the first contact with the individual). However, the agency collecting the information indirectly remains responsible for compliance and needs to be comfortable that the notice has been delivered to individuals. 

What should you be doing now?

Practical steps to take now include:

• Mapping your data flows: What personal information do you collect indirectly? From whom? For what purpose?
• Reviewing third-party arrangements: Are roles and responsibilities around notification clearly addressed?
• Updating privacy notices: Do your existing notices adequately cover indirect collection scenarios?
• Training relevant staff: Particularly those managing partnerships, procurement, marketing, and data-sharing arrangements.

The introduction of IPP 3A is a reminder that transparency remains a core principle of New Zealand privacy law - even where information is not collected directly from individuals.