New Zealand organisations must notify individuals when their personal information is collected indirectly under new privacy legislation that takes effect May 1, 2026.

The Privacy Amendment Act introduces Information Privacy Principle 3A, requiring agencies to inform people when data is gathered from third parties rather than directly from the individual.

Organisations must disclose what information was collected, the purpose, intended recipients, and individuals' rights to access and correct their data.

The law addresses a regulatory gap in New Zealand's Privacy Act 2020, which previously only required notification when personal information was collected directly from individuals.

The change affects any organisation collecting data from sources such as data brokers, background check providers, referral networks, or business partners.

New Zealand's Privacy Commissioner Michael Webster said the amendment aligns the country's privacy framework with international standards in Australia, the United Kingdom and Europe, where notification for indirect collection is already required. Australia's Privacy Act requires notification under APP 5 regardless of whether information is collected directly or indirectly.

“Telling people when you’re collecting information about them supports open and transparent collection practices and helps people better understand where and how their information is being used,” said Mr Webster. 

Organisations have until May 2026 to implement compliant systems and processes. The Office of the Privacy Commissioner will publish guidance on privacy.org.nz later this year and is reviewing existing Privacy Act codes of practice to incorporate the new requirements.

The amendment does not apply retrospectively to information collected before 1 May 2026.

Law firm Anthony Harper notes “There are exceptions to the notification requirement under the new IPP 3A and these are similar to the exceptions in IPP3, but IPP3A adds additional exceptions for publicly available information, national security/international relations, trade secrets and commercial factors, and serious risks to public health or safety.”