The Privacy Amendment Act 2025 brought into force information privacy principle (IPP) 3A from 1 May 2026, adding to the Privacy Act’s set of 13 IPPs. IPP3A is a new notification obligation, covering the collection of personal information other than from the individual concerned (that is, indirect collection). It sits alongside the existing notification obligation IPP3, covering collection of information from the individual concerned. To avoid any confusion, the set of IPPs is still numbered 1-13 with new IPP 3A being inserted to follow IPP3. We will be gradually updating our website content as resources allow to reflect this change. We have guidance on the new IPP3A. A number of codes of practice have also been amended following consultation to include new rule 3A.
Principle 1 states that organisations must only collect personal information if it is for a lawful purpose connected with their functions or activities, and the information is necessary for that purpose. This principle is about data minimisation. When asking people for their personal information, think carefully about why you are collecting it. Don’t collect people’s identifiers such as name, phone number, etc unless it’s necessary for your collection purpose. If the personal information you are asking for isn’t necessary to achieve something closely linked to your organisation’s activities, you shouldn’t collect it.
states that personal information should be collected directly from the person it is about. The best source of information about a person is usually the person themselves. Collecting information from the person concerned means they know what is going on and have some control over their information.
requires organisations to be open about why they are collecting personal information and what they will do with it when collecting it from the person directly. This principle is about helping people understand the reasons you are collecting their information.
Principle 3A means that if an agency collects someone's personal information indirectly, that agency is required to
- notify them, unless one of the listed exceptions applies. This principle is about helping people understand the reasons you are collecting their information.Collecting personal information indirectly means that the agency collects the personal information from someone other than the person themself.The obligation to inform the individual sits with the agency that collects the information indirectly.Before your agency collects personal information indirectly, you still need to assess whether you have a proper basis to do so under IPP2. Agencies should be collecting personal information from an individual directly, unless an exception under IPP2(2) applies. Read the exceptions here
Principle 4 states that personal information must be collected in a way that is lawful and seen as fair and reasonable in the circumstances.What is fair depends a lot on the circumstances like the individual concerned (age and capacity) and the natural sensitivity of the information. Note that threatening, coercive, or misleading behaviour when collecting information from an individual could well be considered unfair.If you break the law when collecting information, then you have collected information unlawfully.What is fair also depends on the circumstances, such as
- the purpose for collection,
- the degree to which the collection intrudes on privacy,
- the time and place it was collected.
You need to take particular care when collecting information from children and young people. It may not be fair to collect information from children in the same manner as you would from an adult. You may need to take special care with the information of young people to address any power imbalance, and to obtain their genuine consent for the collection (or the authorisation) of their family/whānau.
states that organisations must ensure there are safeguards in place that are reasonable in the circumstances to prevent loss, misuse or disclosure of personal information.If an organisation has a serious privacy breach it must notify the Office of the Privacy Commissioner as soon as possible (within 72 hours).
states that people have a right to ask for access to their own personal information.Generally, an organisation must provide access to the personal information it holds about someone if the person in question asks to see it. People can only ask for information about themselves. The Privacy Act does not allow you to request information about another person, unless you are acting on that person’s behalf and have written permission.The rules for how an organisation must respond to a request for personal information are set out in Part 4, Subpart 1 of the Privacy Act 2020.
states that a person has a right to ask an organisation or business to correct information about them if they think it is wrong.If an organisation does not agree that the information needs correcting, an individual can ask that an agency attach a statement of correction to its records, and the agency should take reasonable steps to do so.The rules for how an organisation must respond to a corrections request are set out in Part 4, Subpart 2 of the Privacy Act 2020.
states that an organisation must check before using or disclosing personal information that it is accurate, up to date, complete, relevant and not misleading.
states that an organisation should not keep personal information for longer than it is required for the purpose it may lawfully be used.
means that organisations can generally only use personal information for the purpose it was collected, and there are limits on using personal information for different purposes.Sometimes other uses are allowed, such as use that is directly related to the original purpose, or if the person in question gives their permission for their information to be used in a different way.
means that an organisation may generally only disclose personal information for the purpose for which it was originally collected or obtained. Sometimes other reasons for disclosure are allowed, such as disclosure for a directly related purpose, or if the person in question gives their permission for the disclosure.
sets rules around sending personal information to organisations or people outside New Zealand. Principle 12 was a new principle in the Privacy Act 2020.A business or organisation may only disclose personal information to another organisation outside New Zealand if they check that the receiving organisation subject to the Privacy Act because they do business in New Zealand will adequately protect the information, e.g. by using model contract clauses, oris subject to privacy laws that provide comparable safeguards to the Privacy ActIf none of the above criteria apply, a business or organisation may only make a cross-border disclosure with the permission of the person concerned. The person must be expressly informed that their information may not be given the same protection as provided by the New Zealand Privacy Act.
sets restrictions on assigning identifying numbers and other unique identifiers to individuals. The principle states that an organisation can only assign unique identifiers to people when it is necessary for its functions.Unique identifiers are individual numbers, references, or other forms of identification allocated to people by organisations as a way to uniquely identify the person to the organisation assigning the identifier. Examples include driver’s licence numbers, passport numbers, IRD numbers, or National Health Index (NHI) numbers. An organisation cannot assign a unique identifier to a person if that unique identifier has already been given to that person by another organisation. For example, this prevents the Government from giving you one personal number to use in all your dealings with government agencies.However, an organisation can record (and use) a person’s unique identifier so that they can communicate with another organisation about the individual.Organisations must also take reasonable steps to protect unique identifiers from misuse and make sure they verify someone’s identity before assigning a unique identifier.
(Office of the Privacy Commissioner, 2020)