How to Prepare for the Privacy Act Amendment 2025
New Zealand has officially approved the Privacy Amendment Act 2025, updating the Privacy Act 2020 to enforce IPP 3A starting May 2026.
The Privacy Amendment Act 2025 features the Information Privacy Principle 3A (IPP 3A), which is designed to increase transparency around the indirect collection of personal information. This change to New Zealand data protection laws requires organisations to inform individuals when they collect personal information from a third-party source, bringing the nation in line with other countries.
Learn more about how IPP 3A might affect your business and how you can prepare your privacy systems in advance.
What is IPP 3A?
The Information Privacy Principle 3A (IPP 3A) increases transparency around the indirect collection of personal information. It expands upon the existing IPP 3 legislation, which details obligations for direct collection.
IPP 3A helps individuals understand how their data is being used and enables them to reach the organisation that originally collected the information. It also helps to prevent companies from misusing data.If an organisation collects personal information from a source other than the individual, it must take reasonable steps to tell the individual concerned:
- that their information has been collected
- the name and address of the agency collecting the information and the agency holding it
- the purpose of the collection
- the intended recipients of the information
- whether the collection is authorised or required by law, and which law
- their rights to access and correct their information
For example, if an organisation emailed an individual for a job interview, it would be good practice to inform the individual which recruitment agency supplied the information within the email, with contact details such as a website.
Some of the key exceptions to IPP 3A apply. Organisations don’t have to inform individuals of personal information collected if:
- it is publicly available information
- compliance would compromise the security or defence of New Zealand or the government’s international relations
- compliance would reveal a trade secret
- compliance would cause serious threat to public health or safety or the health and safety of another individual
When Does IPP 3A Come Into Effect?
IPP 3A comes into force on 1 May 2026, and applies only to personal information collected on or after that date. The limited timeframe means that businesses need to act quickly to review and update their privacy policies.
Who Does the NZ Privacy Act Apply to?
New Zealand’s data privacy legislation applies to any organisation or business in the public or private sector that collects personal information about other individuals. This includes:
- Governments
- Companies
- Clubs
- Charities and community groups
The Privacy Act doesn’t apply to individuals collecting data in their personal or domestic capacity.
How Can You Ensure Your Business is Ready for IPP 3A?
Conduct a Privacy Audit
Identify where you indirectly collect personal information from, which third parties you disclose personal information to, and if you need to notify individuals about the use of third-party information.
Update Privacy Policies
Update your privacy policies and privacy notes within forms, websites, and digital platforms to reflect IPP 3A requirements.
Assess Current Contracts
Review contracts with customers and vendors to ensure they meet new disclosure and notification obligations.
Update Privacy Systems
Update your internal privacy systems to ensure you aren’t leaking data to other parties unintentionally, such as through third-party integrations or outbound emails.
Prevent Data Leakage with SendGuard
Alongside updating your notices and contracts for IPP 3A, it’s also important to reduce everyday privacy risks like misdirected emails and errors in emails. These mistakes can lead to businesses accidentally sharing confidential information with unintended audiences. And with the new IPP 3A obligations coming into effect soon, customer data security is more important than ever—and preventing outbound email risks should be one of the priorities.
The SendGuard Outlook add-in is designed to help companies prevent unintended emails. With features like confirmation prompts, email undo, and external domain highlighting, it reduces the risk of accidentally breaching privacy laws in NZ. Start your free 30-day trial today.