The Privacy Amendment Act 2025 received royal assent on 23 September 2025, bringing material changes to New Zealand's privacy laws.

What are the key changes?

The main change in the Amendment Act is the new Information Privacy Principle 3A (IPP3A), which introduces obligations on agencies (which includes both individuals and businesses) when collecting personal information indirectly.

Agencies already have obligations under IPP3 in the Privacy Act 2020 to inform individuals when they are collecting personal information directly and IPP3A expands on these notification requirements by including obligations for indirect collection of information.

These new notification requirements will apply to personal information collected indirectly from 1 May 2026. The IPP3A notification requirements are largely the same as IPP3 and include the fact and purpose of collection, intended recipients, legal basis of collection, and rights of access and correction for the personal information.

There are exceptions to the notification requirement under the new IPP 3A and these are similar to the exceptions in IPP3, but IPP3A adds additional exceptions for publicly available information, national security/international relations, trade secrets and commercial factors, and serious risks to public health or safety.

What does this mean for businesses?

• Broadened notification obligations: Businesses must examine all cases where they might receive personal information from third parties or intermediaries to determine if the new notification requirements apply.
• Policy updates may be required: Privacy policies and notices should be reviewed and revised to incorporate scenarios of indirect collection and clearly articulate notification obligations.
• Contractual and vendor arrangements: Agreements with data suppliers and partners may need clauses addressing IPP3A compliance.
• Training and governance: Staff need to be aware of the new obligations and internal procedures should be updated.

Next steps

Businesses should act promptly to update their practices before the 1 May 2026 commencement of IPP3A. Anthony Harper is happy to assist with assessing impacts, revising policies, and ensuring compliance with the new obligations.