IPP 3A six months on, and the collections we'd check first

Since 1 May 2026, organisations that collect personal information about someone from anyone other than that person must take reasonable steps to make sure the person knows, unless an exception applies. It’s information privacy principle 3A, and it applies to information collected from 1 May onwards.

Plenty of organisations updated their privacy statement in April and moved on. A statement alone may not be enough. If you haven’t checked how people actually find out about each indirect collection, start with these.

1. Reference checks

You collect a referee’s views about an applicant. That’s indirect collection. To fix it, say in your job application form that you’ll contact the referees the applicant nominates, why, and who will see what they say. That tells the applicant in advance.

2. Credit and identity checks

Information from credit reporters or verification services is indirect collection. The Commissioner’s own example has a lender naming the credit reporters it collects from, and the purpose, in the application form, then keeping evidence the client saw it.

3. Referrals from partners

If another organisation refers people to you, you’re collecting from that organisation. Either the referrer tells the person about you (and you can show it, ideally because your agreement requires it), or you tell them when you first make contact.

4. Children’s information from parents

The Commissioner treats this as indirect collection. Address your notice to the parent, so they can explain it to their child in a way that suits their age.

5. People named by your customers

Emergency contacts, additional drivers, household members, beneficiaries. For emergency contacts, the Commissioner gives an example where the “would not prejudice their interests” exception is likely to apply. For others, especially where you’ll use the information to make decisions about that person, you probably need to notify.

6. Bought or shared lists

If you receive a marketing list, you’re an indirect collector, and so is anyone further down the chain. The Commissioner’s example allows a short delay so the notice can arrive with your first campaign message, but not skipping it.

7. Online research

Information about people gathered from the web or social media. If it’s genuinely public, such as an open website or public profile, the publicly available exception may apply. A private account you can see because you follow it isn’t public.

How to check yourself

Use our indirect collection check for each type of collection. It asks whether an exception applies, explains what evidence you’d need, and drafts a notice and a decision record. Keep the records together. If the Privacy Commissioner ever asks how you comply with IPP 3A, that file is the answer.

The Ministry of Justice has said one aim of the change is to support New Zealand keeping its adequacy status with the European Union. For businesses trading with Europe, getting this right is about more than domestic compliance.