Telling people when you collect their information from others (IPP 3A)

Since 1 May 2026, if your organisation collects personal information about someone from anyone other than that person, you must take reasonable steps to make sure they know about it, unless an exception applies. The rule is information privacy principle 3A, added by the Privacy Amendment Act 2025. It only applies to information collected on or after 1 May 2026.

The Ministry of Justice has said the change is meant to help New Zealand keep its data protection adequacy status with the European Union, which matters for any business that trades with Europe.

What people must be made aware of

The same six matters as when you collect directly:

1. the fact that the information has been collected
2. why
3. who it will be shared with
4. your organisation’s name and address (an email or website is fine)
5. if a law authorises or requires the collection, which law
6. their right to access and correct it

You must do this as soon as reasonably practicable after collecting. You can also do it beforehand, including by having the organisation you collect from tell them on your behalf.

Collections that are often caught

Go through these with your inventory in hand:

• Recruitment: reference checks, background and credit checks, information from recruitment agencies.
• Credit and identity checks from credit reporters or verification services.
• Referrals from partners, other providers or agencies.
• Lists bought, swapped or received for marketing.
• Insurance and claims: information from repairers, assessors, doctors, other parties.
• Investigations: information from witnesses, neighbours or other organisations.
• Children’s information collected from parents, which the Commissioner treats as indirect collection.
• Information about other people that customers give you, such as emergency contacts, additional drivers or household members.
• Social media and web research about individuals.

The exceptions, in brief

You don’t have to notify if one of these applies and you can show it:

• the person already knows all six matters (with evidence, not an assumption)
• the information is publicly available
• not telling them wouldn’t prejudice their interests (for common, low-risk cases)
• it’s necessary for a public sector agency to maintain the law, to enforce a financial penalty, to protect public revenue, or for court or tribunal proceedings
• telling them would prejudice the purpose of the collection, such as a genuine fraud investigation
• telling them isn’t reasonably practicable (cost or inconvenience alone isn’t enough)
• telling them would cause a serious threat to public health or safety, or to someone’s health or safety
• it won’t be used in a form that identifies them
• it’s for research or statistics that won’t identify them when published
• archiving in the public interest, where notice would seriously impair it
• New Zealand’s security, defence or international relations would be prejudiced
• it would disclose a trade secret or unreasonably prejudice someone’s commercial position

Our indirect collection check walks through these and drafts a notice and a decision record.

A method that works

1. Find your indirect collections. Add a column to your personal information inventory: “Where do we get this from?” Anything that isn’t “the person” goes on your IPP 3A list.

2. Decide, for each one, how people will be told. There are three practical options:

• In advance, by you. If you also deal with the person directly, cover the indirect collection in the notice you already give them. An employer can explain reference checks in the job application form.
• In advance, by the source. Agree with the source organisation that its privacy notice names you and covers the six matters. Put it in the contract. Keep a copy of their notice.
• Afterwards, by you. Send a short notice when you first contact the person, or within a set time of receiving the information.

3. Record an exception where one genuinely applies, with the evidence. The Commissioner’s guidance says agencies relying on “prejudice the purpose” should take great care and seek advice.

4. Update your privacy statement with a section on information you collect from others. Our privacy statement template has one.

5. Update contracts with suppliers, partners and data sources to say who notifies whom.

Three points that trip people up

IPP 3A isn’t permission. You still need a proper basis under IPP 2 to collect indirectly, and the source needs a basis under IPP 11 to disclose to you.

Each collector in a chain has the duty. If information passes from A to B to C, both B and C are indirect collectors. One can notify for others, but each must be able to show the person was told.

A provider holding data for you isn’t the collector. Under section 11 of the Act, information a cloud or software provider holds only on your behalf is treated as held by you. The duty is yours.

Codes of practice changed too

The Commissioner amended several codes in March 2026 to add equivalent rules, including a rule 3A in the Biometric Processing Privacy Code and in the Health Information Privacy Code. If you’re covered by a code, check its version of the rule.