Faraday
Get help now

Indirect collection check (IPP 3A)

Since 1 May 2026, if you get someone's personal information from anyone other than them, you usually have to tell them. Check whether you must, and draft the notice.

Your data
Runs in your browser. Nothing you type is sent anywhere.
Sources
4 cited
The collection

Answer for one type of collection at a time, for example "reference checks on job applicants" or "customer lists from a partner".

Does an exception apply?

Only tick an exception you could justify to the Privacy Commissioner with evidence. Inconvenience, cost or awkward systems are not enough on their own.

Details for the notice

Things people get wrong

  • IPP 3A doesn't make indirect collection lawful. You still need a proper basis under IPP 2 to collect from someone else, and the source needs a basis under IPP 11 to disclose to you.
  • Every agency in a chain can be an indirect collector. One of you can notify on behalf of the others, but the duty stays with each collector. Put it in the contract and keep evidence.
  • A cloud provider holding data for you isn't collecting it. Under s 11 of the Privacy Act, information held on your behalf is treated as yours, so the IPP 3A duty is yours.
  • Children's information collected from parents is indirect. Tell the parent the IPP 3A matters so they can pass them on, as the Commissioner's school camp example shows.

Read the Commissioner's full IPP 3A guidance before relying on an exception that involves an investigation or a "prejudice" judgement.

Sources

  1. IPP3A: notification requirements for indirect collection of personal informationOffice of the Privacy Commissioner. Checked 19 October 2026.
  2. IPP3A decision flowchart (PDF)Office of the Privacy Commissioner. Checked 19 October 2026.
  3. Enhancing the Privacy Act (Privacy Amendment Act 2025)Ministry of Justice. Checked 19 October 2026.
  4. Privacy Act 2020, s 11 (information held by an agency on behalf of another)NZLII. Checked 19 October 2026.

Something wrong or out of date? Tell us or edit this page on GitHub. General information, not legal advice.