How did you get my details?

If an organisation in New Zealand gets your personal information from someone else, it generally has to take reasonable steps to tell you it collected the information, why it did so and how you can access or correct it. The rule, known as IPP3A, has applied since 1 May 2026, with exceptions.

A friend passes on a potential customer’s details. A customer signs up to a loyalty programme.

Both can be ordinary parts of doing business. They’re also useful prompts to check how personal information enters an organisation and what happens next.

What changed in May 2026?

Information Privacy Principle 3A introduced notification obligations when organisations collect personal information from someone other than the person it’s about. A referral can be indirect collection. A customer giving their own details when signing up for a loyalty programme is direct collection, which is covered by separate notice rules.

Where does your information come from?

You receive a call from a company you’ve never dealt with. They know your name, your contact details and something about your circumstances.

Perhaps another professional referred you. Perhaps someone passed on your details to help arrange a service. There may be a straightforward explanation, but it’s reasonable to ask: “How did you get my information, and what are you using it for?”

For businesses receiving those details, the same question is a useful check. Can you explain where the information came from, why you collected it and what the person has already been told?

What should you expect to be told?

When IPP3A applies, the organisation that collects your details must take reasonable steps to tell you:

• That it collected your information and why.
• Who it intends to share the information with.
• The names and addresses of the organisations that collected and hold it.
• Which law authorises or requires the collection, if applicable.
• How you can access your information and ask for a correction.

The organisation must take those steps as soon as reasonably practicable after collection, unless it has taken them sooner or an exception applies. A privacy policy sitting on a website may not, by itself, be enough.

Does every referral require another notice?

No. For example, another notice isn’t required if the person has already been told everything IPP3A requires about that collection. Being told that someone “passed your details on” may still leave questions about which organisation received them and why.

Giving notice does not make collecting or sharing information lawful by itself. Those obligations need separate consideration. Read the Privacy Commissioner’s guidance or our IPP3A guide for New Zealand businesses.

What can you do next?

If you’re contacted unexpectedly, ask where your details came from and why they’re being used. If something is inaccurate, ask how to have it corrected.

If you receive personal information through your work, check what the person has already been told and whether your process meets the requirements. If you’re making an introduction, ask the person before passing on their details. It gives them a choice and helps the recipient understand what contact they’re expecting.

How can Canterbury Legal help?

People should understand how their information is being used. Businesses benefit from a consistent process they can explain. Whether you’re concerned about your own information or reviewing how your organisation handles other people’s details, contact Canterbury Legal to discuss your next steps.