IPP3A privacy notices: what must NZ businesses do when information comes from someone else?
From 1 May 2026, New Zealand’s information privacy principle 3A requires reasonable steps to notify people when their personal information is collected indirectly, unless an exception applies. Businesses should identify the collection, check what the person already knows and arrange timely notification. The information-sharing parties still have other Privacy Act obligations.
What counts as indirect collection of personal information?
Indirect collection means obtaining someone’s personal information from another source rather than from that person. Referrals, employment references and third-party customer records can raise the issue. Assess what your business actually receives and why, rather than relying on the name of the process.
Before considering notification, establish whether indirect collection is permitted under information privacy principle 2. IPP3A does not create permission to collect information that would otherwise be inappropriate, and notification does not automatically make the sharing lawful.
What does the person need to know?
The Privacy Commissioner identifies the collection, purpose, intended recipients, relevant agencies, access and correction rights, and any law authorising or requiring the collection as matters to address. Notification is about the actual transaction, not simply displaying a general privacy slogan.
Prepare an explanation someone can understand without knowing your internal systems. Identify who is responsible for answering questions. If a supplier holds the records, make sure the explanation reflects that arrangement.
When should notification happen?
The required steps must be taken as soon as reasonably practicable after collection, unless taken sooner. Build the task into the workflow so it is not dependent on someone remembering at month-end.
- Identify the source, information and purpose.
- Check the basis for collection and disclosure.
- Assess whether the person has already received the necessary explanation.
- Select a reasonable notification method and timing.
- Record what was done or why a particular exception was relied on.
Can the business rely on a notice given by the original collector?
Potentially, but it needs an appropriate basis for doing so. The Commissioner’s detailed guidance explains the exception where the individual has already been made aware of all required matters. A broad promise that a supplier has obtained “all consents” may not establish what was actually communicated.
For example, a referral partner might identify your business and explain the transfer properly, or might merely say that information could be shared with unspecified partners. Review the wording and process before deciding that no further notice is required.
When might another exception apply?
The principle contains exceptions, including circumstances involving publicly available information or particular risks and purposes. Their conditions matter. Document the facts supporting reliance on an exception instead of treating it as a standard opt-out for an inconvenient process.
Ask for advice where notification could affect safety, an investigation or contemplated proceedings. A decision appropriate to one case may not justify the same approach for every referral or customer record.
What should change in supplier contracts and staff procedures?
Assign responsibilities clearly and test the hand-off between organisations. A contract can allocate practical tasks, but it does not remove your organisation’s statutory obligations.
- Describe what information each party collects and for which purpose.
- Agree who gives which explanation and how that can be evidenced.
- Provide a route for access, correction and customer enquiries.
- Train staff to identify exceptions requiring advice.
- Review the process when the source or use changes.
Canterbury Legal’s commercial-contract services can help document responsibilities alongside business legal advice. Contact our Christchurch team with a sample workflow, current notices and the supplier agreement.
What other questions do people ask?
Does IPP3A apply to information collected before 1 May 2026?
The Commissioner’s guidance says the new requirements apply to personal information collected from 1 May 2026. Other privacy obligations can still apply to older information.
Is a website privacy policy always enough?
Not necessarily. Assess whether reasonable steps have made the person aware of the required matters for this collection.
Does notifying someone make an otherwise unlawful disclosure acceptable?
No. The parties must separately assess the legal basis for collecting and disclosing the information.
Which official sources explain these rules?
- Privacy Commissioner: principle 3A and timing
- Privacy Commissioner: detailed IPP3A guidance and exceptions
- Privacy Commissioner: final indirect-collection guidance
Information checked on 28 October 2026. This article provides general information about New Zealand law and is not a substitute for advice about your circumstances.
