New Privacy Law Obligations
New Privacy Act obligations come into force on 1 May 2026 to address data collected from indirect sources.
Companies or individuals who hold personal information about employees, clients or the public need to know about new changes to the Privacy Act 2020 that come into effect on 1 May 2026.
The Privacy Act 2020 introduces a number of Information Privacy Principles (IPP) including IPP3, which requires agencies to take reasonable steps to inform individuals when their personal information is collected directly from them. Reasonable steps include:
- Explaining the purpose of collection;
- Who will receive the information;
- Whether collection is required by law; and
- The individual’s rights of access and correction.
The Privacy Amendment Act 2025, which comes into force on 1 May 2026, introduces IPP3A. IPP3A is intended to align New Zealand’s Privacy principles with other countries like Australia, the UK and Europe, by applying the same principles to information that is collected indirectly about individuals.
For example, if an individual lodged a claim their insurer for vehicle damage, any details the insurer sought from the mechanic would be personal information that had been collected indirectly. Similarly, agencies who receive or share personal information about their clients with banks, accountants, credit rating agencies, cloud software, or government organizations, are now subject to IPP3A.
Under the IPP3A, the agency must take the same steps as are required under IPP3 (summarized above). The Act provides exceptions to the above disclosure requirements, most notably, if an individual has been previously made aware of all the matters listed above, then further disclosure is not required.
It is therefore recommend that anyone who obtains, stores or shares personal information ensures that their agreements, contracts, terms of trade, and letters of enagagement as applicable comply with the disclosure requirements for IPP3A before 1 May 2026.
If you have any questions about your obligations under the Privacy Act or IPP3A, or wish to review your compliance, please contact your Saunders & Co lawyer or for all other enquiries contact partner Stephen Caradus.