Privacy Amendment Act Passes, Strengthening Transparency in New Zealand’s Privacy Law

Key Takeaways

• New Law Passed: The Privacy Amendment Act introduces Information Privacy Principle 3A (IPP3A).
• Indirect Collection Covered: Agencies must inform individuals when their personal information is collected from someone else, with certain exceptions.
• Implementation Date: IPP3A will come into force on 1 May 2026, giving organisations time to prepare.
• Guidance Coming: The OPC will publish compliance guidance later this year and review Codes of Practice.
• Global Alignment: The reform keeps New Zealand’s privacy law in step with jurisdictions such as Australia, the UK, and Europe.

Deep Dive

New Zealand has passed the Privacy Amendment Act, introducing new obligations designed to give citizens greater clarity over how their personal information is collected and used. Privacy Commissioner Michael Webster said the reform will align the country’s framework more closely with international standards while helping New Zealanders better exercise their privacy rights.

The key change is the creation of a new Information Privacy Principle 3A (IPP3A). While the existing Information Privacy Principle 3 requires agencies to inform individuals when they directly collect personal information from them, the new provision extends this duty to situations where information is obtained indirectly from another source.

Under IPP3A, agencies that collect personal information about a person from someone else must, with some exceptions, take reasonable steps to ensure the person is informed. They must tell the individual what information was collected, why it was collected, who the intended recipients are, which agencies are responsible for collecting and holding the information, whether the collection is required or authorized by law (and if so, under which law), and the person’s right to access and correct their data.

The new principle will take effect on 1 May 2026, giving organizations time to update their systems and processes. Guidance for compliance will be published later this year, following earlier consultations with businesses and organizations. The Office of the Privacy Commissioner (OPC) is also reviewing the existing Codes of Practice under the Privacy Act to determine if changes are needed to reflect IPP3A.

Commissioner Webster said the reform reflects a global trend toward greater transparency in data handling.

“Telling people when you’re collecting information about them supports open and transparent collection practices and helps people better understand where and how their information is being used,” he said. “This reform helps keep our privacy law in line with other countries like Australia, the UK and Europe. There are other pressing privacy reforms that I will continue to advocate for with the government of the day.”

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.