New Information Privacy Principle 3A takes effect today in New Zealand, introduced by the Privacy Amendment Act 2025.
Key points
- Individuals must be notified when their personal information is collected indirectly.
- Notification must include specified information.
- Exceptions apply in certain circumstances.
- The rule applies to overseas agencies carrying on business in New Zealand.
UK organisations collecting New Zealanders’ personal information from third parties need to update notices and processes. This closes a gap with the GDPR and UK GDPR, which already require individuals to be told when their data is obtained from another source. Organisations using data brokers, referrals or shared customer lists should review their approach before relying on existing notices.
Source: Privacy Amendment Act 2025 (legislation.govt.nz)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
