Not to be outdone by its regional peers, New Zealand updated its privacy laws with the passing of the Privacy Amendment Act 2025 (the Act) last month: see the NZ Privacy Commissioner’s media release here.

Most notably, the Act introduces a new Information Privacy Principle 3A (IPP3A) which takes effect from 1 May 2026.

IPP3A introduces a new requirement for organisations to take reasonable steps to notify individuals when collecting their personal information indirectly, ie from third party sources such as other organisations or individuals. Previously, organisations were only required to notify individuals when collecting personal information directly from them.

This obligation is subject to several exceptions, and does not apply where a third party is acting solely as a service provider on behalf of the collecting organisation. However, in most other cases, organisations will need to take active steps to inform individuals, and based on draft guidance released by the Office of the NZ Privacy Commissioner, reliance on generic wording in an organisation’s online privacy statement will not be sufficient to meet the new standard.

This change reportedly brings New Zealand’s privacy regime closer in line with international standards, including Australian Privacy Principle 5, and Article 14 of the EU General Data Protection Regulation.

Click here to view the draft guidance on IPP3A, as released by the Office of the Privacy Commissioner (OPC) in April 2025. The OPC will be publishing its final position later this year.

For companies with NZ operations, the passing of the Act is a timely reminder to consider and potentially align collection notices and practices and ensure ongoing compliance.