Requirements for Indirect Collection of Personal Information under IPP3A
The Privacy Act 2020 regulates the collection, use and handling of personal information by agencies in New Zealand. An agency can be a person, business, or organisation that collects personal information about other people, provided they are not acting in a personal or domestic capacity. Any information about an identifiable individual is personal information.
From 1 May 2026, agencies that indirectly collect personal information are subject to a new privacy obligation under the Privacy Act 2020. Information Privacy Principle 3A (IPP3A) requires agencies to notify individuals when their personal information has been collected from a source other than the individual themselves.
For many organisations, this represents a significant shift. While businesses should already be familiar with the notification requirements that apply when collecting information directly from individuals, similar obligations now apply to indirect collection.
What is indirect collection?
IPP3A applies whenever an organisation obtains personal information from a third party rather than directly from the individual concerned. Common examples include obtaining credit information from a reporting agency, receiving information from a recruitment agency, verifying employment history with a former employer, or collecting customer information from a referral partner.
Where information is collected indirectly, the collecting agency must take reasonable steps to ensure the individual is aware that their information has been collected and understands how it will be used.
What must organisations tell individuals?
IPP3A largely mirrors the existing notification requirements in IPP3. Individuals should be informed:
- that their information has been collected;
- the purpose of the collection;
- who may receive the information;
- the name and address of the agency collecting and holding the information;
- any legal authority requiring or authorising the collection; and
- their rights to access and correct their personal information.
Notification can occur before collection or as soon as reasonably practicable afterwards, depending on the circumstances.
Are there any exceptions?
Yes. Notification may not be required where, for example, the individual is already aware of the collection, notification would undermine the purpose of the collection, or notifying the individual is not reasonably practicable. This is not an exhaustive list, and organisations should be cautious about relying on these exceptions and ensure any decision is carefully documented.
What should organisations do now?
Organisations should review how personal information enters their business and identify situations where information is obtained from third parties.
Practical steps include:
- mapping all indirect collection activities;
- reviewing privacy policies and collection statements;
- implementing processes to notify affected individuals;
- reviewing agreements with suppliers, referral partners and service providers; and
- documenting decisions where an exception to IPP3A is relied upon.
IPP3A reflects an increasing focus on transparency and individual control over personal information. Organisations that collect personal information from third parties should ensure they understand when notification is required and have processes in place to comply.
Written by Aislinn Molloy, Associate
