As of 1 May 2026, some new privacy rules took effect in New Zealand.
The Privacy Amendment Act 2025 brings a number of updates to NZ’s existing privacy laws, including some new requirements around how you handle personal information received via third parties.
This may affect your business if you use other agencies or online tools to collect personal information about your customers or clients.
Up until now, the rules mainly focused on personal information you collect directly – for example, you need to tell your customers what information you’re collecting, why you are collecting it and how it will be used. This is usually covered in your Privacy Policy or Privacy Statement.
The new Privacy Principle 3A (IPP3A) extends these obligations to information you get through other channels – for example a third party who collects information about your customers and passes it on to you in the usual course of business.
The Office of the Privacy Commissioner has produced some useful guidance documentation about exactly what you need to do, including practical examples:
https://www.privacy.org.nz/resources-and-learning/a-z-topics/ipp3a/
The new IPP3A requirement may not require any drastic changes to your business processes, but it could be time to review and update your Privacy Statement.
As with any legal compliance matter, you should get legal advice to ensure your business or organisation is fulfilling all its obligations.
