COMPLIANCE | PRIVACY
New NZ Privacy Act Rule You Need to Know About: What IPP 3A Means for Your Business
If you collect customer information from other sources - like a partner, a database, or even Google - there's a change in the Privacy Act you need to be across. It's called IPP 3A, and it kicked in on 1 May 2026.
NOT SURE IF IPP 3A APPLIES TO YOU?
Talk it through with a Lucidity advisor and get privacy advice tailored to your setup.
One conversation, no obligation.
What’s the change?
Previously, if you got someone’s details from someone else (rather than straight from them), you didn’t have to tell them. Now you do.
IPP 3A says that when you collect personal information indirectly – meaning from a third party rather than directly from the person – you need to notify them about it. Unless an exception applies, you must tell them:
- That you've collected their information
- Why you collected it
- Who you're planning to share it with
- Your business name and address
- How they can access or correct their information
Not sure where your customer data comes from? Book a consultation with Lucidity →
Privacy Act · IPP 3A
Find out where your customer data actually comes from
A Lucidity advisor walks through your systems with you and shows you where IPP 3A applies, in plain English.
- Every place personal information enters your business
- Where an exception genuinely applies, and where it does not
- Which of the five notification points you already cover
- A privacy policy that covers indirect collection
Tailored to your setup, not a template.
How do I know if this applies to my business?
Ask yourself:
Are we getting personal information about someone from a source that isn't them?
If the answer is yes, IPP 3A probably applies to you.
Examples of when IPP 3A applies
-
1
You buy a marketing list
You purchase a database of potential leads from another company. IPP 3A means you need to tell those people you've got their details, where you got them from, and what you're planning to do with them.
-
2
A customer refers a friend
Your existing customer gives you their mate's contact details for a quote. Before you add that person to your system and contact them, you need to let them know where you got their details and why.
-
3
You use a third-party provider
You're using software (like a CRM or invoicing tool) that holds customer data on your behalf. If that software pulls in information from other sources, you still need to notify the individuals.
-
4
Insurance claims
Someone makes a claim, and you contact their mechanic or another third party for details. You need to tell the claimant that you collected information about them from somewhere else.
-
5
Recruitment through agencies
You ask a recruitment agency for candidate details. The candidates need to know you've got their info from the agency, not directly from them.
Recognise your business in one of these? Book a consultation with Lucidity →
When don’t I have to tell them?
There are exceptions. You might not need to notify if:
- The person already knows (for example, they were told by the first company you got their details from)
- The information is already publicly available (like on a public register)
- You can reasonably show they wouldn't be disadvantaged by not knowing
- It's not actually possible to contact them
- It's required by law (like for a police investigation)
But here's the thing
These exceptions have limits. Don't assume you can skip notification just because it's easier.
What do I need to do?
-
1
Audit where your data comes from. Map out everywhere you collect personal information from sources other than the individual.
-
2
Update your privacy policy. Make sure it covers indirect collection, not just direct collection.
-
3
Think about how you'll notify people. Email, letter, website notice - it needs to be clear and accessible.
-
4
Keep records. If you rely on an exception, document why.
Take a look at our updated Privacy Policy here – feel free to copy or use as inspiration.
Want a second pair of eyes on your audit? Book a consultation with Lucidity →
The bottom line
If you’re collecting anyone’s personal information from another source, you now need to tell them. It’s about being upfront and building trust. The penalties for getting this wrong can be significant, but more importantly, it’s just good business practice.
Not sure if you’re covered? It’s worth a chat with your IT support or getting some privacy advice tailored to your setup.
For more information see the Privacy Commissioner website: privacy.org.nz/privacy-principles/3a/
Top 10 questions asked about IPP 3A
Quick answers to the questions New Zealand businesses ask most about the new rule. Each one is covered in more detail above.
1. What is IPP 3A?
IPP 3A is a new Information Privacy Principle in the New Zealand Privacy Act. It requires you to notify people when you collect their personal information indirectly, from a source other than the person themselves.
2. When did IPP 3A come into force?
IPP 3A kicked in on 1 May 2026. If you're collecting anyone's personal information from another source, the notification requirement already applies to your business.
3. What does collecting personal information "indirectly" mean?
It means getting someone's details from a third party rather than straight from them - for example from a partner, a purchased database, a customer referral, a recruitment agency, or even Google.
4. How do I know if IPP 3A applies to my business?
Ask yourself: are we getting personal information about someone from a source that isn't them? If the answer is yes, IPP 3A probably applies to you.
5. What do I have to tell people when I collect their information indirectly?
Unless an exception applies, you must tell them that you've collected their information, why you collected it, who you're planning to share it with, your business name and address, and how they can access or correct their information.
6. Does IPP 3A apply if I buy a marketing list?
Yes. If you purchase a database of leads from another company, you need to tell those people you've got their details, where you got them from, and what you're planning to do with them.
7. Does IPP 3A apply when a customer refers a friend?
Yes. Before you add the referred person to your system and contact them, you need to let them know where you got their details and why.
8. What if my CRM or invoicing software holds the data?
You're still responsible. If the software you use pulls in customer information from other sources, you need to notify the individuals, even though the tool holds the data on your behalf.
9. When don't I have to notify people?
You might not need to notify if the person already knows, the information is already publicly available, you can reasonably show they wouldn't be disadvantaged by not knowing, it's not actually possible to contact them, or it's required by law. These exceptions have limits, so document why you're relying on one.
10. What do I need to do about IPP 3A now?
Audit where your data comes from, update your privacy policy so it covers indirect collection, decide how you'll notify people, and keep records of any exception you rely on. Not sure where to start? Book a consultation with Lucidity.
Ready to get IPP 3A sorted?
Book a consultation with Lucidity and get privacy advice tailored to your setup, from a team that already looks after your IT.
