Most of us have probably done it at some point. Used our work email address for something that has absolutely nothing to do with work. A recent case from the Office of the Privacy Commissioner is a useful reminder that where personal information is stored can matter just as much as what the information is about.

Tracking pixels have become a standard part of digital marketing, but many organisations don't understand what information they're collecting or where it's going. Here's what the OAIC's latest guidance means for businesses and why privacy should be treated as a business decision, not just a technical one.

You probably tell your friends a lot about yourself. Your opinions, your plans, the version of your life that feels safe to share. There’s a kind of control in that, an understanding that what people know about you is, at least partly, your decision.

Your phone however doesn’t work like that. It watches, quietly, constantly, without needing permission in the way we usually think about it. Your phone is watching not just what you say, but what you do.

The term data broker often conjures images of shadowy data trading, but the reality is usually much less dramatic. A data broker is simply an organisation that gathers personal information from multiple sources, combines those datasets, and provides the resulting insights to others. From 1 May 2026, changes to the Privacy Act introduce Information Privacy Principle 3A (IPP3A). The amendment strengthens transparency obligations when organisations collect personal information from a source other than the individual concerned.

When organisations think about collecting personal information, they often picture the direct kind of collection, when someone fills out a form, subscribes to a service, or makes an online purchase. But there’s another, often less visible way that personal information comes into your organisation’s possession, known as indirect collection.

In an age where digital convenience often takes precedence over caution, many organisations across New Zealand routinely collect and store photographic identification as part of customer onboarding processes. The most commonly collected documents are driver licences and passports. It can seem efficient, even responsible, to hold on to a copy “for the record.” Yet what feels like a simple administrative safeguard can in fact create a long-term privacy risk that is difficult to unwind.

In an age where cameras are everywhere, from shop ceilings to street corners, the question isn’t whether we can watch, but whether we should and to what extent.

Last week Parliament passed the Privacy Amendment Bill through its third reading, confirming the introduction of a new Information Privacy Principle IPP 3A focused on indirect collection. This isn’t a change that can be left until the week before commencement. The work must start now.

When a customer signs up for a service, the focus is often on speed and convenience. Seamless onboarding is seen as the gold standard. Yet, in that very moment, one of the most important privacy decisions is made: do you actually know who this person is?

It is common for organisations to utilise many tracking technologies on their websites to monitor performance, identify user experience issues and market to individuals.

The legislative requirements for providing notice and seeking consent for tracking technologies vary.

Most organisations typically have some insight into what information they collect indirectly from large organisations but not a full picture.