IPP 3A Clears Third Reading: The Time to Act is Now

Last week Parliament passed the Privacy Amendment Bill through its third reading, confirming the introduction of a new Information Privacy Principle IPP 3A focused on indirect collection.

Until now, organisations only had to notify people when collecting personal information directly. From 1 May 2026, that obligation extends to situations where information is gathered from someone else, not from the individual themselves.

The intent is straightforward, but the reality is complex. This isn’t a change that can be left until the week before commencement. The work must start now.

Organisations should be identifying where indirect collection occurs, updating privacy notices and policies, and reviewing contracts. Technical processes may need to be adjusted so that notifications can be sent “as soon as reasonably practicable.” Staff will need training, and teams should be clear on when exceptions apply and how those decisions are documented.

Our recent Lunch and Learn series explored these upcoming changes and the steps organisations may need to take. Recordings are available at (https://www.threeblackcats.co.nz/lunchandlearn). Updated guidance from the Privacy Commissioner is also expected shortly, with the draft version already available here: 202505430-DRAFT-IPP3A-guidance-for-website-and-external-consultation-A1073422.pdf.

If you’d like help getting started, whether mapping your indirect collections, determining if exceptions apply, updating notices, or training your teams we’d be happy to talk. Now is the time to prepare.