Today marks the start of a key change to New Zealand’s privacy law that employers should not overlook.
From 1 May 2026, Information Privacy Principle 3A (IPP3A) under the Privacy Amendment Act 2025 is now in force. This new requirement applies when personal information is collected indirectly, that is, from a source other than the individual concerned.
What has changed?
Under IPP3A, employers must take reasonable steps to notify individuals when their personal information is collected indirectly. In most cases, individuals must be told:
That their personal information has been collected
Why it was collected
Who holds the information
The change is designed to improve transparency and help individuals better understand how their personal information is being used.
Why this matters for employers
Many common recruitment and employment practices involve indirect collection of personal information, including:
Referee reports
Recruitment agencies
Background or pre‑employment checks
Information obtained from third‑party providers
While there are some exceptions, IPP3A will apply in many everyday employment scenarios.
What employers should do now
If you collect personal information about employees or candidates from anyone other than the individual themselves, now is the time to:
Review and update privacy statements
Check recruitment and onboarding processes
Ensure HR practices reflect the new notification obligation
Taking steps now will help minimise privacy risk and ensure compliance with the current law.
If you’re unsure whether your current practices are compliant, now is a good time to check. Contact our team for tailored advice for your organisation.
