The Government has changed the Privacy Act 2020 (the Act) to improve transparency about the collection of personal information and to better enable people to exercise their privacy rights.
The Privacy Amendment Act 2025 introduces a new information privacy principle 3A (IPP 3A) relating to indirect collection of personal information. Under the new IPP 3A, an agency that collects personal information from a source other than the individual themselves must take reasonable steps to ensure that the individual is aware of specified matters. These new steps are closely based on existing requirements for direct collection of information (IPP 3). These changes come into force on 1 May 2026.
The Act also makes several technical amendments to address some minor issues that have arisen since the Act came into force. These changes came into force on 24 September 2025.
The Office of the Privacy Commissioner(external link) is developing guidance for businesses and agencies on complying with new IPP 3A. They are interested in hearing about specific areas where guidance would be most helpful – agencies can contact the OPC at: guidance@privacy.org.nz to be included in this engagement.
The collection of information from sources other than the individual concerned was highlighted as a gap in our privacy system by the European Union during its assessment of New Zealand’s EU “adequacy status”.
EU adequacy means New Zealand businesses can receive information from the European Union without implementing individual contractual agreements, and places New Zealand in a small cohort of jurisdictions recognised for protecting individual privacy. The Amendment Act is designed to support New Zealand to retain its adequacy status into the future.
The legislation was introduced to Parliament in September 2023, and the Justice Committee received 55 submissions. It received Royal Assent from the Governor-General on 23 September 2025.
Whilst the amendments related to IPP 3A (in Part 1) were originally due to come into force on 1 June 2025, Parliament extended the commencement date for Part 1 to 1 May 2026 to provide a sufficient time for agencies to prepare to comply with IPP 3A. The technical amendments to part 2 of the Act came into force the day after Royal Assent.
Read the Privacy Amendment Bill (external link)(New Zealand Legislation website)
Find out information on Privacy Amendment Act's progress(external link) through Parliament (Justice Committee website)
Cabinet paper: Privacy Amendment Bill 2023: Approval for introduction [PDF, 606 KB]
Regulatory Impact Statement: Broadening notification in the Privacy Act 2020 [PDF, 1.8 MB]
Departmental Report: Initial Briefing - Privacy Amendment Bill(external link)
Consistency with the New Zealand Bill of Rights Act 1990: Privacy Amendment Bill [PDF, 2.7 MB]
This page was last updated: