IPP 3A indirect personal information collection notification requirements may apply if you collect information indirectly, from third parties, other agencies, or external data sources.
NZ Privacy Act change, effective 1 May 2026
IPP 3A indirect personal information collection notification requirements may apply if you collect information indirectly, from third parties, other agencies, or external data sources.
To work out what is required, you need to understand:
• what personal information is being collected
• where it comes from
• whether the collection is direct or indirect
• who receives it
• whether an exception applies
• whether the individual has already been made aware
• how notification will actually happen in a timely and workable way
• whether you have an audit trail to show the notification was sent
We’re currently implementing IPP 3A compliance for clients in the financial services sector.
If you’re unsure whether you’re ready, happy to have a quick conversation about what’s involved.