New Zealand Strengthens Privacy Protections with Privacy Amendment Act

On 24 September 2025, New Zealand passed the Privacy Amendment Act, introducing a new Information Privacy Principle to enhance transparency and accountability in how organizations collect personal data.

What’s New

Until now, under IPP3, organizations only had to notify people when collecting their information directly.

With IPP3A, businesses and agencies must now also notify individuals when their personal data is collected indirectly(from third parties), unless a clear exception applies.

photo: https://pl.freepik.com/

Organizations must take reasonable steps to tell individuals:

☑️ That their information has been collected.

☑️ The purpose of collection.

☑️ The intended recipients of the information.

☑️ The name and address of the collecting agency and the one holding the information.

☑️ Whether the collection is authorized by law, and if so, under which law.

☑️ Their rights to access and correct their information.

The new requirements will come into force on 1 May 2026.

Another country has implemented more rigorous privacy laws. Businesses that want to operate in New Zealand will need to adjust their privacy practices, processes, and compliance frameworks to ensure they’re fully compliant.

For me, the most important part of this reform is the focus on transparency in indirect data collection. Too often, personal data is shared or bought through third parties without individuals even knowing. This law closes that gap. This amendment brings New Zealand closer to global standards seen in CCPA, the UKGDPR, and the hGDPR. It reinforces open and transparent data practices, empowering individuals to understand where and how their information is used.

Link to the changes

Author: Sebastian Burgemejster