IPP3A Explained: Your Duty When Personal Information Comes From Someone Else

A New Privacy Principle Took Effect on 1 May 2026

Most businesses collect personal information about people they have never spoken to. A referral partner passes on a client's details, a recruiter forwards a CV, a franchisor shares a customer list, a parent fills in a form on behalf of a child, or an insurer asks a repairer about damage to a customer's vehicle. Until this year, the Privacy Act 2020 set out what you had to tell people when you collected information directly from them, but said little about information that arrived from somewhere else. That gap has now closed.

The Privacy Amendment Act 2025 received Royal Assent on 23 September 2025 and inserted a new information privacy principle, IPP3A, into the Privacy Act. According to the Ministry of Justice, the change was made to improve transparency about the collection of personal information, and IPP3A came into force on 1 May 2026. The Ministry also notes that the amendment is designed to help retain the country's adequacy status with the European Union, after the EU identified indirect collection as a gap.

The transitional provision in the amending Act is clear that IPP3A does not apply to personal information collected before 1 May 2026. Anything you have gathered from a third party since that date, however, is in scope.

What IPP3A Requires

IPP3A applies when an agency collects personal information about an individual from someone other than that individual. In that situation the agency must take steps that are reasonable in the circumstances to make the individual aware of:

• the fact that the information has been collected
• the purpose for which it was collected
• the intended recipients of the information
• the name and address of the agency that collected it and the agency that holds it
• if the collection is authorised or required by law, the particular law involved
• the individual's rights to access and correct the information

Those steps must be taken as soon as reasonably practicable after the information is collected, unless they were taken earlier. The list closely mirrors IPP3, which already applied to direct collection, so many businesses will be able to adapt the privacy statement they already use rather than starting from scratch.

The Office of the Privacy Commissioner's IPP3A guidance adds some useful detail on what a good notice looks like. It says the purpose must be specific, and that "it is not enough to say, 'for business purposes.'" Recipients should be named where you share routinely, or described by type, sector and location where naming them is impractical. Contact details can be an email address or website rather than a street address, and the access and correction explanation should point to a clear process such as a contact address or online form. The guidance also reminds agencies that they still need a proper basis under IPP2 to collect information indirectly in the first place; IPP3A deals with telling people, not with whether the collection is allowed.

Timing: When You Have to Tell People

The legal test is "as soon as reasonably practicable" after collection. The Commissioner's guidance says agencies must be able to justify any delay and recommends documenting the reasoning. One of its examples involves a business that received a partner's marketing list and held its notice until the campaign began, which the guidance treats as reasonable in that context.

In practice, the cleanest approach is usually to deal with notice at the point of first contact. If you receive a referral and your first step is to email or call the person, that first message is the natural place to explain where you got their details, why you have them, and how they can see or correct what you hold.

The Exceptions, and Why They Are Narrower Than They Look

IPP3A carries its own set of exceptions, several of which will sound familiar from IPP3. You do not need to take the notification steps where, among other things:

• the individual has already been made aware of all of the required matters, for example by the agency that disclosed the information to you
• the information is publicly available
• you reasonably believe that not complying would not prejudice the individual's interests
• complying would prejudice the purpose of the collection
• complying is not reasonably practicable in the circumstances
• the information will not be used in a form that identifies the individual, or will be used only for statistical or research purposes

There are further exceptions for law enforcement, court proceedings, public revenue, health and safety threats, archiving, national security and international relations, and for situations where complying would reveal a trade secret or unreasonably prejudice someone's commercial position.

The Commissioner's guidance takes a careful line on several of these. Assuming that a person probably already knows is not enough to rely on the "already aware" exception. Publicly available information means sources such as public registers or public websites, and the guidance says it does not include private social media. The "not reasonably practicable" exception is not met by inconvenience or cost alone, and the guidance states plainly that "having incompatible systems or processes is not a valid reason." Where a business wants to rely on the exception for prejudicing the purpose, for instance during a fraud investigation, the guidance advises taking great care and seeking professional advice.

Common Situations Where IPP3A Applies

The Commissioner's guidance works through several examples that map closely onto everyday business activity. A garden business that refers clients to an arborist and passes on their details satisfies the rule by naming the arborist on its client form and linking to the arborist's privacy policy. An insurer that asks a repairer about a customer's car damage is collecting indirectly, and the repairer separately needs a lawful basis under IPP11 to disclose. A school that collects medical details from parents should cover the IPP3A matters in its form so that parents can pass them on. Where a business buys another business and inherits a loyalty programme, the guidance suggests notification may not be needed if prejudice to members is unlikely.

Other common sources of indirectly collected information include referral partners, lead lists, employment references, background checks, debt collection, and personal information about third parties that customers volunteer in the course of a transaction. Each of these is worth testing against the principle.

Cloud and IT Providers Do Not Carry the Obligation for You

Many businesses rely on payroll platforms, customer relationship management systems, managed IT providers and cloud storage. Section 11 of the Privacy Act 2020 provides that where one agency holds personal information only on behalf of another, the information is treated as held by the agency it is held for, not by the provider, unless the provider uses or discloses it for its own purposes. The IPP3A guidance applies the same logic: where a third-party provider only holds data for a client and does not use it for its own ends, the client is responsible for IPP3A.

The practical consequence is that outsourcing a system does not outsource the obligation. If your CRM vendor enriches contact records from a third-party data source on your instructions, or your recruitment platform pulls in candidate information from elsewhere, the notification duty generally sits with your business. The guidance recommends building notice requirements into contracts with partners and suppliers so the steps actually happen.

Why IPP3A Matters for Cyber Risk

At first glance a notification rule looks like a paperwork exercise rather than a security issue. The connection is the data map. The first practical step the Commissioner recommends is to map which personal information you collect directly and which you collect indirectly. That is exactly the inventory a business needs when something goes wrong.

When personal information is accessed or disclosed without authorisation, the agency needs to work out whether it is a notifiable privacy breach. The Commissioner's knowledge base describes a notifiable breach as one where it is reasonable to believe an affected individual has suffered, or is likely to suffer, serious harm, and says the agency must notify the Commissioner as soon as practicable. The Office has said it expects that to happen within 72 hours of becoming aware that a breach is notifiable. The Commissioner's guidance on consequences notes that failing to report a notifiable privacy breach is an offence under section 118 of the Privacy Act 2020, and its privacy breach guidance says affected people must also be told as soon as you are practically able.

A business that has never mapped where its personal information came from tends to struggle with that assessment. It may not know which records were in the compromised system, whose details they were, or whether it even holds contact details for the people affected. Information that came from third parties is the most likely to be poorly documented. The same exercise that satisfies IPP3A shortens the most stressful part of a breach response.

There is also a simpler point about volume. Every record you collect is a record that can be exposed. Unauthorised access was behind a reported direct loss of $1.3 million in the National Cyber Security Centre's Quarter Two 2026 Cyber Security Insights, roughly half of all reported direct financial loss for the quarter. Reviewing indirect collection is a natural moment to ask whether you need the information at all, and to stop collecting what you do not use.

Complaints and Consequences

A breach of an information privacy principle is not automatically actionable. The Commissioner explains that an interference with privacy occurs when an agency breaches a privacy principle and that breach causes harm, and that a breach without harm is not usually an interference with privacy. Where harm does follow, the Commissioner's guidance on consequences explains that an affected person can complain to the Office, and that matters which cannot be resolved can reach the Human Rights Review Tribunal, which decides whether to award compensation. Beyond the legal process, a customer who discovers that a business has been holding their details without ever telling them is unlikely to be impressed, and that reputational cost can arrive well before any formal complaint.

A Practical Checklist

Drawing on the Commissioner's recommended steps, a sensible IPP3A review for a small or medium business looks like this:

• List every route by which personal information reaches you from someone other than the person concerned, including referrals, partners, platforms and data providers.
• For each route, decide whether the person has already been told the required matters by the source, and keep evidence of that notice if you rely on it.
• Update your privacy statement so it covers indirect collection specifically, and make it easy to find from your first contact with the person.
• Add notification wording to referral forms, partner agreements and supplier contracts.
• Document any decision to delay notice or rely on an exception, with the reason.
• Use the same inventory to confirm where the information is stored, who can access it, and how you would contact the people concerned after a breach.

The Commissioner publishes full IPP3A guidance and a decision flowchart on the IPP3A topic page, and these are the best starting point for any business working through the change.

Where Cyber Insurance Fits

IPP3A is a compliance obligation, and no insurance policy replaces the work of meeting it. Where cyber insurance becomes relevant is when personal information is compromised: many cyber policies include sections for breach response costs, legal advice on notification obligations, and the costs of responding to a privacy regulator's investigation. How far those sections extend, and what conditions attach to them, varies between policy wordings, so it is worth checking the detail rather than assuming. For background, see our guides to the Privacy Act 2020 and your business and how mandatory breach notification works.

If you would like to talk through cyber cover for your business, complete the enquiry form and your details will be passed to a referred adviser who can discuss your situation.