Privacy & Cybersecurity Law Blog

Wotton Kearney reports that on September 23, 2025, the New Zealand Privacy Amendment Act 2025 (“the Amendment Act”), which introduces new privacy notification requirements that will become effective May 1, 2026, received royal assent.

The Amendment Act introduces a new Information Privacy Principle (“IPP”) 3A to the Privacy Act 2020. This new IPP is meant to “increase transparency and help New Zealanders to better exercise their privacy rights” and is “in line with other countries like Australia, the UK and Europe” (Office of the Privacy Commissioner | Privacy Amendment Act passes).

IPP3A comes into force as of May 1, 2026. Any information collected indirectly on or after this date will be subject to additional notification requirements. Where agencies collect personal information from a source other than the individual in question, they will need to take “reasonable steps” to ensure the individual receives various information typically found in agencies’ privacy policies. Prior to this, IPP3 only imposed notification requirements on the collection of personal information directly from the individual in question.

As with IPP3, there are exceptions to the new IPP3A notification requirements. These include where the information is publicly available, the individual has already been made aware of the information having been collected, notification would prejudice the maintenance of the law, notification would undermine the purpose of the collection, or notification would cause a serious threat to public health or safety, or to the health or safety of another individual.

All agencies, including insurers, will need to update or develop their privacy policies to deal with the new requirements of IPP3A and be clear on when any of the exceptions apply. The Office of the Privacy Commissioner is to issue final guidance on the implementation of IPP3A later this year. In the meantime, the OPC published its draft guidance in April 2025.