New Zealand Privacy Commissioner seeks feedback for Privacy Amendment Bill

New Zealand’s Privacy Commissioner is opening up to public consultation on the Privacy Amendment Bill (IPP3A) draft guidance.

While the Bill has not yet passed, parliament is indicating that IPP3A will come into force a year from now, on 1 May 2026.

New Zealand’s government is also carrying out a broader review of the country’s privacy laws, reportedly to identify legal barriers to using facial recognition in retail settings, and is on the cusp of enacting a code to specifically regulate biometrics.

The Privacy Amendment Bill updates New Zealand’s privacy framework and adds responsibilities to agencies collecting personal information from third-party sources, as opposed to the individual themselves. As such, the IPP3A introduces a legal obligation for agencies to notify individuals when their personal information is being collected indirectly. Previously, agencies were only required to notify individuals when collecting their personal information directly.

Organizations obtaining data from a third party, such as a partner agency, data broker or another platform, may have to inform the individual whose data they’re getting unless an exemption applies. Several new exemptions, such as if the disclosure would threaten the health or safety of someone else, are added in the draft.

Notifications must be delivered “as soon as reasonably practical,” but the draft notes room for considerable latitude in interpreting what that means, based on the type of organization and data in question.

The country’s Privacy Commissioner is in the process of developing guidance and has invited agencies to have their say. The commissioner’s office (OPC) said that due to “significant” interest in the draft guidance, it decided to publish it on its website for the duration of the consultation period. The OPC is inviting considerations on whether the guidance is fit for purpose, if the guidance needs more clarity or is hard to understand, and if examples are meaningful, among others.

The OPC will collect feedback from April 30 to June 25 via email. Thoughts can be sent to the OPC with the email listed here. The draft guidance on IPP3A can be found here. The OPC is also doing a webinar about IPP3A as part of Privacy Week 2025, for which interested parties can sign up here.

Article Topics

data collection  |  data privacy  |  New Zealand  |  New Zealand Privacy Commissioner