Cybersecurity Policy Report, New Zealand Privacy Amendments Become Law, (Sep 24, 2025)
New Zealand’s Privacy Amendment Bill, which amends the New Zealand Privacy Act 2020 in several respects, has become law after receiving royal assent.
The bill, which was originally introduced in September 2023, was reported out of the House in late March. Principal among other amendments contained in the final version of the bill is the introduction of Information Privacy Principle (IPP) 3A, which governs required notifications for indirect collections of personal data (CPR, Sept. 22).
IPP 3A requires that any agency collecting personal information from sources other than the individual data subject “take any steps that are, in the circumstances, reasonable to ensure that the individual concerned is aware of the fact that the information has been collected, the purpose for which the information has been collected, and the intended recipients of the information,” according to its text.
In addition, the individual is entitled to know the “name and address of the agency that collected the information, the agency that is holding the information, if the collection of the information is authorized or required by or under the law, the particular law by or under which the collection of the information is authorized or required, and the rights of access to, and correction of, information provided by the IPPs.”
Certain provisions of the amendments, including new IPP 3A, do not apply until May 1, 2026.
News: InternationalLegislation DataPrivacy