Understanding the new privacy landscape: what you need to know before 1 May 2026
New Zealand’s privacy environment is about to undergo its most significant update since the Privacy Act 2020 came into force.
With the passing of the Privacy Amendment Act 2025, a new requirement, Information Privacy Principle 3A (IPP3A), comes into effect on 1 May 2026. This change will reshape how organisations collect and use personal information, including across communications, marketing, PR, and engagement activities.
IPP3A states that if an organisation collects personal information about an individual from any source other than the individual themselves, it must take reasonable steps to notify the individual. This brings New Zealand in line with global standards in Australia, the UK and Europe, and reflects a broader trend toward transparency in how organisations handle personal data.
Why this change matters for communications and marketing
Marketing and communications teams frequently rely on data that wasn’t collected directly:
Email lists sourced through partners, sponsors or event co-hosts
Contact information from industry bodies or public sources
Sign-up data collected via third-party platforms
Community engagement data shared between councils, boards, and NGOs
Under IPP3A, individuals must be told:
That you have collected information about them
Why you collected it
Who will receive or hold the data
Whether the collection is authorised by law
Their rights to access and correct their information
Generic privacy statements will no longer be sufficient. Legal commentary makes it clear that organisations will need specific, scenario-based notices that fit different collection pathways.
What this means in practice
If you import data into Mailchimp, HubSpot, or Campaign Monitor from any source other than direct opt‑in, you must notify people promptly. That could mean an automated “data received from X” email or an updated onboarding workflow.
Partnerships need clear privacy roles
Joint events, campaigns, and sponsorships are common across the sectors we work in, including community, government, energy, agribusiness, education and more. From 1 May 2026, your agreements must specify who notifies individuals if personal data is shared.
Community engagement requires greater transparency
Engagement activities often involve multiple data custodians (councils, boards, community groups, researchers). IPP3A means organisations must ensure stakeholders are informed when their details are shared between parties. This supports the reform’s goal of strengthening trust and transparency.
Influencer, media and stakeholder lists may require notification
We know this will impact some of our clients. While some exceptions apply to publicly available information, reliance on exceptions must be cautious and justified. Media lists purchased from third-party databases will likely trigger notification requirements.
What your organisations should do now
Legal experts and the Office of the Privacy Commissioner recommend early preparation, including mapping data flows, reviewing privacy policies, and updating agreements. Final guidance from the OPC will be issued later this year.
The introduction of IPP3A represents a positive shift toward transparency, accountability, and respect for individuals’ data. For communications and marketing professionals, it’s also an opportunity: organisations that act early will demonstrate leadership and build deeper trust with their communities, customers, and stakeholders.
Our team is here to help organisations prepare for these changes, ensuring your communications, engagement, and marketing activities remain compliant, clear, and confidence‑building. If you’d like support reviewing your workflows, updating your privacy notices, or preparing your team, give us a call on 0210 296 2820 or email info@bellepr.co.nz.
