The Advocate | Issue 371 | March 2026

The new Information Privacy Principle 3A (“IPP3A”) under the Privacy Act 2020 is intended to address the situation where an agency collects personal information indirectly, (i.e. from someone other than the person themselves). These new notification obligations come into force from 1 May 2026. 

Previously, an agency would not be required to notify an individual of indirect collection of personal information. However, the new IPP3A will require agencies to take reasonable steps to notify an individual of the following (unless an exception applies): 

• The fact that the information has been collected; 
• The purpose of the collection; 
• The intended recipients of the information (i.e. who the information will be shared with); 
• The name and address of the agency that is collecting the information and the agency that holds the information; 
• If the collection is authorised or required by law, which particular law; and 
• The individual’s rights of access to, and correction of, the information. 

An agency can meet its notification obligations under IPP3A by notifying individuals in advance or at the time of collection by way of privacy policies, privacy statements, and notices. Alternatively, an agency would be required to notify the individual as soon as reasonably practicable after the information has been collected. 

Where an agency (the main agency) uses a third party-provider to hold or process information on their behalf, the information is being treated as being held by the main agency. Therefore, the main agency will be responsible for meeting any IPP3A requirements. 

The exceptions are: 

• The individual has already been made aware of the collection. For example, this could be met where the disclosing agency has already informed the individual of and met the requirements around notification; 
• The personal information is already publicly available. For example, this could include where the information is published on a website, or other publication. However, this exception would not apply where the information is collected from social media that requires additional permission to view (for example, being a Facebook friend of the individual); 
• It would not prejudice the interests of the individual concerned; 
• It is necessary for maintenance of the law by a public sector agency, enforcement of the law that imposes a financial penalty, protection of public revenue, or conduct or court/tribunal proceedings. This exception will not apply to private sector agencies; 
• Telling the individual would prejudice the purposes of the collection. For example, this exception could apply where an agency is conducting an investigation into an employee taking company property without authorisation, and notifying the person would undermine or prejudice the investigation; 
• Telling the individual is not reasonably practicable in the circumstances. For example, this exception could apply where you do not have contact details for the individual concerned; 
• It would cause serious threat to public health or safety, or to the health and safety of another individual; 
• The information won’t be used in a way that identifies the individual; 
• The information will be used for research and statistics, and publishing the information will not identify the individual; 
• The agency collects information for archiving purposes and notification is likely to seriously impair achieving this. For example, your agency is a museum, and it would likely be a significant operational burden having to notify every individual that you hold information about them; and 
• It would prejudice the security or defence of New Zealand. 

For advice on reviewing your Privacy Policies and/or Privacy Statements to get ahead of the change, contact one of our team. Alternatively, if you have a specific issue you would like to discuss around the new IPP3A, please get in touch to discuss this further with us. 

From 1 April 2026, the default rate of employer and employee contributions to KiwiSaver is increasing to 3.5%.

 

The increase will be applied to all pay days from 1 April 2026, so if the employee’s pay period covers before and after 1 April 2026, the increase will be applied to the total contribution for that pay period.

 

If contributions are already at or above 3.5% then they will not change. 

A temporary rate reduction is available for employees who want to continue contributing at 3% for between 3 and 12 months. An employer can choose to match the temporary rate reduction, i.e. the employer contribution would not increase to 3.5% if there is a temporary rate reduction in place. 

16- and 17-year-olds will become eligible for employer KiwiSaver contributions of 3.5% of their pay from 1 April 2026.