NZ Privacy Amendment Act broadens privacy notification obligation to meet global practice

New Zealand's Privacy Amendment Act 2025 has been signed into law and is now officially enacted after receiving Royal Assent 23 Sept.

The Privacy Amendment Act makes several changes to New Zealand's Privacy Act 2020, some more consequential than others. The key change is the introduction of new Information Privacy Principle 3A that requires organizations to inform individuals when their personal information is collected indirectly, meaning from a source other than the individual themselves. 

Extension of withholding grounds

As well as some more technical amendments, and the more significant introduction of IPP3A, the Privacy Amendment Act extends two of the available grounds for refusing an individual's request for their personal information.  

Section 49(1)(c) of the Privacy Act permits an organization to withhold personal information if the requester is under age 16 and providing the information would be contrary to their interests. The Privacy Amendment Act extends this to allow refusal if releasing the information would be contrary to the interests of another person who is under age 16.

Section 49(1)(d) of the Privacy Act allows an organization to withhold personal information if its release would prejudice the safe custody or rehabilitation of a requester who has been convicted of an offense and is, or was, in custody. The Privacy Amendment Act extends this to allow refusal if release would similarly impact another person who is convicted of an offense and is, or was, in custody.