The Privacy Amendment Act 2025 brought into force information privacy principle (IPP) 3A from 1 May 2026, adding to the Privacy Act’s set of 13 IPPs. IPP3A is a new notification obligation, covering the collection of personal information other than from the individual concerned (that is, indirect collection). It sits alongside the existing notification obligation IPP3, covering collection of information from the individual concerned. To avoid any confusion, the set of IPPs is still numbered 1-13 with new IPP 3A being inserted to follow IPP3. We will be gradually updating our website content as resources allow to reflect this change. We have guidance on the new IPP3A. A number of codes of practice have also been amended following consultation to include new rule 3A.
Principle 1 - Purpose for collection-
Principle 1 states that organisations must only collect personal information if it is for a lawful purpose connected with their functions or activities,and the information is necessary for that purpose. This principle is about data minimisation.
Principle 2 - Source of personal information-
Principle 2 states that personal information should be collected directly from the person it is about. The best source of information about a person is usually the person themselves. Collecting information from the person concerned means they know what is going on and have some control over their information.
Principle 3 - Manner of collection
Principle 3 states that personal information must be collected in a way that is lawful and seen as fair and reasonable in the circumstances.
Principle 4 - Storage and security of information
Principle 4 states that organizations must ensure there are safeguards in place that are reasonable in the circumstances to prevent loss, misuse or disclosure of personal information.
Principle 5 - Access to personal information
Principle 5 states that people have a right to ask for access to their own personal information.
Principle 6 - Correction of personal information
Principle 6 states that a person has a right to ask an organization or business to correct information about them if they think it is wrong.
Principle 7 - Accuracy of personal information
Principle 7 states that an organization must check before using or disclosing personal information that it is accurate, up to date, complete, relevant and not misleading.
Principle 8 - Retention of personal information
Principle 8 states that an organization should not keep personal information for longer than it is required for the purpose it may lawfully be used.
Data Collection: Enforces data minimization; IT systems should only capture required user identifiers.
Data Storage: Mandates robust encryption, access controls, and secure local or cloud environments.
Data Sharing: Requires explicit legal authority or clear individual consent before transferring data between systems or third parties.
Data as Taonga: Recognizes that Māori data is a treasured cultural asset (taonga) requiring high-level stewardship rather than mere ownership.
Core Principles Integration: Aligns with Rangatiratanga (authority/control), Kotahitanga (guardianship), and Kotahitanga (collective benefit) in data ecosystems.
Protection Importance: Prevents culturally insensitive analysis, misuse, or overseas cloud vulnerabilities (such as foreign subpoena laws) that compromise indigenous self-determination.
Vision and Objectives
Vision: "New Zealand is confident and secure in the digital world".
Goals: Achieve broad cyber resilience, build local capability, counter cybercrime, and foster international cooperation.
Aware and Active Citizens: Elevating national cyber literacy so everyday users recognize and mitigate digital risks.
Resilient and Responsive NZ: Hardening government networks, critical infrastructure, and business supply chains against intrusions.
Workforce and Ecosystem: Investing in trained cybersecurity professionals and research initiatives.
Tackling Cybercrime: Enhancing legal mechanisms and law enforcement coordination.
Internationally Active: Working with global allies to deter malicious actors.
Risk Management: Encourages structured evaluations to address gaps between current and desired security postures.
Collaboration: Promotes information sharing regarding active threats between industry sectors and government bodies.
Preparedness: Urges entities to implement baseline technical controls, incident response playbooks, and continuous staff training.
If you'd like, I can provide:
Specific details onInformation Privacy Principles (IPPs) 8 through 13
A deeper breakdown of Māori data governance frameworks
Actionable steps for business cyber compliance in New Zealand
Refrences - https://www.privacy.org.nz/privacy-principles/