Most of the contacts in your CRM never handed you their details, which is exactly why the Privacy Act changes 2026 NZ businesses face are worth ten minutes of your attention.
They came from a list someone bought. A spreadsheet a partner forwarded. A scraper. An enrichment tool that appended mobile numbers. An event attendee sheet. Someone on the team typing in a stack of business cards. Nobody has ever asked you to account for it, so nobody has.
From 2026, the law asks. A new information privacy principle, IPP 3A, covers personal information you collect about a person from a source other than that person, and it comes with a notification duty.
This post covers what IPP 3A actually requires, which parts of your database it touches, how far the exceptions really stretch, what it costs to get it wrong, and the practical work to do before the date.
Key Takeaways
- The Privacy Act changes 2026 NZ businesses face centre on IPP 3A, a rule covering personal information collected from anyone but the person themselves.
- From 2026, if a contact’s details came from a bought list, a partner, an enrichment tool or a scraper, you have to tell that person you hold their information.
- The notice must go out before collection or as soon as reasonably practicable after, and it has to name you, your purpose and who else gets the data.
- Most CRMs have no working source field, so businesses cannot prove which contacts were collected directly and which were not.
- Publicly available information is a real exception, but it only covers what was genuinely public, not enriched, appended or inferred fields.
- Privacy law and spam law are separate in New Zealand. Meeting one does not make your cold email compliant under the other.
- Breaching a privacy principle where it causes harm can end at the Human Rights Review Tribunal, which awards damages against the business.
- Fix it with a mandatory provenance field and an automated notice on contact creation, not a policy document nobody opens.
A note before the details: I build systems; I am not a lawyer. Nothing here is legal advice. Use it to work out what questions to ask, then get your own advice on your specific setup.
Privacy Act Changes 2026 NZ: What IPP 3A Actually Requires
The Privacy Act 2020 runs on thirteen information privacy principles. Principle 3 has always covered what you tell someone when you take their details directly from them: the form on your website, the phone enquiry, the intake sheet at the front desk. You tell them who you are, why you want it, who else sees it, and that they can ask for it back or correct it.
There has never been an equivalent for information you collect about someone from somewhere else. That is the gap the Privacy Amendment Act 2025 closes by inserting IPP 3A, which takes effect in 2026.
The trigger is the source, not the data
IPP 3A does not care how sensitive the information is or how much of it you hold. It cares where it came from.
If you collect personal information about an individual from any source other than that individual, the principle applies. A partner sends you a list of their customers. Your enrichment provider appends a direct dial. Your marketing tool pulls a name and title off a company website. A staff member adds a contact after a conversation with someone else. All indirect collection.
The obligation is to take such steps as are reasonable in the circumstances to make sure the individual is aware of a defined set of things.
What the notice has to cover
The content mirrors what IPP 3 already asks for on direct collection. In plain terms, the person needs to know:
The fact that you have collected their information, and where you got it from. Why you collected it. Who is going to receive it. The name and address of the business collecting it and the business holding it. Whether the collection is required or authorised by law. What happens to them if the information is not provided. And that they have a right to access and correct what you hold.
That is not a long document. It is a short paragraph, once, per person. The work is not the writing. The work is knowing which contacts need it.
When it has to go out
Before you collect, where that is practicable. Otherwise as soon as reasonably practicable after.
There is no phase-in period once the date arrives. The duty attaches to the act of collection, which means it bites on what you add from 2026 onwards rather than reaching back through everything already sitting in your database. That reading matters a lot for how big this job is, so confirm it against your own circumstances before you build around it. The Office of the Privacy Commissioner publishes guidance on the amendment and is the source worth reading directly.
Where Your Contact List Actually Came From
Here is the exercise almost nobody has done. Open your CRM. Pick twenty contacts at random. For each one, answer in a sentence how that record got there.
Most founders get to about contact number four before it turns into guesswork.
The usual sources
Purchased and rented lists. Scraped business directories and association member pages. Enrichment and waterfall providers that take a company domain and hand back named people with job titles, work emails and mobile numbers. Referral partners forwarding spreadsheets. Event and conference attendee lists. Bulk imports from an old system nobody documented. Someone on the team adding a name after a chat at a barbecue.
Every one of those is indirect collection.
The part that catches people out
Two sources are growing fast, and both sit squarely inside IPP 3A.
The first is enrichment. When a tool takes a company name and returns a named individual with a personal mobile, that is personal information about an identifiable person, collected from a data broker rather than from the person. The fact that a vendor did the collecting does not move the obligation off your business once the record lands in your system.
The second is AI research. A research agent that reads a prospect’s LinkedIn, their company site and three news articles, then writes a summary into the contact record, has just collected personal information indirectly. At volume. Without a human touching it. If you are running AI agents across a small business, that pipeline needs the same source discipline as any other inbound path, and it usually has none.
Business emails are not exempt
This trips up a lot of NZ operators who have read about overseas rules. New Zealand has no business-to-business carve-out and no small business exemption. The Privacy Act applies to every agency, from a sole trader to a corporation, and information about an identifiable individual is personal information whether the email address ends in gmail.com or your prospect’s company domain.
A named person’s work email, direct dial and job title is personal information. Treat it that way.
None of this means databases are a liability. Contact lists that have been sitting untouched are often the most valuable asset a business owns. One finance client had 319 dormant contacts his team had written off completely. A structured reactivation sequence pulled $49,000 in closed business out of that list. The value is real, which is exactly the reason the provenance is worth getting right rather than hoping nobody asks.
The Exceptions, and How Far They Actually Stretch
IPP 3A comes with exceptions. They are genuine, and some will apply to you. They are also narrower and more fact-specific than the average founder assumes after a two-minute skim.
The main ones cover situations where the individual authorised the collection knowing all the relevant matters, where the individual is already aware of them, where non-compliance would not prejudice the person’s interests, where compliance would prejudice the purpose of collection, where compliance is not reasonably practicable in the circumstances, where the information will not be used in a form that identifies the person, and where the information is publicly available.
Three of those deserve a closer look.
Publicly available information. The Act defines a publicly available publication broadly, and a website generally qualifies. So a name and role taken straight off a company’s own team page is on much better footing than most people expect. What that exception does not stretch to is everything bolted on afterwards. If the public page gave you a name and title, and your enrichment stack then supplied a personal mobile from a broker database, the mobile did not come from a publicly available publication. The record is now a mix, and the exception only covers the part that was actually public.
Not reasonably practicable. Reasonable practicability is judged against your actual circumstances, and “we had 8,000 records and no system” reads very differently to “we had 8,000 records, here is the automated notice log”. Volume alone is a weak argument when sending an email costs nothing.
Already aware. Fine when someone has been dealing with you for years. Weak when the first contact they have ever had from you is the notice itself.
The commercial reality is that exceptions get assessed after a complaint, against your records, months later. If your answer depends on what someone remembers about an import from two years ago, you do not have an answer.
Two other things sit alongside IPP 3A and are worth knowing.
IPP 4 governs the manner of collection: it has to be lawful, fair, and not unreasonably intrusive. That applies whether or not IPP 3A is triggered. Aggressive scraping can be a problem under IPP 4 even where the notification exception applies.
And spam law is separate legislation entirely. The Unsolicited Electronic Messages Act 2007 handles consent, sender identification and unsubscribe on commercial electronic messages, and it is enforced by the Department of Internal Affairs, not the Privacy Commissioner. Its penalties run into six figures. Complying with the Privacy Act does not make a cold email compliant, and complying with spam law does not cover IPP 3A. Two rulebooks, one send.
What It Costs to Get This Wrong
The path starts with one annoyed person. They notice you have their mobile number, they cannot work out how, and they complain to the Office of the Privacy Commissioner.
The Commissioner investigates. Most matters settle. Where a breach of a privacy principle has caused harm, it is an interference with privacy and can proceed to the Human Rights Review Tribunal, which can award damages against your business. The Tribunal’s jurisdiction runs to $350,000 per claim, and while awards that size are rare, six-figure awards have happened in New Zealand.
The Commissioner can also issue a compliance notice requiring you to do something or stop doing something. Failing to comply with one is an offence carrying a fine of up to $10,000. Misleading someone in order to obtain another person’s information is a separate offence.
Sitting behind all of that is the notifiable breach scheme, live since December 2020. If a privacy breach is likely to cause serious harm, you have to notify the Commissioner and the affected individuals promptly.
In practice, the legal exposure is rarely the biggest number. The commercial cost usually arrives first and quietly. Complaints and spam reports hammer your sending domain reputation, which means the emails you actually want delivered stop landing. A prospective enterprise client sends through a vendor security questionnaire with a data provenance section you cannot fill in. A partner asks how you sourced the list before they will co-market.
Contracts increasingly carry privacy warranties, and signing one you cannot evidence is its own problem. This is the same territory as the AI automation contract checklist: the questions get asked at the worst possible moment, and the answers have to already exist.
Privacy Act Changes 2026 NZ: Your Pre-Deadline Checklist
None of this is hard. It is just unglamorous, and it has a date on it. Here is the order I would run it in.
1. Map every inbound path
List every single way a contact record gets created in your systems. Website forms. Phone enquiries. Manual entry. CSV imports. Enrichment tools. Partner feeds. Automations. AI research steps. Chat widgets. Event integrations.
Most businesses find between eight and fifteen. Half of them nobody remembers setting up. For each path, mark it as direct or indirect. That single column is the whole compliance question.
2. Make provenance a mandatory field
Add fields to your contact records and make them required on creation. Source name. Source date. Direct or indirect. Notice required: yes or no. Notice sent date.
In Nexus, or whatever platform you run, this is custom fields plus a validation rule. An afternoon of work. The reason to do it is not tidiness. It is that in eighteen months, when someone asks how you got their number, the record answers instead of your memory.
3. Write the notice once
One short block of plain English covering the required matters. Who you are, that you hold their details, where they came from, why, who else gets them, and how to access, correct or remove them.
Write it so a person reads it and feels informed rather than lawyered at. Then stop rewriting it.
4. Automate the send
This is the step that decides whether the whole thing survives contact with a busy week.
Trigger on contact creation. If the source field says indirect and no exception applies, the notice sends automatically and stamps the record with the date. No human decides, no human remembers, no human forgets during a bad Tuesday.
If a person has to remember to do it, it will happen for three weeks and then stop.
5. Put the same rule on your enrichment and AI steps
Anywhere a machine adds personal information to a record, the same logic runs. Enrichment appends get flagged as indirect. Research agents write their source alongside their output. Any automated step that cannot say where a field came from gets fixed or switched off.
6. Update the public privacy statement
Your website privacy policy almost certainly describes direct collection only. Add a section covering indirect sources, in the same plain language, and make it easy to find.
7. One page of training, not twenty
Everyone who can create a contact record needs to know two things: fill in the source field, and never import a list without asking where it came from. That is a one-page brief, not a workshop.
8. Set the review date
Put a recurring check in the calendar. Once a quarter, pull a sample of new records and confirm the source field is populated and the notices fired. Fifteen minutes. The 90-day checkpoint habit works here as well as it does anywhere else.
This Is a Systems Problem Wearing a Legal Costume
Here is what I actually think is going on when a founder tells me this is going to be a nightmare.
The nightmare is not IPP 3A. The requirement is one paragraph sent to one person. The nightmare is that the knowledge of where every contact came from lives in three people’s heads and one abandoned spreadsheet, so the only way to answer a simple question is to interrupt everybody and reconstruct history.
That is the same failure mode as everything else that eats a founder’s week. The business knows things. The business just has no way of holding what it knows. So every question routes back to the person with the longest memory, which is almost always the owner. It is the same reason admin overload never gets better by working harder at it.
The fix is structural. Give the business a brain that holds the rule, and a workforce that applies it every time without being asked. The brain is the context: what your policy is, what counts as indirect, what the notice says, what your exceptions are and why. The workforce is the automation: it stamps the source, sends the notice, logs the date, and flags any record that arrived without provenance so a human can look at the handful that actually need judgement.
Once that exists, this stops being an annual scramble and becomes a field on a form. And the same structure handles the next rule change, because the notice text and the exception logic are in one place to edit rather than fifteen habits to retrain.
That is the difference between businesses that treat AI adoption as a system and businesses that treat it as a pile of tools. One of them absorbs a regulatory change in an afternoon. The other one spends a fortnight on it and still cannot prove anything.
Conclusion
The Privacy Act changes 2026 NZ are not dramatic. IPP 3A asks you to tell people when you have collected their information from somewhere other than them, and to do it promptly and plainly. Most businesses could comply tomorrow if they knew where their contacts came from.
That is the real gap, and it was a gap before the law changed. A database nobody can account for is a liability whether or not a regulator is looking, because it means you cannot answer basic questions about your own most valuable asset.
Do the source audit now. Add the provenance field. Automate the notice. Then stop thinking about it, because the system is thinking about it for you.
If you are not sure how many undocumented paths feed your CRM, that is the number to go and find this week. It is always higher than the guess.
Want a second set of eyes on how contacts actually flow through your business and where the gaps sit? Book a 30-minute Discovery Call. No pitch deck, just a straight conversation about what you have and what needs fixing.
Frequently Asked Questions
When do the Privacy Act changes take effect in New Zealand?
The new information privacy principle, IPP 3A, takes effect in 2026. It was introduced by the Privacy Amendment Act 2025, which amends the Privacy Act 2020. There is no phase-in period after that date, so the practical deadline for having your contact sources documented and your notice process running is the end of April 2026.
What is IPP 3A?
IPP 3A is a new information privacy principle covering indirect collection. When you collect personal information about someone from any source other than that person, you have to take reasonable steps to make them aware of the collection, your purpose, who will receive the information, who you are, and their rights to access and correct it. Exceptions apply in defined circumstances.
Does the Privacy Act apply to business contact details?
Yes. New Zealand has no business-to-business carve-out and no small business exemption. If information identifies an individual, it is personal information regardless of whether the email address is personal or corporate. A named person’s work email, direct dial and job title all count. Every agency is covered, from a sole trader through to a large company.
Do I have to notify people whose details came from a purchased list?
If you collect their details in 2026 and no exception applies, yes. That is exactly the situation IPP 3A was written for. Before buying any list from that date, confirm what the supplier can tell you about the original source, because you will need that to assess whether an exception applies and to answer a complaint later.
Does the publicly available information exception cover scraped data?
Partly. A website generally counts as a publicly available publication, so a name and role taken from a company’s own team page sits on reasonably firm ground. The exception does not extend to fields added afterwards by enrichment providers, data brokers or inference. Separately, IPP 4 still requires collection to be fair and not unreasonably intrusive, whatever the source.
What are the penalties for breaching the Privacy Act in New Zealand?
Breaching a privacy principle is an interference with privacy where it causes harm, and matters can proceed to the Human Rights Review Tribunal, which can award damages up to its $350,000 jurisdictional limit per claim. The Privacy Commissioner can also issue compliance notices, and failing to comply with one is an offence carrying a fine of up to $10,000.
Do I need to delete my existing database?
Almost certainly not. The duty attaches to the act of collection, so it applies to records you add from 2026 onwards rather than reaching back through what you already hold. Other principles still govern retention and use of existing data, so this is worth confirming with your own adviser rather than assuming either way.
About Octavius
Titus Mulquiney is the founder of Octavius AI, where he builds AI brains and AI workforces for founder-led businesses stuck running everything out of their own head. Twenty years in marketing, ex-Sony product manager, ex-GM Zeal NZ. Based in Auckland, working with operators across NZ, Australia, and the US. Connect on LinkedIn.