15th April
2026
New Privacy Rules Are Coming - Is Your Business Ready
New Zealand's privacy law is changing again, and this time it affects almost every business that buys, sells, or shares personal information.
The Privacy Amendment Act 2025 introduces a new rule called Information Privacy Principle 3A (IPP 3A), which comes into force on 1 April 2026. In plain English: if your business collects personal information about someone from a third party, rather than directly from that person, you now have an obligation to notify the individual. That means telling them what information was collected, why, who holds it, and their rights around accessing or correcting it.
This is particularly relevant in business sales and acquisitions. When a purchaser receives customer lists, employee records, or supplier details during due diligence, IPP 3A is likely triggered. The notification obligation falls on the purchaser, so if you're buying a business after 1 April, this needs to be on your checklist from day one.
The good news? Information collected before 1 April 2026 isn't captured by these new rules. Acting now gives you a real head start.
There's also a housekeeping note: the Office of the Privacy Commissioner is retiring its current contact email from 1 April. If your terms of trade or privacy policy reference it, it needs updating.
With recent high-profile cyberattacks, including a breach affecting 120,000 New Zealanders' health records, regulators are paying close attention. Tighter enforcement and increased penalties are likely on the horizon.
At Asco Legal, we help businesses stay ahead of legal change, not scramble to catch up. Whether you need your privacy policy reviewed, your terms updated, or advice on an upcoming transaction, our team is ready to help.
Get in touch before 1 April - don't let compliance be an afterthought.
09 308 8070
ascolegal.co.nz