From 1 May 2026, the Privacy Amendment Act 2025 introduces a new information Privacy Principle, IPP3A, into the Privacy Act 2020 (Act). This change will have a direct impact on how employers collect and handle personal information about employees and candidates, and it is closer than many employers realise.
What is IPP3A?
In short, IPP3A expands the notification requirement to include indirect personal information collection – information obtained about a person from any source other than that person. For agencies and employers, this captures a wide range of routine activities, from background checks and contacting referees to storing information.
The notification obligation
The detail of what must be included in a notification is set out in the Act itself, but in broad terms employers must tell individuals what information has been collected, why, who will receive it, and how they can access or correct it.
We have previously covered the basics of IPP3A – read on for a more detailed outline of what employers should be doing to prepare.
What does this mean for employers?
For most employers, the practical implications will be felt across recruitment, day-to-day employment and third-party service arrangements.
Key examples:
- Recruitment processes: reference checks and police vetting are standard practice for many roles. Under IPP3A, employers must ensure candidates are told that their personal information is being collected about them from third parties, what information is being sought and how it will be used. While many employers may already do this informally, the new principle makes it a legal requirement rather than simply best practice.
- Workplace monitoring: CCTV, GPS vehicle tracking and time and attendance systems all involve the collection of personal information about employees. Where this information is collected or processed by a third-party provider, the employer must take reasonable steps to notify employees that their information is being shared, with whom, and for what purpose.
- Any third-party service providers: this might be payroll providers, accountants, IT support companies etc. If an employer is using a third party to store personal information, if the third party is not collecting or storing this information for its own purposes, then the employer is responsible for meeting IPP3A requirements.
- Employers using AI: you should consider whether the way that you’re doing so might trigger IPP3A obligations, or whether exceptions apply.
Exceptions
There are some exceptions to the obligation to notify, which we covered previously here.
The Office of the Privacy Commissioner (OPC) has provided a specific example of how some of these exceptions might apply.
In relation to the exception that non-compliance would not prejudice the interests of the individual concerned, if an employer were collecting emergency contact information from its employees, the employer would not need to notify the emergency contact. The employer is able to make the reasonable assumption that the emergency contact has an existing relationship with the employee, and are aware that they are the employee’s emergency contact.
Steps employers should take now
With 1 May 2026 fast approaching, employers should be taking practical steps to prepare. At a minimum, employers should consider every way personal information is collected and note where information might be collected indirectly.
We also suggest that employers should:
- Assess each instance of indirect collection and determine whether notification is required, or whether an exception applies.
- Consider the method of notification: if no exception applies, decide on an appropriate method in line with the OPCs guidance.
- Update privacy policies and systems: revise policies to address indirect collection and notification obligations.
Employers who act now will be well placed to meet their obligations from 1 May 2026.
For further information, or assistance in preparing for IPP3A, please contact our specialist Employment Law Team.
