Privacy Act 2020, Information Privacy Principle 3A (Indirect-Collection Notice)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force 5 months, effective 1 May 2026.
A comprehensive regime rule binding public and private bodies.
As of 6 September 2026.
What it requires
- If you collect personal information about an individual other than from that individual, including by scraping it from a third-party source, take reasonable steps to make the individual aware, as soon as practicable after collection, of the fact of collection, its purpose, the intended recipients, your identity, any legal authority for the collection, and their access and correction rights.
- This duty does not apply to personal information collected before 1 May 2026, or where the individual has already been made aware of these matters by other means.
If you get it wrong
Private right of actionNo
Who enforces it
Enforcement body
Office of the Privacy Commissioner
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
If an agency collects personal information about an individual from a source other than that individual, such as a third-party dataset or a scrape of another site, it must take reasonable steps to make the individual aware, as soon as practicable, of the fact and purpose of collection, the intended recipients, the collecting and holding agency's identity, any legal authority for the collection, and the individual's access and correction rights.
The duty does not apply where the individual has already been made aware of these matters by any means, or to personal information collected before 1 May 2026.
When LexLint raises it
crawls_webtrains_models
Read the law
official consolidated Act text, New Zealand Legislation