A new privacy rule came into force on 1 May 2026, creating additional notification obligations for employers when they collect information about a person from other people or organisations.
The new notification obligation in a nutshell
Whenever you as an employer collect information about someone indirectly – for example, when checking a job candidate’s references or talking to witnesses in a workplace investigation – you may have to notify the person that you’ve collected the information.
There are some exceptions, but if no exception applies you must take reasonable steps to notify the person concerned as soon as reasonably practicable.
In the Privacy Act, the new rule is called “Information Privacy Principle 3A”, which we’ll abbreviate to “IPP3A” in this article.
What situations does the new IPP3A rule cover?
For employers, the new rule could apply whenever you:
- talk to referees or check references for job applicants
- carry out background screening
- carry out workplace investigations
- obtain health and safety or medical information from third parties, or
- obtain information from recruitment, payroll, or HR service providers.
What information do employers have to provide when they notify the person concerned?
You must tell the person:
- the fact that their information has been collected
- why you collected it
- who will receive the information, and
- who is holding it.
You must also tell the person about their rights to access the information, and to correct it if necessary.
The exceptions: When does the new IPP3A not apply?
There are various exceptions to the new rule.
For example, you don’t have to notify the individual concerned if the organisation or person you collected the information from has already notified them.
You also don’t have to notify the person if the information you collected was already publicly available on a source such as a news website or public register.
But information on social media doesn’t count as publicly available for this exception if you need to get some kind of additional permission to see the information – like becoming a Friend or Follower of a private social media account.
There are several other exceptions: you can read about them all here on the Privacy Commissioner’s website.
Complying with the new notification rule: Practical steps for employers
You should review your information gathering practices now to identify and document all those situations when your business collects information about an individual indirectly, and to make sure you are notifying the person concerned when the new rule requires this.
We suggest you work through the following specific steps:
Review your existing documents and processes to find out what you’re already doing
- Audit all the information your organisation collects, directly or indirectly, about individuals, and how you are collecting it.
- Identify whether you are already notifying individuals about their information being collected indirectly – you might already be giving them the necessary IPP3A notice through your existing documents and communications such as application forms or privacy statements.
Decide how you will comply with the new notification rule
- Consider how your business will provide IPP3A notifications and who exactly in the business will be responsible for issuing them.
- If you have no reasonably practicable way to contact the individual, consider whether an exception could apply or whether another organisation could notify the person on your behalf.
Update your documents and processes, and train your staff
- As needed, update your recruitment documentation, your privacy notices, and your internal processes.
- Make sure all your staff who regularly handle personal information are trained on the new requirements.
If you would like advice on how these changes could affect your business and on how to ensure you’re meeting your obligations under IPP3A, please talk to the Ford Sumner Employment Team