New Zealand’s IPP3A and lead generation
The Privacy Amendment Act 2025 added Information Privacy Principle 3A, in force from 1 May 2026. Agencies that collect personal information about someone from a source other than that person must take reasonable steps to tell them, unless an exception applies. Advertisers who buy lead lists, enrich CRM records or receive leads through partners need a notice process. Leads captured directly on your own forms are outside IPP3A, which gives first-party lead generation a compliance advantage.
Executive findings
- 1
The Privacy Amendment Act 2025 received assent on 23 September 2025.
Documented: official source. Scope: New Zealand; legislation, as of . [1]
- 2
IPP3A requires agencies to take reasonable steps to inform individuals when their personal information is collected from another source, unless an exception applies, from 1 May 2026.
Secondary source. Scope: New Zealand; law firm summary of OPC guidance, as of . [2]
- 3
The Office of the Privacy Commissioner published final IPP3A guidance, including detail on reasonable steps and exceptions.
Secondary source. Scope: New Zealand; law firm summary of OPC guidance, as of . [2]
- 4
The Privacy Commissioner’s guidance says inconvenience, cost or administrative burden does not automatically make notification “not reasonably practicable”.
Documented: official source. Scope: New Zealand; Office of the Privacy Commissioner, as of . [3]
Method and limitations
- Question
- How does IPP3A change lead generation and data enrichment for advertisers in New Zealand?
- Written for
- Marketing and CRM leads running lead generation in New Zealand.
- Decision at stake
- Which lead sources need a notice process before campaigns run.
- Sources
- The Privacy Amendment Act 2025 and a law firm summary of the Office of the Privacy Commissioner’s final IPP3A guidance.
- Period
- Official and legal sources as published and opened on 18 October 2026.
- Markets
- New Zealand.
- Definitions
- Indirect collection: obtaining personal information about a person from someone other than that person.
- Limitations
- We did not review every exception; check the OPC guidance for your case.
- This is not legal or tax advice. Confirm obligations for your business with qualified counsel in the market.
What IPP3A adds
Secondary source
IPP3A requires agencies to make people aware of certain matters when they collect personal information about them from someone else, such as the fact of collection, its purpose and the agency’s name and address. The guidance explains when the exceptions apply, including when the person was recently told about a similar collection.
Where it touches advertising
FOCUSADS view
- Purchased or rented prospect lists.
- CRM enrichment from data vendors.
- Leads passed on by partners, comparison sites or events.
- Referral programmes where customers submit friends’ details.
Preparing campaigns
Secondary source
The guidance summary recommends data mapping, updated privacy notices, contract reviews with data suppliers and building notification into existing workflows. If you rely on the source having already told the person, keep evidence, such as the supplier’s privacy notice naming your organisation.
Where we see opportunity
FOCUSADS view
Lead forms on your own site and native lead forms on search and social platforms collect information directly, which keeps them outside IPP3A. For B2B advertisers, this strengthens the case for content offers and webinars over bought lists.
How this connects to our method: How FOCUSADS screens channels by market
References
- Privacy Amendment Act 2025, New Zealand Legislation, accessed
- Final IPP3A guidance released, MinterEllisonRuddWatts, accessed
- IPP3A: notification requirements for indirect collection of personal information, Office of the Privacy Commissioner (New Zealand), accessed