PRIVACY PRINCIPLE

On 1 May 2026 a new privacy principle came into force under the New Zealand Privacy Act 2020 (Act): the Information Privacy Principle 3A (IPP3A). Katrina Hammon of Wynn Williams explains why franchisors and franchisees should be aware of these important changes for indirect collection of personal information. 

The new IPP3A expands on the existing requirement to notify individuals of specific information when collecting their personal information. Common examples include a franchisor obtaining a prospective franchisee’s credit history from a credit reporting agency, or a franchisee verifying a job applicant’s employment with previous employers. 

The IPP3A notification requirements include advising the individual:

• that personal information has been collected, and what it is;
• the purpose for collection;
• the persons or entities to whom the personal information will be disclosed;
• the name and address of the business that is collecting the personal information and the business that holds the personal information;
• whether collection is authorised or required by which applicable law; and
• how the individual can access and correct their personal information.

Businesses must take reasonable steps to notify individuals of the above. What is “reasonable” depends on the circumstances, but you should consider:

• how sensitive the personal information is;
• the possible harm or negative effects on the individual if not informed;
• any particular requirements the individual may have, such as language or accessibility needs; and
• practical factors, including time and expense, while noting that difficulty or cost by itself does not relieve an obligation to comply.

Notification can occur before collection, or as “reasonably practicable” following collection, which again depends on the circumstances. Individuals may be notified of IPP3A matters through any means, provided the communication is clear and easy to comprehend. Most commonly, businesses will use their privacy policy, and subsequent shorter reminders. 

Various exceptions to the IPP3A notification requirements include where:

• the individual is already aware of the disclosure;
• the personal information is publicly available;
• non-disclosure would not prejudice the interests of the individual;
• telling the individual would prejudice the purpose of collection or is not reasonably practicable; or
• the personal information will be used in a way that does not identify the individual.

These exceptions should be applied cautiously, and if relied on, the decision and supporting evidence should be properly documented. Businesses have flexibility in determining how they comply with IPP3A and there are a variety of ways to approach it, including:

• identifying internal flows of indirect collection of personal information;
• assessing each instance of indirect collection to determine where notification is required, or whether exceptions apply;
• where no exceptions apply, the method of notification under the IPP3A;
• updating privacy policies and/or contracts, and establishing new systems to support compliance at franchisor and franchisee level; and
• training employees on new obligations.

A one-size-fits-all privacy policy adopted by the franchisor and its franchisees may not be appropriate, given they each collect and use personal information from different sources and for different purposes. If you have any questions about how the IPP3A applies to your business, or need guidance on compliance, please get in touch.

For more information and advice on buying a franchise get your FREE copy of Franchise New Zealand magazine.