Most of us assume that organisations only hold information that we have personally provided. In reality, information about us is often obtained from other sources as well.
A recent change to New Zealand’s privacy laws is designed to make that process more transparent.
From May 2026, organisations that collect personal information about someone from a third party will generally be required to let that person know. The change is intended to help people understand what information is being held about them, where it came from, and how it may be used. Information can be obtained from a variety of sources, including professional advisers, employers, government agencies, family members, business associates, or publicly available records.
The new rules reflect growing concerns about privacy in an increasingly digital world, where information can be shared and stored more easily than ever before.
For most people, the practical effect is straightforward. You should have a better opportunity to understand what information organisations hold about you and how they obtained it.
The law also gives individuals the right to request access to personal information held about them. This can be an important safeguard where someone wants to understand what information is being used to make decisions that affect them or simply wishes to check that the information held is accurate.
For businesses and organisations, failing to meet privacy obligations can have serious consequences. Complaints may be made to the Privacy Commissioner, investigations may follow, and organisations can suffer reputational damage if customers or clients lose confidence in how their personal information is handled. In some cases, privacy breaches can also result in financial costs, disruption to business operations, and legal liability.
While the changes place additional responsibilities on businesses and organisations, they are ultimately intended to promote openness, transparency, and trust. Organisations that handle personal information carefully and communicate clearly with the people affected are likely to build stronger relationships with their customers and clients.
Whether you are concerned about your own privacy, or are a business or organisation concerned to ensure you are complying with the new requirements, please reach out to us for advice.
