Over two years after its introduction to the House, the Privacy Amendment Act 2025 (Amendment Act) received Royal assent on Tuesday, 23 September 2025. The Amendment Act makes several amendments to the Privacy Act 2020 (Privacy Act); most notably to include a new Information Privacy Principle (IPP), IPP 3A, with effect from 1 May 2026.

IPP 3A will require agencies who collect personal information indirectly (ie from sources other than the individuals concerned) to notify the individual concerned of a range of matters, including the fact and purpose of collection.

IPP 3A will have implications for a range of agencies, including from an employment perspective. Agencies will need to review what personal information they currently collect from third parties and other indirect sources and potentially update their privacy statements to comply with IPP 3A.

IPP 3A: What are the new requirements?

IPP 3A will enhance transparency when personal information is collected indirectly, that is, not from the individual concerned. Agencies will have a legal obligation to take reasonable steps to notify the individual concerned of certain matters when collecting their personal information from a third party source. Currently, notification is only required if personal information is collected directly from the individual concerned.

The matters that must be notified under IPP 3A are largely aligned with the existing notification requirements under IPP 3. Specifically, they require the agency to, as soon as practicable, take reasonable steps to ensure the individual concerned is aware of:

• the fact of collection; and
• the purpose for which the information has been collected; and
• the intended recipients of the information; and
• the name and address of the agency that has collected the information and is holding the information; and
• any law authorising or requiring the collection; and
• the rights of access to, and correction of, the information.

IPP 3A will come into force on 1 May 2026. IPP 3A will not apply to personal information collected before that date, including any personal information collected under an approved information sharing or matching agreement in force before that date.

There are a number of exceptions to the IPP 3A notification requirements, which are largely aligned with the existing exceptions under IPP 3. For example, notification need not occur when the personal information is publicly available.

IPP 3A’s requirements and exceptions are discussed in detail in our previous article here.

What should agencies do?

Although IPP 3A does not come into effect until next year, there are several steps that agencies can take now to prepare for the new requirements. These include:

• Reviewing how the agency currently collects personal information, particularly from third parties and other indirect sources.
• Reviewing existing policies and contractual arrangements.
• Mapping out indirect collection scenarios across operations.
• Identifying where notifications may be required and assessing whether current notification practices are sufficient.
• Identifying where exceptions may apply.
• Preparing updates to privacy statements, forms, and contractual arrangements.

For agencies that are employers, a key area where personal information may be indirectly collected is where information is obtained from referees and previous employers. In our experience, most employers are already collecting such information with the knowledge and consent of the individual concerned. However, IPP 3A will now impose more stringent notification requirements. Including a clear and comprehensive privacy statement in job application forms, which addresses the requirements of IPP 3A, is a practical way that employers can meet their IPP 3A obligations.

Earlier this year the Office of the Privacy Commissioner (OPC) released for public consultation draft guidance to assist agencies to comply with their obligations under IPP 3A. The OPC has indicated that the guidance is being revised following substantial feedback received through that consultation process. The finalised guidance is expected to be published later this year, which will provide more insight into how organisations can prepare for the new requirements.

Get in touch

Please feel free to reach out to any of our experts if you have any questions about how your organisation will be affected by these changes.

Special thanks to Caitlin Walker and Pippa Saunders for their assistance in writing this article.