New Privacy Rules Are Coming: What IPP3A Means for Digital Investigations

From 1 May 2026, New Zealand organisations will face a new privacy obligation when they collect personal information about someone from another source.

Known as Information Privacy Principle 3A, or IPP3A, the new rule will generally require an organisation to tell a person when information about them has been collected indirectly.

That sounds straightforward. In practice, it raises some interesting questions for workplace investigations, fraud inquiries and other matters where information is often gathered without first approaching the person under investigation.

Does the new rule mean investigators must reveal an investigation before the evidence has been secured? Can organisations still speak with colleagues, examine public information or collect records from third parties? And what happens when an external forensic provider is involved?

The answer is that legitimate investigations can still proceed. However, organisations will need to think more carefully about transparency, timing and why information is being collected.

A New Expectation of Transparency

Indirect collection happens more often than many organisations realise.

A workplace investigator might interview colleagues, examine CCTV footage or review information held in company systems. A fraud investigation might involve bank records, transaction data, emails, mobile devices or information supplied by customers and service providers.

In each of these situations, information about a person is being obtained from somewhere other than that person.

From 1 May, the starting position will be that the individual should be told that the information has been collected, why it was collected, who may receive it and how they can exercise their privacy rights.

The change does not prevent indirect collection. Instead, it creates a stronger expectation that people should understand when organisations are gathering and using information about them.

Does This Make Confidential Investigations Impossible?

The obvious concern is that notification could undermine an investigation.

Imagine an organisation suspects that an employee has manipulated financial records. Telling the employee immediately that information is being collected could give them time to delete files, contact witnesses or change their explanation.

IPP3A recognises this problem.

Notification may not be required where telling the person would prejudice the purpose of a legitimate investigation. The Office of the Privacy Commissioner has specifically referred to internal fraud investigations as an example where an exception may apply.

However, this should not be treated as a blanket investigation exemption.

The fact that an investigation is confidential does not automatically mean that notification can be avoided. The organisation should be able to explain why secrecy was genuinely necessary in the particular circumstances.

There is an important difference between protecting an investigation and simply preferring not to have a difficult conversation.

Timing May Be More Important Than Secrecy

In many cases, the real issue may not be whether the individual is ever told, but when they are told.

An organisation may need time to secure devices, preserve cloud information or interview key witnesses before approaching the person involved. Once that immediate risk has passed, the justification for delaying notification may become weaker.

This means IPP3A should not be treated as a single decision made at the beginning of an investigation and then forgotten.

The position may need to be reconsidered as the investigation progresses.

A delay that was justified on the first day may no longer be justified several weeks later. Organisations should be prepared to explain both why notification was delayed and why the delay continued for as long as it did.

Public Information Is Not Automatically Simple

Investigators often assume that information found online can be collected and used without raising privacy concerns.

IPP3A includes an exception for some publicly available information, but the boundary between public and private is not always clear.

A news article or openly accessible company website is relatively straightforward. A restricted social media account, closed group or page requiring membership is different.

The fact that an investigator can gain access to information does not necessarily mean that it is genuinely public.

This is particularly relevant where screenshots are used. A screenshot may show the content itself but not whether the page was public, restricted or accessed through someone else’s account.

The context in which online information was obtained may therefore become just as important as the information itself.

External Investigators Do Not Remove the Responsibility

Organisations sometimes engage an external investigator, lawyer or forensic provider to collect and examine information on their behalf.

Using a specialist does not automatically transfer the organisation’s privacy responsibilities.

The organisation should still understand what information is being collected, why it is necessary and how any notification obligations will be handled.

The external provider may deliver a notice or assist with the privacy assessment, but the organisation instructing the work will usually remain closely involved in determining the purpose and scope of the collection.

This makes it important to discuss privacy at the beginning of the engagement rather than after the evidence has already been gathered.

A Better Conversation at the Start of an Investigation

The practical effect of IPP3A is not that every investigation needs a complicated new process.

It does mean that legal, privacy, human resources and investigation teams should have a short, deliberate conversation before collecting information.

Why are we collecting this information from another source? Is it relevant and necessary? Would telling the person now undermine the investigation? If notification is delayed, when should that decision be reconsidered?

Those questions are more valuable than relying on a generic statement that the investigation is confidential.

They also create a clearer record if the collection is later challenged.

The Takeaway

IPP3A introduces a stronger expectation of transparency, but it does not prevent legitimate digital investigations.

Organisations can still preserve evidence, interview witnesses and collect relevant information from third parties. Where notification would genuinely undermine an investigation, an exception may be available.

The important change is that organisations will need to think more carefully about why information is being collected, when the person should be told and whether continued secrecy remains justified.

Privacy should form part of the investigation strategy from the beginning, not be added after the important decisions have already been made.

How We Can Help

We help legal teams and organisations identify, preserve and collect digital evidence in a way that is proportionate, documented and suitable for the matter.

This includes workplace and fraud investigations, forensic collection from computers and mobile devices, email and messaging evidence, cloud data, evidence scoping and the preparation of clear and defensible findings.