From:

📅 May 1, 2026

new rules under the:

⚖️ Privacy Amendment Act 2025

introduced a powerful new privacy rule known as:

⚖️ Information Privacy Principle 3A (IPP3A)

And for many Kiwi businesses, marketers, recruiters, real estate agents, and sales teams…

👉 The impact could be massive.

🧠 WHAT IS IPP3A?

Under the old Privacy Act rules, businesses generally only had notification obligations when they collected information:

✔ Directly from the individual

But IPP3A changes that completely 👇

Now, if a business collects personal information:

❌ Indirectly

—from another source — they may need to notify the individual that their information has been collected.

📌 WHAT COUNTS AS “INDIRECT COLLECTION”?

Indirect collection can include obtaining information from:

• Third-party databases
• Purchased prospect lists
• Public records
• Social media
• Referral partners
• Lead generation services
• CRM enrichment tools
• Public business directories

This is where huge parts of the modern prospecting industry operate.

📧 WHY EMAIL MARKETING & LEAD GENERATION ARE NOW UNDER THE SPOTLIGHT

One of the industries most affected by the changes is:

📈 Direct marketing and prospecting

especially where businesses purchase or obtain contact data from third parties.

Under IPP3A, organisations may now need to take “reasonable steps” to notify people that:

✔ Their information has been collected
✔ Who collected it
✔ Why it was collected
✔ How it may be used

—even if the information came from another source.

⚠️ THIS DOES NOT MAKE ALL DATA ILLEGAL

One major misconception is that all databases or prospecting activity suddenly became illegal on May 1 👀

That’s not true.

Business-to-business marketing and prospecting can still occur in New Zealand.

However, businesses now face much greater obligations around:

✔ Transparency
✔ Notification
✔ Data sourcing
✔ Compliance processes

🏢 BUSINESS DATA VS PERSONAL DATA

The changes mainly impact:

👤 Personal information about identifiable individuals

This means even:

📧 firstname.lastname@company.co.nz

can still be considered personal information under the Privacy Act because it identifies a person.

📅 THE MOST IMPORTANT DETAIL: THE LAW IS NOT RETROSPECTIVE

A huge point many businesses are missing 👇

IPP3A only applies to:

📅 Personal information collected on or after May 1, 2026.

It does NOT automatically apply retrospectively to older databases developed prior to that date.

This has become a critical distinction for many NZ data providers and CRM businesses.

🏘️ WHAT THIS MEANS FOR REAL ESTATE PROSPECTING

The real estate industry is expected to be heavily impacted by the changes.

Particular pressure is now being placed around:

❌ Residential mobile numbers
❌ Personal email addresses
❌ Highly targeted homeowner profiling
❌ Indirectly sourced personal data

Many providers have already begun restricting or removing:

📵 Residential mobile phone data

from homeowner datasets.

📊 B2B DATA STILL REMAINS ACTIVE

Business databases remain a major part of NZ marketing and sales activity.

Many datasets still include:

✔ Business names
✔ Director names
✔ Business emails
✔ Industry classifications
✔ Business phone numbers where lawful

However, businesses using this data must now pay much closer attention to compliance obligations.

📨 UEMA STILL APPLIES TOO

Businesses also need to remember that New Zealand’s:

⚖️ Unsolicited Electronic Messages Act 2007 (UEMA)

still governs:

📧 Commercial emails
📲 Electronic marketing communications

That means Privacy Act compliance alone is not enough.

The two laws now work side-by-side.

⚖️ WHAT BUSINESSES SHOULD BE DOING NOW

Privacy experts say organisations should urgently be:

✔ Reviewing data collection methods
✔ Auditing CRM systems
✔ Updating privacy policies
✔ Reviewing supplier agreements
✔ Mapping indirect collection sources
✔ Improving opt-out systems
✔ Training staff on compliance

Many companies are also reassessing:

📈 Purchased data lists
📈 Lead-generation partnerships
📈 Public scraping practices

👀 THE “PUBLICLY AVAILABLE” CONFUSION

One major area of confusion surrounds publicly available information.

Just because information is public online does NOT automatically mean businesses can freely use it however they want.

IPP3A still potentially applies where personal information is collected indirectly from public sources.

🌍 NZ PRIVACY LAW NOW CLOSER TO GLOBAL STANDARDS

The reforms are part of New Zealand’s broader push to align more closely with international privacy standards such as Europe’s GDPR framework.

Maintaining New Zealand’s international “adequacy” status for data protection was seen as an important driver behind the reforms.

🧠 WHY THIS MATTERS FOR THE FUTURE OF SALES & MARKETING

The days of simply buying a spreadsheet and blasting marketing messages without robust compliance processes are rapidly disappearing 👇

The industry is now shifting toward:

✔ Greater transparency
✔ Permission-based marketing
✔ Better CRM governance
✔ More compliant prospecting
✔ Stronger data accountability

For many businesses, this represents a major operational and cultural shift.

🔥 THE BOTTOM LINE

New Zealand’s new privacy rules are now reshaping how businesses collect, use, and prospect with personal data.

💥 Indirect data collection now under scrutiny
💥 Prospecting practices changing fast
💥 Real estate and marketing industries heavily impacted
💥 Businesses facing new compliance obligations

And while business data and B2B marketing remain active…

⚖️ The era of “easy data” in New Zealand is rapidly changing.