Our website uses cookies so we can analyse our site usage and give you the best experience. Click "Accept" if you’re happy with this, or click "More" for information about cookies on our site, how to opt out, and how to disable cookies altogether.

More Accept ×

We respect your Do Not Track preference.

Close ×

opc header logo

Focus areas

Print | Email this page

IPP3A

September 2025

The Privacy Amendment Act was passed. A major part of the Act is the addition of Information Privacy Principle (IPP) 3A.

1 May 2026

IPP3A will come into force and all organisations will need to have their systems in place to comply with the new requirements by then.

A woman working at her laptop points something out on the screen to her coworker at the desk behind her.

What is IPP3A?

Under IPP3, agencies (businesses or organisations) must already inform people when they collect their personal information from them. Under IPP3A, if an agency collects a person’s personal information from someone other than the person themselves (i.e. indirectly), then that agency is required to tell the person, unless an exception applies.

If an agency has collected personal information indirectly, IPP3A requires them to take reasonable steps to make sure that the person concerned is told:

  • that the information has been collected
  • the purpose of the collection
  • the intended recipients of the information
  • the name and address of the agency that is collecting the information and the agency that holds the information
  • whether the collection is authorised or required by law and which particular law
  • their right to access and correct their information.

Read our media release about the Privacy Amendment Act passing.

We've developed IPP3A guidance

Early in 2025 we consulted on draft guidance for organisations about IPP3A. We got some practical and useful feedback, which we’re currently incorporating into the guidance.

Read the full, updated guidance about IPP3A.

In Privacy Week 2025, Steph Gregor, our Capability and Guidance Manager, presented a webinar about IPP3A before our guidance was updated. This may not line up exactly with our final guidance, but gives a useful overview of the new rules. You can view her slides or watch the recording of her presentation.

There may be some code amendments

We’re reviewing the codes of practice issued under the Privacy Act to determine whether any amendments are required to incorporate IPP3A. If you'd like to give us your feedback about how IPP3A works in regards to a particular code, you can take our survey or email [email protected].

Back to top