Most privacy rules were written with one picture in mind: a person gives you their own details. Charities often get details a different way. A social worker sends a referral. A partner organisation passes on a list of event sign-ups. A supporter tells you about a friend who should get a card.
Since 1 May 2026, the Privacy Act 2020 has a rule for that: information privacy principle 3A, or IPP 3A. The Privacy Amendment Act 2025 added it.
What the rule says
If your charity collects personal information about someone from another source, you must take any steps that are reasonable in the circumstances to make sure the person knows:
- that the information has been collected
- why it was collected
- who the intended recipients are
- the name and address of the agency that collected it and the agency that holds it
- the particular law that authorises or requires the collection, if there is one
- their right to see their information and ask for it to be corrected
You need to do this as soon as is reasonably practicable after you collect the information. The wording is on the Privacy Commissioner’s IPP 3A page.
What counts as collecting from another source
In plain terms: any time the details came from someone other than the person they’re about. The examples above fit, and so does a referral list from a partner agency. Details you read on a public website or register are different, which is covered under the exceptions below.
When you don’t have to
The principle has several exceptions. These are the ones most likely to matter to a charity:
- The person has already been made aware of everything on the list for that collection. The Commissioner says you need evidence for this, not an assumption.
- The information is publicly available.
- You believe on reasonable grounds that not telling them wouldn’t harm their interests.
- Telling them isn’t reasonably practicable in this case.
- Telling them would seriously threaten someone’s health or safety.
Inconvenience alone is not a reason to skip it, the Commissioner says. You also aren’t expected to collect someone’s contact details just so you can notify them.
What “reasonable steps” looks like
It depends on your situation. The Commissioner’s guidance points to how sensitive the information is, the risk of harm to the person, their particular needs, and what is practical.
A few things follow from that:
- For low-risk details, an accessible privacy statement that covers indirect collection may be enough, as long as people can actually find it.
- For sensitive information, such as client or case records, expect to do more.
- Several organisations can be in the same chain, and each one that collects indirectly has the duty. One organisation can give the notice on behalf of another, but the notice has to name the charity that is collecting, and the responsibility stays with that charity.
What I would put in the CRM
A rule like this is much easier to meet when the record shows it. For each person whose details came from someone else, the record should say:
- Where it came from. The referrer, partner or form.
- Whether the person has been told. Yes or no.
- When and how. For example, a letter on a date, or a notice on the referrer’s form.
Then a report can list everyone who hasn’t been told yet, and the gap gets closed before it becomes a problem. If you work with referral partners, agree with them whether their forms or privacy statements will carry your notice. If they do, check that it is being delivered.
What I’d do this month
- List where your charity’s information comes from, other than the people themselves.
- Update your privacy statement to say what you collect indirectly and why.
- Talk to your main referrers about who tells the person, and put it in writing.
- Add a source field and a told-or-not field to your records.
- Ask your solicitor how the rule applies to information you collected before 1 May 2026.
Sources
- The Privacy Commissioner’s pages on IPP 3A and indirect collection
- The Ministry of Justice’s note that the new principle is in force