Country-specific guidance Current

New Zealand Privacy Act 2020 client information requests

What to tell a client, and when, under Information Privacy Principle 3.

Collecting a client's personal information directly comes with a specific obligation to tell them about it. This guide sets out what Information Privacy Principle 3 requires. It is general information, not legal or compliance advice.

Action plan

1 Cover what Information Privacy Principle 3 requires The Privacy Commissioner's own guidance lists the specific matters the individual needs to be aware of.

Information Privacy Principle 3 requires that where your firm collects personal information directly from a client, it takes reasonable steps to ensure the client is aware of: the fact that information is being collected and its purpose; the intended recipients of the information; your firm's identity and address; whether collection is authorised by law and whether providing the information is voluntary or mandatory; the consequences, if any, of not providing part or all of the requested information; and their rights of access to and correction of that information.

  • Tell the client what's being collected, why, and who will receive it
  • Tell the client whether providing the information is voluntary or mandatory, and any consequences of not providing it
  • Tell the client about their rights of access to and correction of the information

Done when: The client has been made aware of every matter Principle 3 requires

Privacy Commissioner: Information Privacy Principle 3
2 Give the notice before collection, or as soon as practicable after Timing matters as much as content under Principle 3.

Principle 3's steps are required to be taken before the information is collected, or if that's not practicable, as soon as practicable afterwards. Build this into the collection step itself rather than treating it as optional follow-up.

  • Give the notice before collection wherever practicable
  • Where that's genuinely not practicable, give it as soon as practicable afterwards
  • Don't treat the notice as optional correspondence to send later

Done when: The notice was given before collection or as soon as practicable afterwards

Privacy Commissioner: Information Privacy Principle 3
3 Know that the exceptions to notice are narrow Skipping the notice is the exception, not a general option, and needs a genuine reason.

There are limited circumstances where these steps aren't required, such as where non-compliance wouldn't prejudice the individual, where it's necessary for law enforcement purposes, or where compliance genuinely isn't reasonably practicable. Treat these as narrow exceptions requiring a real reason, not a general opt-out.

  • Only rely on an exception where a genuine, specific reason applies
  • Don't treat inconvenience alone as making compliance impracticable
  • Record the reason relied on if a notice is genuinely not given

Done when: Any decision not to give notice was based on a genuine, documented exception, not general convenience