On 1 May 2026, a new principle is being introduced to New Zealand’s Privacy Act 2020 called the Information Privacy Principle 3A (IPP3A).

IPP3A is about transparency and accountability. The change being introduced means businesses now have an obligation to notify individuals when they collect personal information indirectly (that is from someone other than the person), unless an exception applies.

You will be required to:

• inform customers clearly
• update your processes
• keep records of customer notifications.

Taking action now will ensure your business stays compliant and maintains trust with your customers.

What is the IPP3A?
The purpose of the IPP3A is to make individuals aware that their personal information is being held by agencies they don’t have a direct relationship with.

Centrix is governed by the Credit Reporting Privacy Code (CRPC) and in late March 2026, the Privacy Commissioner updated the CRPC to incorporate IPP3A with a new Rule 3A that applies when credit information is collected by Centrix in its credit reporting business.

What this means for Centrix customers
When you use Centrix credit reporting services, you supply personal credit information to us and this is an indirect collection by Centrix.

IPP3A and Rule 3A comes into effect on 1 May 2026. Centrix does not have a direct relationship with your customers whose credit information you share with Centrix. So that Centrix can comply with the new obligation, Centrix requires subscribers to take steps to notify customers of Centrix’ collection of their personal information before that information is shared with us.

Advising your customers or individuals

The process of advising individuals is straightforward::

• notify them that their information will be shared with Centrix
• • advise them that Centrix may use or share their information in accordance with its Privacy Statement
• • provide a link or a copy of the updated Centrix Privacy Statement
• • inform them of their rights to access or correct their information.

You must keep evidence that notifications have been provided to the individuals.

To help you notify your customers, we’ve included suggested wording below. There is also helpful information on the Privacy Commissioner website here.

Suggested wording*
“We provide your personal information to Centrix Credit Bureau of New Zealand when we use their consumer credit reporting services (e.g. for credit checking).

Details of how Centrix handles your personal information can be found in its Privacy Statement.

Centrix will collect your credit information for the purpose of providing credit reporting services. You have a right to access and correct your credit information and any other personal information held by Centrix in accordance with the Privacy Statement.”

*Please note, this is a guide only and relates to personal information you may share with us when using our credit reporting services. You remain responsible for ensuring your wording meets your legal obligations.

Your notification obligations
Your notification obligations to ensure Centrix complies with this new requirement are set out in this updated Supply of Centrix Services Agreement document.

We recommend you update your current customer onboarding policies, privacy and consent wording, and your terms and conditions to ensure you comply with the new requirements.

Checklist

✔ Update your onboarding

• Add clear information about the privacy notifications process.
• Ensure your customers understand how their information will be used.

✔ Review and update your terms and conditions

• Reference credit reporting and data sharing with Centrix
• Include consent language where required.

✔ Train your team

• Make sure your team understands when and how to provide notifications.

✔ Keep documentation

• Implement a system to record and store evidence of notifications.

Resources

• Centrix Privacy Statement
• Updated Supply of Centrix Services Agreement
• The IPP3A explained by The Office of the Privacy Commissioner

For more information or support
If you have questions or need support understanding this change, please contact helpdesk@centrix.co.nz