NZ Privacy Act IPP 3A (2026): Ditch 3rd-Party Data for POS

Why hospitality and salon owners should move away from third-party customer data and bring bookings, ordering, and loyalty into an all-in-one POS CRM.

Are you exhausted by paying steep commissions to third-party delivery and booking apps that hold your customer relationships hostage? For years, the standard workaround for New Zealand hospitality and wellness owners was simple: export a CSV file of guest details from a booking marketplace, delivery aggregator, or guest Wi-Fi portal, upload it into an email or SMS tool, and run your own promotions.

Since May 1, 2026, that exact workaround has become a major legal headache. Navigating IPP 3A compliance rules in New Zealand is now an everyday operational reality for local hospitality and service business owners.

When New Zealand's Privacy Amendment Act 2025 took effect on May 1, 2026, it introduced Information Privacy Principle 3A (IPP 3A). This rule targets the indirect personal data collection that NZ businesses rely on when pulling customer profiles from third-party platforms. If you import customer contact details from an external app to market to them directly, you now need to take reasonable steps to make sure those people know you have their information, why, and who holds it, unless an exception applies (for example, they were already told). A complaint could lead to a Privacy Commissioner investigation, a compliance notice or a claim at the Human Rights Review Tribunal.

The good news? You do not need a law degree or hours of weekly admin to stay compliant. In this guide, you will learn how IPP 3A impacts your daily operations, why third-party data has become a double tax on your margins, and how switching to a first-party customer data POS system simplifies your compliance obligations while helping you grow repeat revenue.

What is First-Party vs. Third-Party Data in Hospitality?

To understand why the May 2026 privacy changes matter to your bottom line, we first need to separate how customer information enters your business. Every phone number, email address, dietary note, or massage consultation record you hold falls into one of two legal buckets.

First-Party Data (Direct Collection under IPP 3)

First-party data is information you collect directly from the customer through your own branded channels. Under the Privacy Act 2020, direct collection is governed by Information Privacy Principle 3 (IPP 3).

Examples of first-party data in action include:

• A regular at your cafe scanning a counter QR code to add your digital stamp card to their Apple Wallet (Premium plan).
• A diner booking a Friday night table directly through the reservation widget on your restaurant's website.
• A food truck customer placing a pre-order on your branded online ordering page.
• A client filling out an intake profile directly on your salon's iPad POS at reception.

Because the customer gives their details directly to your business, a clear privacy statement at sign-up covering the IPP 3 matters (what you collect, why, who will hold it, and their right to access and correct it), plus marketing consent, takes care of your notice obligations.

Third-Party and Indirect Data (Regulated by IPP 3A)

Indirect data is personal information you collect from someone other than the customer themselves. Under the Privacy Amendment Act 2025 update that took effect in May 2026, this is now policed by IPP 3A.

According to the Ministry of Justice, the Privacy Amendment Act 2025 received Royal Assent on 23 September 2025, its IPP 3A changes came into force on 1 May 2026, and it is designed to help New Zealand keep its EU adequacy status.

Under the official Office of the Privacy Commissioner guidance on IPP 3A, any business that collects personal information indirectly from another source must take reasonable steps to ensure the individual is aware of:

1. The fact that their information has been collected.
2. The specific purpose for which it was collected.
3. The intended recipients of the information.
4. The name and address of both the agency collecting the data and the agency holding it.
5. Which law authorises or requires the collection (if applicable) and the individual's right to access and correct their data.

Unless an exception applies, you must take reasonable steps to inform the customer as soon as reasonably practicable after receiving their details.

What to do right now: Open your email marketing tool, SMS platform, or current customer spreadsheet. Identify every source feeding contacts into that list. If those contacts did not type their details directly into a system owned and branded by your venue, flag that data source for an immediate IPP 3A review.

How Third-Party Delivery and Booking Apps Hurt Your Margins (And Create an IPP 3A Trap)

Most venue owners already know the financial sting of aggregator platforms. Delivery apps take a cut of every order, while marketplace booking directories charge steep commissions on new clients or per-cover fees on diners. Worse still, these platforms use your hard-earned order history to cross-promote competing restaurants and salons in your neighbourhood.

Since May 2026, these platforms also represent a double tax: first they take your margin, and then they expose you to delivery aggregator customer data risks.

The "Don't Assume Notice" Compliance Trap

Here is how local business owners accidentally trip up: You use a third-party table booking directory, a salon marketplace, or an external Wi-Fi harvesting plug-in. At the end of the month, you export those customer names, phone numbers, and emails into your marketing software to send out a winter special.

You might assume that because the customer ticked a "Terms & Conditions" box on the booking app, you are legally covered. You may not be.

Under IPP 3A, the responsibility to make sure the individual is notified sits with the agency collecting the data indirectly. You should not assume that a third-party platform has already provided the required IPP 3A notice covering your specific business and marketing purpose unless you have verified their disclosures.

In reality, third-party aggregators write their privacy policies to protect their right to market to the customer, not yours. When you pull data out of a marketplace app to use for your own independent marketing or CRM profiling, you are collecting that data indirectly for a new purpose.

As commercial privacy specialists at Bell Gully point out, businesses that rely on personal information gathered via third parties face a complex compliance exercise requiring careful review of indirect sources, updated privacy statements, and checks on supplier terms.

What to do right now: Stop manually exporting CSV customer lists from third-party booking marketplaces, event ticketing sites, or delivery platforms into your marketing tools. If you cannot verify that the third-party app explicitly notified the customer of your business name, address, and marketing purpose at sign-up (and obtained marketing consent), do not send them promotional blasts.

Benefits of an Integrated POS CRM System: The IPP 3 Shortcut

How does a busy cafe, restaurant, food truck, or salon owner avoid auditing third-party contracts and sending follow-up legal notices? You use the IPP 3 Shortcut.

When you ditch third-party data aggregators and use an all-in-one POS with built-in Customer Management (CRM), Online Ordering, Bookings, and Loyalty (Premium plan), you change the legal nature of your data collection. Instead of collecting data indirectly via a middleman (IPP 3A), you collect it directly from your guest (IPP 3).

Feature / Risk Factor	Third-Party Marketplaces & Add-Ons (IPP 3A)	Native Lazygrid POS CRM (IPP 3)
Primary Legal Rule	IPP 3A (Indirect Collection Rules)	IPP 3 (Direct Collection Rules)
Post-Collection Notice Required?	Yes, as soon as reasonably practicable (unless an exception applies)	Handled via your privacy statement at sign-up
Commission / Fee Structure	High order commissions and marketplace fees	Small per-order commission (can be passed on to customer); flat NZ$0.50 or NZ$1.00 per booking
Who Owns the Customer Relationship?	The marketplace app	Your business
Cross-Promotion Risk	Competitors advertised to your guests	Zero competitor ads; 100% your brand

Instead of duct-taping separate apps together, evaluating add-on vs all-in-one POS systems in NZ shows how consolidating your tech stack reduces the number of third-party data handoffs. With Lazygrid POS running on iPads or iPhones you already own, every transaction, direct booking, and loyalty scan feeds straight into one first-party hospitality customer database.

What to do right now: Map out how many separate software logins your staff use each shift. Consolidating your till, online ordering, table reservations, and loyalty programme (Premium plan) into a single cloud-based POS removes the third-party data handoffs that trigger IPP 3A.

Tailored Compliance Playbooks for 4 NZ Industries

Every hospitality and service vertical collects customer data differently. Here is how IPP 3A affects your specific operation and how to transition to cleaner direct collection.

1. Restaurants: Table Bookings, QR Codes, and Takeaway

Full-service restaurants often leak customer data in two places: third-party reservation directories and delivery apps. When a guest books through a dining marketplace that charges per-cover fees, that platform controls the primary diner profile.

Instead, you can capture booking data by using Lazygrid's integrated Booking System and Reserve with Google in NZ for direct bookings (Premium plan). Rather than paying steep per-cover percentages, Lazygrid charges a flat, small per-booking fee of just NZ$0.50 or NZ$1.00 depending on your business type (including for Reserve with Google bookings). Diners can book with your venue from Google Search or Maps (Reserve with Google is included on the Premium plan), and automated SMS/email reminders help cut no-shows. Bookings made through your own widget land straight in your POS CRM. For Google bookings, make sure your privacy statement covers how booking details reach you.

For dine-in service, placing table-specific QR codes (Premium plan) on each table lets guests browse the menu and order when ready, helping you boost table turnover without rushing guests. For takeaway, switching to one of the best online ordering systems for NZ restaurants gives you a custom-branded ordering website synced in real time with your POS and Kitchen Display System (KDS). While third-party apps take high commissions, Lazygrid charges only a small per-order commission on online orders that you can easily pass on to the customer, keeping your margins intact and your customer data first-party.

2. Cafes: Guest Wi-Fi Traps and Morning Rush Kiosks

Many cafes use third-party "social Wi-Fi" portals that force customers to log in via social media or an external splash page, while the Wi-Fi provider harvests and shares that data across a wider marketing network. Under New Zealand privacy and hospitality marketing consent rules, importing leads from a third-party Wi-Fi broker without explicit, transparent disclosures is an IPP 3A risk.

During a chaotic 8:00 AM coffee rush, your barista does not have time to type customer names and emails into a till, nor can they hand out paper privacy notices. You can solve both counter congestion and direct data capture by setting up QR table ordering for NZ cafes (per-table QR ordering is on the Premium plan) or deploying a Lazygrid Self-Service Kiosk on an iPad at the counter.

Self-service kiosks let customers browse the full menu, customise orders and check allergen information at their own pace, which takes pressure off your counter during the rush.

3. Massage Clinics & Beauty Salons: The HIPC Rule 3A Update

If you own a massage clinic, day spa, or wellness business, privacy compliance requires extra care when you collect health-related information such as pregnancy status, skin allergies, medications, and injury histories.

Massage therapists and other businesses that provide health services may be health agencies under the Health Information Privacy Code 2020 (HIPC). Check with the Office of the Privacy Commissioner whether the code applies to you. In March 2026, the Privacy Commissioner issued Amendment No 2 to the HIPC, which came into force on 1 May 2026 alongside IPP 3A. Where the HIPC applies, this amendment inserted Rule 3A, regulating the indirect collection of identifiable health information.

When you rely on marketplace apps that charge hefty new-client commissions, untangling who holds those consultation notes is an administrative headache. By reviewing Fresha vs Kitomba vs Lazygrid salon POS costs in 2026, you can see how switching to Lazygrid's direct booking system (just NZ$0.50 or NZ$1.00 per booking) and integrated CRM keeps client preferences, service history, and digital gift cards inside your own first-party database.

4. Food Trucks: High-Speed Queues and Event Lists

Food truck operators often get offered attendee email lists from festival organisers, night markets, or corporate catering coordinators. Under IPP 3A, if you upload an event organiser's spreadsheet into your SMS tool, you need to make sure attendees know you have their details and why, unless the organiser's notice already covered this. You also need their consent under the Unsolicited Electronic Messages Act before sending marketing texts.

Instead, capture festival and street-food crowds directly using order pacing & scheduled pickup POS tools. Put a large QR code on your truck's A-frame sign linking to your branded Lazygrid online ordering page. Customers scan, pre-order from the queue, opt into your loyalty programme (Premium plan) directly, and get a notification when their food is ready.

Because Lazygrid is a live cloud POS that needs an active internet connection to take orders and payments (data cached on your iPad or iPhone stays viewable during an outage, but transactions cannot be processed offline), keeping your connection solid ensures you never miss a direct sale or loyalty sign-up. As detailed in our guide to connectivity for NZ food trucks and rural venues, trucks at regular spots with good mobile coverage should use a dedicated 4G/5G wireless broadband router (the cheapest reliable option), while trucks working poor-signal rural events can use Starlink Business from NZ$92/month for 50GB (more than enough for POS data, with NZ$449 one-off hardware that is sometimes free on promotion), reserving phone hotspots strictly for temporary emergencies.

What to do right now: Pick the playbook that matches your venue and replace your highest-risk indirect touchpoint this week. Swap out marketplace booking links on your Instagram bio and Google Business Profile for your direct Lazygrid booking or online ordering URL.

How to Build a Compliant Customer Loyalty Program

Running a profitable restaurant or salon loyalty programme under the Privacy Act 2020 comes down to transparency and clear opt-in. Traditional paper stamp cards are easily lost or forgotten and give you zero customer data. On the flip side, asking customers to download a clunky third-party loyalty app slows down your counter and hands your customer database to an external vendor.

Why an Apple Wallet Loyalty Program in NZ Wins

Lazygrid's integrated Loyalty Programme (Premium plan) uses Apple Wallet and Google Pay integration to give you direct, first-party data capture:

• Zero App Downloads: Customers scan a QR code on your counter, iPad customer display, or thermal receipt and add your branded digital stamp card or points pass straight to their phone's native wallet.
• Direct Sign-Up: Customers join your loyalty programme straight from your QR code, so make sure your sign-up screen includes your privacy statement and a marketing opt-in.
• Automated Retention: Track purchase history automatically, set up Bronze/Silver/Gold VIP tiers, and trigger automated "we miss you" vouchers or birthday rewards without ever exporting data to a third-party platform.
• Digital Vouchers & Gift Cards: Sell digital gift cards online or in-store that load into Apple Wallet and Google Pay, and invite recipients to join your loyalty programme directly when they redeem.

What to do right now: Retire your cardboard coffee cards and third-party loyalty tablets. Print your direct Lazygrid loyalty QR code (Premium plan) directly onto the footer of your EPSON or Xprinter thermal receipts so every paying guest can join your database on their own phone.

Best Practices for Securing Customer Data Inside Your POS

Once you collect customer data directly under IPP 3, Information Privacy Principle 5 (IPP 5) requires you to protect that database against unauthorised access, misuse, or staff leaks. Treating data security with the same discipline you apply to your NZ Food Control Plan verification audit checklist protects your reputation.

Follow these four practical steps inside your POS system:

1. Eliminate Shared Staff Passwords: Never let your entire team run the till under the owner's master login. Use Lazygrid's Staff Management features to create individual sub-accounts with PIN or password logins (Standard plans include 2 sub-accounts; Premium plans include 4 sub-accounts).
2. Use Role-Based Permissions: Give baristas, floor staff and junior therapists only the access they need, such as looking up a customer profile to apply loyalty points or check an allergy note.
3. Centralise Multi-Location Databases: If you operate multiple cafes, restaurants, or a fleet of food trucks, use Lazygrid's Multi-Location Management to keep all customer data inside one central cloud dashboard rather than emailing spreadsheets between store managers.
4. Keep Payments Certified and Segregated: Use EFTPOS NZ certified terminals (trusted by over 50,000 NZ merchants) and Stripe integration for online ordering so sensitive credit card numbers are tokenised and PCI-DSS compliant, never sitting in plain text in your CRM.

What to do right now: Log into your POS settings today, turn off shared counter logins, give each staff member their own PIN, and limit report access to management roles.

Frequently Asked Questions: NZ Privacy Act IPP 3A & POS CRM

What is IPP 3A in the New Zealand Privacy Act and when did it take effect?

Information Privacy Principle 3A (IPP 3A) is a rule introduced by the Privacy Amendment Act 2025 that took effect on May 1, 2026. It requires New Zealand agencies that collect personal information indirectly (through a third party rather than directly from the individual) to take reasonable steps to inform the person as soon as reasonably practicable about what data was collected, why it was collected, who holds it, and how they can access or correct it, unless an exception applies.

Does IPP 3A apply to my cafe, restaurant, or beauty salon if I use third-party booking or delivery apps?

Yes, if you extract, sync, or use customer personal information from those third-party platforms for your own independent purposes, such as building a marketing database, profiling regulars, or sending promotional emails and SMS blasts. If the data stays strictly inside the app only to fulfill that single order, the app manages the primary relationship; the moment you pull that data into your own system for your own purposes, IPP 3A obligations apply to you.

Can I assume a third-party booking platform has already notified customers under IPP 3A?

No. Under IPP 3A, the legal responsibility to take reasonable steps to notify sits with your business as the collecting agency, unless you can rely on an exception such as the individual having already been made aware of those specific matters. Do not assume a third-party marketplace or lead provider has notified the customer about your specific business and marketing purpose unless you have verified their disclosures.

What is the difference between direct collection (IPP 3) and indirect collection (IPP 3A) for hospitality marketing?

Direct collection (IPP 3) happens when a customer gives their details straight to your business, such as ordering on your branded POS website, scanning your Apple Wallet loyalty QR code (Premium plan), or booking via your direct widget. Indirect collection (IPP 3A) happens when another party collects the data first and you obtain it second-hand, requiring you to take reasonable steps to notify the individual after collection unless an exception applies.

Are massage clinics and beauty salons subject to stricter data rules in New Zealand?

Massage therapists and other businesses that provide health services may be health agencies under the Health Information Privacy Code 2020 (HIPC). Check with the Office of the Privacy Commissioner whether the code applies to you. If your business is a health agency under the HIPC, Amendment No 2 to the code also took effect on 1 May 2026, adding Rule 3A for health information collected indirectly.

How does switching to a POS CRM with built-in loyalty help me comply with NZ privacy laws?

Switching to an all-in-one POS CRM with native loyalty (Premium plan), online ordering, and bookings shifts your customer data collection from indirect (IPP 3A) to direct (IPP 3). Because customers enter their own details directly into your branded system or scan your QR code to add a pass to their Apple Wallet or Google Pay, you can present your privacy statement and marketing opt-in right at sign-up without needing post-collection notices.

What are the penalties for breaching IPP 3A or the Privacy Act 2020 in New Zealand?

If an individual files a complaint and the Office of the Privacy Commissioner investigates, your business can face compliance notices, public naming, or referral to the Human Rights Review Tribunal, which can award damages to affected individuals. Failing to comply with a formal Privacy Commissioner compliance notice or obstructing an investigation is an offence that carries fines of up to $10,000.

Does IPP 3A apply to customer lists I collected from third-party apps before May 1, 2026?

No, IPP 3A does not apply retrospectively to personal information collected before May 1, 2026. However, any new customer profiles, bookings, or order contacts you import, sync, or collect indirectly from third-party platforms on or after May 1, 2026 must follow IPP 3A rules, and all existing marketing lists must still comply with the Unsolicited Electronic Messages Act 2007 (anti-spam consent rules).

Can my cafe still offer guest Wi-Fi without triggering IPP 3A compliance headaches?

Yes, provided you do not import customer details from a third-party Wi-Fi marketing broker that harvests logins across multiple businesses. The cleanest approach is to offer simple password-protected Wi-Fi for guests and capture marketing opt-ins directly via table QR codes (Premium plan), or receipt QR codes linked straight to your POS loyalty programme (Premium plan).

How do digital gift cards and vouchers fit into IPP 3A when a customer buys one for a friend?

When someone buys a digital gift card for a friend, the recipient's email reaches you indirectly, so IPP 3A applies unless an exception does. Keep that email for delivering the gift, tell the recipient who you are and why you have their details (for example, in the delivery email), and invite them to opt into your loyalty programme directly when they redeem.

What happens to my customer database if I switch POS providers in the future?

Customer data you collect directly through your own Lazygrid POS CRM belongs to your business. You are the agency holding it under the Privacy Act. Ask our team about your data options before you switch.

Take Back Ownership of Your Customers and Your Margins

New Zealand's May 2026 IPP 3A privacy rules are a wake-up call for the hospitality and personal services industry. Relying on third-party delivery aggregators and booking marketplaces doesn't just eat into your revenue; it locks you out of owning your customer relationships and exposes you to unnecessary compliance admin.

By switching to an all-in-one POS CRM, you bring online ordering, table and appointment bookings, Apple Wallet loyalty (Premium plan), digital gift cards, and customer management under your own roof. You handle your NZ privacy notice obligations cleanly at the point of collection under IPP 3, protect your profit margins, and build a loyal customer database that belongs to your business.

For more practical guides on growing your venue, explore our latest POS tips and hospitality insights. Ready to bring online ordering and bookings in-house? Our Standard plan ($59/month) includes online ordering, bookings and gift cards, and Premium ($149/month) adds the loyalty programme, Reserve with Google and per-table QR codes. Get in touch with our Wellington-based Lazygrid team to see how easy it is to switch on the iPad or iPhone you already own.