Can an employer gather personal information on an employee without their knowledge?
Get In Touch
Pursuant to the provisions of The Privacy Act 2020, the primary means to gather information on an employee, is to obtain the information directly from the person themselves.
Outside of that, an employer should only gather information about an employee from other sources, with the prior consent of the employee.
To obtain information about any employee without their prior consent may amount to a breach of the Privacy Act and could also constitute an unjustified disadvantage.
Frequently Asked Questions.
What is Privacy Principle IPP 3A?
As of 1 May 2026, a major change to the Privacy Act 2020 came into effect relating to the gathering of information indirectly about an employee.
Principle IPP 3A now requires employers to advise an employee in advance that they will be collecting information about them from another party.
Within an employment context this now requires an employer who is implementing a disciplinary process to advice the accused employee in advance, that witness statements will be gathered from other parties. Similarly, in an investigation process, the accused employee will need to be advised the sources from which the investigator will be gathering information – including the complainant, third party sources or electronic recording devices such as CCTV. Other situations where information may be gathered includes during restructures and redundancies, in responding to personal grievances or in seeking to resolve disputes.
What must an employer specifically tell the employee about the information to be gathered?
Principle 1PP 3A requires that employers must take reasonable steps to tell the employee:
- that their information has been collected
- the purpose of the collection
- who will receive the information
- who collected and who holds it
- whether the collection is authorised or required by law (and which law)
- their rights to access and correct the information
This mirrors the existing IPP 3 requirements but extends them to indirect collection.
What are organisations expected to do now?
The Office of the Privacy Commissioner has stated that organisations must:
- identify where personal information is collected indirectly
- review their privacy notices and policies
- ensuring staff understand when notification is required
- update processes for complaints, referrals, investigations, and third-party information flows
What rights do employees have to access information gathered against them?
Principle IPP 6 of the Privacy Act 2020 confirms that an employee has a legal right to request access to all and any personal information the employer may hold about them.
This may include information held on:
- personnel and HR files
- performance reviews and disciplinary records
- investigation materials relating to the employee
- emails, notes, or correspondence referring to the employee
- payroll, leave, attendance, and benefit records
- CCTV footage, monitoring data, or recordings (where identifiable)
- managers’ notes or assessments about the employee
Where the employee makes a request for disclosure of personal information, the employer must provide the requested and available information within 20 working days of receiving the request.
However, in being requested to disclose such information the employer may decline the request where:
The disclosure would involve an unwarranted breach of another person’s privacy, such as:
- witness identities
- complainant details
- third-party personal opinions
- The release would pose a serious threat to life, health, or safety of any person
- The Information is protected by legal professional privilege (e.g. advice from the employer’s lawyer)
The Privacy Act 2020:
- does not give an employee a right to access information about other employees
- does not require employers to create new documents that don’t already exist
- does not override legitimate confidentiality or safety protections
What assistance can we get if we need advice about collecting information and/or we receive an information disclosure request?
This is an area of law that the Employment Relations Consultants at Russell Drake Consulting are frequently engaged to provide advice and assistance. Please feel free to contact us directly if you have any questions with respect to the gathering and use of an employee’s personal information or you receive an information disclosure request.