When the Privacy Act changed in May 2026, one new Information Privacy Principle flew a little under the radar.

It's called Information Privacy Principle 3A, and although the name isn't particularly memorable, the practical effect is.

In simple terms, if your business collects personal information about someone from another source instead of directly from them, you may now have an obligation to tell them.

For many businesses, that's a change worth understanding.

What does "collecting information indirectly" mean?

It simply means obtaining personal information from someone other than the individual concerned.

For example:

speaking to a job applicant's referee
confirming qualifications with a training provider
obtaining a credit report
verifying information with a previous lender
contacting trade references before offering a business credit account
receiving information from a professional registration body.

None of these situations are unusual. In fact, they're part of everyday business.

The difference now is that businesses need to think not only about whether they're allowed to collect the information, but also whether they need to tell the individual that they've done so.

Recruitment is an obvious example

Imagine you're recruiting a new employee.

You contact two referees and verify the applicant's qualifications before making an offer.

Under the new principle, you don't necessarily have to send the applicant an email saying, "We've just spoken to your referee."

However, if your recruitment process already explains that you'll collect information from referees, previous employers, qualification providers and other relevant sources, you've probably already met the notification requirement.

That's one reason it's worth reviewing your employment application forms and recruitment privacy statements. If you need help with that, we recommend contacting our friends over at Epic People.

The same applies when lending money

Finance companies and lenders regularly obtain information from third parties when they’re assessing your business loan application.

That might include credit reporting agencies, identity verification providers, banks, accountants or other organisations involved in assessing an application, and for verifying your identity and complying with anti-money laundering laws.

Again, the Privacy Act doesn't necessarily require a separate notification every time information is obtained.

If you have already been told, through your business loan application process or the privacy statement you’ve signed, where information may be obtained from and why, the lender has likely addressed the new requirement.

Don't forget about trade credit

Many businesses don't think of themselves as "credit providers", but if you allow customers to buy now and pay an invoice later, you probably are.

Before approving a credit account, it's common to:

obtain trade references;
carry out a credit check on the business and it’s owners;
verify business ownership; or
confirm other information supplied by the applicant.

These activities may involve collecting personal information indirectly, particularly where sole traders, partnerships or company directors are involved.

It's another reason to make sure your credit application forms and privacy statements clearly explain what checks may be carried out and where information may be obtained from.

The good news

The purpose of the new rule isn't to create unnecessary paperwork.

In fact, the Privacy Act recognises that if you've already explained your information collection practices up front, you generally won't need to notify people every time you collect information from another source.

That's good news for businesses, because it means the focus is on being transparent, not on sending endless notifications.

A good time for a privacy health check

If your business hasn't reviewed its privacy notices in the last few years, now is a good opportunity.

Ask yourself:

Do our employment application forms explain what information we'll obtain during recruitment?
Do our finance or credit applications explain what third-party checks we'll carry out?
Do our privacy statements reflect how we actually collect information today?
Are we relying on old wording that predates the introduction of Information Privacy Principle 3A?

A few small updates now could help ensure your business stays compliant while also giving customers, applicants and employees greater confidence in how their personal information is handled.

Privacy compliance isn't just about avoiding complaints. Done well, it's another way of demonstrating that your business is transparent, professional and trustworthy.

For a long time, there was an assumption in business that bigger automatically meant better.

If you wanted quality accounting advice, you went to a major firm. If you needed HR consulting, infrastructure maintenance, or professional services, you looked for the company with the biggest office, the most staff, and the strongest brand recognition.

But I think that mindset is starting to shift — particularly in the current economic climate.

I was recently speaking with someone who was being made redundant from a large infrastructure and maintenance company that had been around for decades. From the outside, it looked like a successful, established business. But financially, things were becoming increasingly difficult.

The issue wasn’t poor workmanship or a lack of expertise. The issue was overheads.

Large office buildings, layers of management, finance teams, HR departments, admin staff, expensive software systems, high base salaries — the company had become incredibly expensive to run. Smaller competitors, meanwhile, were operating with leaner structures and far lower fixed costs, which meant they could compete far more aggressively on price.

And right now, price matters.

Businesses everywhere are tightening spending and becoming much more selective about where their money goes. That’s forcing many people to rethink an old assumption: do you really need a big company to get great service?

Increasingly, the answer seems to be no.

In fact, there are some very good reasons why smaller businesses are becoming more attractive than larger organisations.

Better pricing without the corporate overhead

This is the obvious one, but it matters.

Large organisations have enormous operating costs. Those costs need to be recovered somewhere, and ultimately, they get passed on to clients through higher fees and pricing.

Smaller businesses simply don’t carry the same financial weight. They often operate with leaner teams, smaller offices, remote working arrangements, and less internal bureaucracy. That allows them to price their services far more competitively without necessarily sacrificing quality.

For many clients, particularly in tougher economic conditions, that difference is becoming hard to ignore.

Closer working relationships

One of the biggest advantages of working with a smaller business is the relationship itself.

You’re often dealing directly with the owner or the senior person doing the work, rather than being handed between multiple departments or account managers. Communication tends to be quicker, simpler, and more personal.

Smaller businesses also tend to invest more heavily in relationships because every client genuinely matters to them. They take the time to understand your business, your goals, and the challenges you’re facing.

That creates a level of trust and familiarity that can sometimes get lost in larger organisations.

Faster decision-making

Large businesses can become slow simply because of their size.

Even relatively straightforward decisions often need approvals, meetings, internal sign-offs, or multiple layers of communication. That can frustrate clients who just want things done efficiently.

Smaller businesses are usually much more agile. Decisions can be made quickly, changes can happen faster, and problems can often be solved on the spot rather than disappearing into a corporate process.

In today’s environment, speed and responsiveness are incredibly valuable.

We often find that the lenders we work with when looking for business loans for our clients, that the smaller lenders make the fastest decisions.

More flexibility

Smaller businesses are often far more adaptable than larger firms.

Big organisations typically rely on standardised systems and rigid processes because that’s how they maintain consistency across large teams. The downside is that clients can sometimes feel forced into a one-size-fits-all approach.

Smaller operators generally have more freedom to tailor their services, pricing, and solutions to suit individual clients. They can pivot quickly, customise their approach, and respond to changing needs without layers of internal complexity getting in the way.

That flexibility can make a huge difference, particularly for small and medium-sized businesses looking for practical solutions rather than corporate process. Again we find that the smaller invoice finance lenders are much more flexible in their approach than the larger lenders.

You’re often getting the same expertise anyway

One of the more interesting shifts in recent years is that many small businesses are now being run by people who came directly out of large organisations.

The senior accountant who spent 15 years at a top-tier firm starts their own practice. The experienced consultant leaves the large corporate environment and sets up independently. The specialist project manager branches out on their own. It’s what our friends over at Epic People did.

In many cases, clients are getting exactly the same level of expertise — just without paying for the massive corporate structure sitting behind it.

That’s changing how people think about value.

Better accountability

In a smaller business, reputation is everything.

Owners and staff know that client satisfaction directly impacts referrals, repeat business, and future growth. There’s usually a much stronger sense of personal accountability because the business doesn’t have the luxury of hiding behind a large brand name.

When problems arise, smaller businesses are often quicker to respond and more motivated to resolve issues properly because they know relationships matter.

That level of accountability can be refreshing.

Less bureaucracy and less fluff

Most people have experienced the frustration of dealing with unnecessary corporate process.

Lengthy approval chains, endless meetings, generic customer service systems, and layers of administration can make even simple tasks feel complicated.

Smaller businesses tend to cut through much of that.

There’s often less jargon, fewer formalities, and more focus on simply getting good work done efficiently. Clients appreciate that practicality, especially when time and budgets are tight.

Technology has levelled the playing field

Twenty years ago, large organisations genuinely had significant advantages when it came to systems, infrastructure, and access to technology.

That gap has narrowed dramatically.

Cloud software, AI tools, remote work technology, automation, and online platforms have made it possible for small businesses to operate incredibly efficiently and professionally. A boutique accounting practice can now use the same software systems as a multinational firm. A small consultancy can work with clients nationwide without needing expensive offices around the country.

As a result, professionalism is no longer determined by company size.

Final thoughts

None of this means large businesses are suddenly obsolete. There will always be industries and projects where scale, infrastructure, and large teams are important.

But the automatic assumption that “bigger is better” is definitely fading.

In many cases, smaller businesses are proving they can deliver the same expertise, stronger relationships, greater flexibility, and better value — all without the heavy overheads that large organisations carry.

And in an economy where businesses are watching costs more closely than ever, that’s becoming a very compelling proposition.

A new Privacy Act requirement that could affect almost every business