Privacy Act 2020 (NZ) | Privacy Amendment Act 2025 (NZ)
Effective: 1 May 2026
Introduction
The Malaghan Institute (the Institute) is committed to protecting your privacy. This outline explains what personal information we collect when you apply for a role with us, how we use it, and what your rights are.
This outline reflects New Zealand's Privacy Act 2020, including the new Information Privacy Principle 3A (IPP 3A) that came into force on 1 May 2026. IPP 3A means we must now tell you when we collect information about you from someone other than yourself.
Who this covers
This outline applies to anyone going through our recruitment process, including:
- People applying for jobs (from inside or outside the Institute)
- Candidates we approach directly or through a recruitment agency
- Referees and people asked to provide references
- Contractors, students, and interns
What information we collect
Information you give us directly
When you apply for a role, we usually collect:
- Your contact details (name, address, phone, email)
- Your CV and cover letter
- Qualifications, certifications, and professional memberships (where relevant)
- Your right to work in New Zealand (where relevant)
- Your answers to application questions or assessments
- Notes from interviews and evaluations
Information we collect from others (IPP 3A notice)
From 1 May 2026, we are required to tell you when we collect information about you from a third party. If we do this, we will let you know as soon as we reasonably can. We may collect information from:
- Referees – people you nominate such as former managers or colleagues
- Recruitment agencies – candidate profiles and notes they share with us
- Background check providers – criminal record checks (NZ Police vetting), identity checks, and credential checks (where relevant)
- Professional bodies – confirmation of your registration or any disciplinary history (eg Medical Council of NZ) (where relevant)
- LinkedIn or other public professional profiles
- Previous employers – to verify your employment history, with your permission
When we collect information about you from others, we will tell you: what was collected and where from, why we collected it, who might see it, whether any law requires us to collect it, and your right to access or correct it.
Why we collect your information
We collect your information to:
- Assess whether you are suitable for a role at the Institute
- Check the accuracy of what you have told us
- Carry out background, reference, and credential checks
- Keep you updated about your application
- Meet our legal obligations as an employer
- Keep equal employment opportunity (EEO) records
- Consider you for future roles, if you agree to this
We will not use your information for anything unrelated to recruitment unless you agree, or we are required to by law.
Our legal basis for collecting your information
We collect your information under the Privacy Act 2020. Some collection is also required by other laws, including:
- Employment Relations Act 2000
- Immigration Act 2009 (to check your right to work)
- Health and Safety at Work Act 2015 (for pre-employment health checks where needed)
- Criminal Records (Clean Slate) Act 2004 (for criminal record checks on certain roles)
If a law requires or allows us to collect your information indirectly, we will tell you which law when we notify you.
How we keep your information safe
We take reasonable steps to protect your information from loss, misuse, or unauthorised access. This includes:
- Your information is stored in BambooHR, our HR platform. BambooHR's data centre is in Ohio, USA – this means your information is held overseas. We rely on BambooHR's GDPR-compliant data processing agreements to ensure your information is protected to a comparable standard
- Access to BambooHR is limited to HR staff and managers directly involved in your recruitment – no one else can see your records
- Password protection and encryption of digital files
- Secure handling and disposal of any physical documents
- Requiring any third parties we work with (e.g. recruitment agencies) to follow equivalent privacy standards
We keep recruitment records for up to 12 months after a recruitment process ends. After that, we securely delete them – unless the law requires us to keep them longer, or you have agreed to us holding your information for future roles.
Who we share your information with
We may share your information with:
- Our recruitment panel and relevant managers
- Our recruitment agency or search firm (if we use one)
- Professional registration bodies (to verify your credentials)
- Government agencies where the law requires it (eg Immigration New Zealand)
We do not sell or trade your information. We only share it overseas if we have to (for example, if a background check provider operates internationally), and we make sure your information is protected when we do.
Your rights
Under the Privacy Act 2020, you can:
- Ask to see the information we hold about you
- Ask us to correct anything that is wrong, incomplete, or misleading
- Ask how your information is being used
- Withdraw your consent at any time if we are relying on it
To do any of these, contact our HR team. We will get back to you within 20 working days. In some cases we may not be able to share certain information – if so, we will let you know why.
If something goes wrong
We take privacy breaches seriously. If something happens that puts your information at risk of serious harm, we will notify you and the Office of the Privacy Commissioner within 72 hours of finding out, as required by the Privacy Act 2020.
Get in touch
If you have questions about this outline, want to access or correct your information, or want to make a complaint, please contact:
Human Resources
Malaghan Institute of Medical Research
Gate 7, Kelburn Parade, Wellington 6012, New Zealand
[email protected]
+64 4 499 6914
If you are not happy with how we handle your complaint, you can contact the Office of the Privacy Commissioner at privacy.org.nz or call 0800 803 909.
Updates to this outline
We review this outline at least once a year, or sooner if the law or our practices change. The latest version will always available on request or on our website.
Last updated May 2026