Hospitality and tourism businesses collect personal information constantly — guest bookings, staff onboarding, contractor vetting, and liquor-licence compliance. Much of it comes from third-party sources, which triggers IPP3A.
High-risk collection points
Staff and contractor screening. Reference checks, credit checks for finance roles, and driver licence verification through NZTA all involve third-party data. A generic employment agreement rarely records the pathway for each check.
Corporate and event bookings. Credit checks on new corporate accounts or large event deposits pull bureau data about authorised signatories — not just the company.
Liquor licence and duty manager checks. Verifying criminal record or licence status through external registers is third-party collection about identifiable individuals.
The publicly available trap
Some hospitality operators assume guest names on a booking platform or director names on the Companies Register are "public" and need no IPP3A step. The OPC's proportionate standard still expects documentation — especially when data is aggregated or used for a new purpose.
Practical steps
- List every third-party source used in HR, finance, and operations.
- Match each source to an IPP3A pathway before the lookup runs.
- Retain evidence for the retention period your policy requires — DEIS defaults align with common seven-year audit expectations.
DEIS is already used by accommodation groups and tourism operators who want one evidence trail across seasonal hiring spikes.