Consent and Contact: The Rules Before You Call a Lead

A purchased lead is a record, and contacting it is regulated conduct. The consent, channel and timing rules for both markets in one place.

The short version

The rules differ by channel more than by country. Voice, SMS and email are governed by different instruments in both markets.
Australia has a Do Not Call Register and detailed ACMA consent-record expectations. New Zealand has neither, which places more weight on being able to show what the consumer was told.
In both markets the privacy obligation attaches to you as an indirect collector: IPP 3A in New Zealand, APP 5 and APP 7 in Australia.
Consent given to your supplier is not automatically consent given to you. What the supplier's form said about onward supply is the artefact that decides it.

Consent gets treated as a single yes-or-no property of a lead. It is closer to a set of permissions, each attached to a channel, a sender and a purpose, and a record can be well-consented for one and poorly consented for another.

This is the side-by-side. It describes published law and regulator guidance rather than advising on your situation.

Which rules apply to which channel?

Channel	New Zealand	Australia
Voice call	No do-not-call register. Privacy Act IPP 3A applies	Do Not Call Register Act 2006; consent needed for listed numbers
SMS	Unsolicited Electronic Messages Act 2007	Spam Act 2003
Email	Unsolicited Electronic Messages Act 2007	Spam Act 2003
Any of them, as data handling	Privacy Act 2020, IPP 3A, IPP 9, IPP 11	Privacy Act 1988, APP 5, APP 7, APP 11

The row that surprises brokers most is the first. New Zealand has no call register, so a voice call to a consumer who submitted an enquiry sits on ordinary footing, while the same call in Australia may require checking the number and holding consent.

What does consent have to cover?

Three properties, and a consent that is strong on one can be weak on another.

The sender: who the consumer agreed to hear from, which is the property that fails most often on purchased data
The channel: agreeing to a call is not agreeing to marketing emails
The purpose: agreeing to be contacted about a specific enquiry is narrower than agreeing to general marketing
The time: consent given minutes ago is a stronger basis than consent given last year, and ACMA names reliance on old consent as non-compliant

The one question that resolves most of it: What did the form tell the consumer would happen next? If it said their enquiry goes to a licensed adviser or broker who will contact them, your first contact is within what they agreed to. If it was silent, you are relying on wording you have never read.

What are the ACMA record-keeping expectations?

For Australia these are published and specific. Businesses must keep reliable, well-maintained consent records including the method used to provide consent, the terms of that consent, and the date and time it was obtained. ACMA can require production of those records if it receives complaints.

ACMA also names practices it treats as non-compliant: placing contact details on marketing lists without consent, using old consent, requiring consumers to log in to an account in order to unsubscribe, and inferring consent from a one-off purchase.

Method: How the consent was given
Terms: What exactly was agreed to
Timestamp: The date and time it was obtained

What does the privacy layer require?

In New Zealand, IPP 3A applies because you collected personal information about the individual from a source other than that individual. You must take reasonable steps to make them aware that you hold it, the purpose, your identity, the intended recipients, and their access and correction rights.

In Australia, APP 5 requires notification at or before collection, and APP 7 restricts direct marketing on third-party-collected data unless the APP 5.1 notification named direct marketing as a purpose. The OAIC guidelines name third-party lead generation explicitly, and add an obligation to make the individual aware of their right to opt out.

What does a compliant first contact look like?

The same call works in both markets, which is convenient, because a script that varies by jurisdiction is a script that will be got wrong.

Identify yourself and your firm at the start, by name
Say how you came to hold their details, naming the brand they enquired through
Confirm what they were asking about, in their words rather than yours
Make it easy to end the conversation, and honour that immediately if they do
Record that you did all of it, because an unevidenced step is one you cannot rely on later

How Lead Foundry answers this: The consumer is told on the form that their enquiry goes to a licensed adviser who will be in touch, and enquiries reach you within minutes of submission. That means the consent you rely on is both specific about onward supply and recent.

Do I need consent to call a purchased lead?

In New Zealand there is no do-not-call register, so a voice call to a consumer who submitted an enquiry does not require separate call consent, though IPP 3A still requires you to make them aware you hold their details and why. In Australia a telemarketing call to a number on the Do Not Call Register requires the recipient's consent, so the position depends on the number and on what consent your supplier holds.

Can I email or text a lead I bought?

Only with a consent basis that covers you as the sender for that channel and purpose. New Zealand applies the Unsolicited Electronic Messages Act 2007, requiring consent, accurate sender identification and a functional unsubscribe. Australia applies the Spam Act 2003, with ACMA expecting consent records showing method, terms and timestamp.

How recent does consent need to be?

There is no fixed statutory expiry in either market, but age weakens the basis and ACMA explicitly names reliance on old consent as a non-compliant practice. Enquiries delivered within minutes of submission carry consent that is both specific and fresh, which is one of the practical arguments against buying aged data.

What should I say at the start of a first call?

Identify yourself and your firm, say how you came to hold their details by naming the brand they enquired through, confirm what they were asking about in their own words, and make ending the conversation easy. That sequence satisfies the awareness obligations in both markets and also produces a better call, since it reminds the person why they are speaking to you.