The Biometric Processing Privacy Code was issued on 21 July 2025 and came into force on 3 November 2025 for new biometric collection. Organisations already processing biometric information were given a transition period.
That period ended on 3 August 2026. The Code now applies to existing biometric processing as well as new.
What the Code covers
The Code does not amend the Privacy Act. It modifies how the information privacy principles apply where an organisation collects biometric information for processing by an automated biometric system.
That framing is broader than most businesses expect. It captures:
- Facial recognition, including for loss prevention in retail.
- Fingerprint systems, including time clocks.
- Iris and other physical characteristic matching.
- Voiceprint identification, including in call centres.
- Biometric access control on buildings and equipment.
The common thread is automated matching of physical or behavioural characteristics to identify or verify someone.
The proportionality assessment is the core requirement
Before deploying biometric processing, an organisation must be satisfied the benefit is proportionate to the privacy intrusion, and must have genuinely considered whether a less intrusive alternative would achieve the same result.
That is a documented assessment rather than a conclusion. An organisation that deployed a system because it was convenient, and never considered alternatives, does not have one.
The Code also imposes specific notification and transparency obligations, and restricts certain uses outright.
What to check now
- Does anything you operate perform automated biometric matching? Including systems procured as a feature of something else — access control, rostering, security cameras with analytics.
- Is there a documented proportionality assessment, and did it consider less intrusive alternatives?
- Does your signage and notice actually describe biometric processing, or does it just say the area is under surveillance? Those are different disclosures.
- Where is the biometric data stored, who can access it, how long is it kept, and what triggers deletion?
- What does the vendor contract say about the vendor’s own use of the data?
Retail loss prevention is the live case
Facial recognition for retail crime prevention is where this most often arises commercially, and it sits at the intersection of several obligations.
Beyond the Code, CCTV footage is personal information under the Privacy Act — collected for a lawful purpose, notified, held securely, retained no longer than necessary, with access rights.
Publishing images of suspected shoplifters is where retailers get into serious difficulty. Posting footage to social media or sharing it in retailer groups discloses personal information, can breach the Privacy Act, and can defame someone who turns out to be innocent.
Provide footage to police. Do not publish it.
Employment uses carry their own issues
Fingerprint time clocks and biometric access control for staff engage the Code and employment obligations together.
Consent obtained from an employee under the implicit condition of keeping their job is weak consent. Where biometric systems are introduced, genuine consultation and a real alternative for employees who object are the practical answer.
Health and biometric information about employees should also be access-restricted rather than sitting in a general personnel file.
The wider privacy picture
The Office of the Privacy Commissioner received approximately 1,598 complaints and 1,093 breach notifications in the year to 30 June 2025, and has shown willingness to issue compliance notices — confirming intent to do so against two health sector organisations in May 2026.
Separately, IPP 3A came into force on 1 May 2026, adding a notification obligation where personal information is collected indirectly.
Both indicate an active regulator rather than a passive one.
Where to look
The Office of the Privacy Commissioner publishes the Biometric Processing Privacy Code, guidance on its application, and general privacy material free at privacy.org.nz. Its content is licensed for reuse with attribution.
Dates and requirements as at August 2026. Confirm current obligations with the Office of the Privacy Commissioner. General information only, not legal advice.
