Retailers collect more personal information than most realise — CCTV, loyalty programmes, online transactions, and increasingly biometric systems. Each carries obligations, and the enforcement environment has tightened.
CCTV is personal information
Footage of identifiable people is personal information under the Privacy Act 2020. That means:
- Collect for a lawful purpose connected to your functions — loss prevention and staff safety qualify.
- Notify people that it is in operation, with signage that is actually visible.
- Hold it securely, with access restricted to those who need it.
- Retain no longer than necessary, with a defined period and actual deletion.
- Provide access if an individual requests footage of themselves, subject to limited grounds for refusal — including where it would disclose someone else’s information.
That last obligation surprises retailers. A person can ask for footage of themselves, and you need a process for handling it.
Publishing images is the serious mistake
Posting footage of suspected shoplifters to social media, or sharing it in retailer groups, discloses personal information. It can breach the Privacy Act, and it can defame someone who turns out to be innocent or misidentified.
The consequence typically exceeds the value of the goods by a wide margin.
Provide footage to police. Do not publish it. Where retailers share offender information through an organised scheme, that scheme needs privacy compliance designed into it rather than bolted on.
Facial recognition is now fully regulated
The Biometric Processing Privacy Code came into force on 3 November 2025 for new collection, and the transition period for organisations already using biometric systems ended on 3 August 2026.
The Code applies where biometric information is collected for processing by an automated system — facial recognition for loss prevention sits squarely within it.
The central requirement is a proportionality assessment: the organisation must be satisfied the benefit is proportionate to the privacy intrusion, and must have genuinely considered whether a less intrusive alternative would achieve the same result. That is a documented assessment, not a conclusion.
Specific notification and transparency obligations apply, and some uses are restricted outright. Signage saying the area is under surveillance does not describe biometric processing — that is a different disclosure.
Loyalty programmes and customer data
A loyalty programme collects purchase history, which is personal information and can be revealing.
Obligations: collect what you need for the stated purpose, tell people what you are collecting and why, hold it securely, and do not use it for purposes unrelated to what was disclosed.
Note also that IPP 3A, in force since 1 May 2026, adds a notification obligation where personal information is collected indirectly — which catches retailers who buy marketing lists or enrich customer records from third-party data providers.
Staff monitoring
CCTV that captures staff is monitoring of employees, which engages employment obligations alongside privacy ones.
Covert monitoring is very difficult to justify and should not be undertaken without advice. Overt monitoring requires notification, a legitimate purpose, and proportionality — cameras in areas where staff have a reasonable expectation of privacy are not defensible.
Biometric time clocks engage the Biometric Processing Privacy Code and employment consent issues together. Consent given under the implicit condition of keeping a job is weak, so a genuine alternative for employees who object is the practical answer.
Breach obligations
Where a breach has caused or is likely to cause serious harm, you must notify the Privacy Commissioner and affected individuals as soon as practicable.
The Office received approximately 1,093 breach notifications and 1,598 complaints in the year to 30 June 2025, and has confirmed intent to issue compliance notices where information was not adequately protected.
The safety point underneath
Loss prevention policy should start from your health and safety duty to staff, not from the criminal law. Violence and aggression from customers is a recognised workplace hazard.
A policy expecting staff to physically intervene in a theft increases the risk of assault to those staff. The consensus in loss prevention is observe, record, report — do not intervene physically. Stock is insurable; serious assault is not.
The Office of the Privacy Commissioner publishes CCTV and biometrics guidance free at privacy.org.nz, and WorkSafe publishes guidance on managing violence and aggression at work.
Figures: Office of the Privacy Commissioner Annual Report, year ending 30 June 2025. Biometric Code transition ended 3 August 2026. General information only, not legal advice.
