A short biometrics audit for every workplace, now the grace period is over

The Biometric Processing Privacy Code came into force on 3 November 2025 for new biometric processing. Organisations already using biometrics had a nine-month transition. That ended on 3 August 2026. Every biometric system in New Zealand, old or new, now has to comply.

Most organisations don’t think of themselves as using biometrics. Then someone mentions the fingerprint scanner at the staff entrance.

Where biometrics hide

• Fingerprint or face timeclocks and door access
• Security cameras with face recognition switched on, sometimes by default
• Identity verification apps that compare a selfie with an ID document during onboarding
• Voice verification on phone lines
• Online exam or interview software that analyses faces
• Visitor management systems that capture photos and match them

The ten-minute audit

For each system you find, answer four questions. If you can’t answer “yes” to all four with evidence, you have work to do.

1. Have we documented why it’s necessary and proportionate? The code requires an assessment weighing the privacy risks against the benefits. For a timeclock, ask honestly whether a card or PIN would do the job. If so, biometrics will be hard to justify.
2. Is there an alternative for people who don’t want to use it?
3. Do people get clear notice before or when their biometric information is collected?
4. Do we know where the templates are stored, who can access them, and when they’re deleted? Including when staff leave.

If you can’t justify it

Switch it off, delete the stored templates, confirm deletion with the vendor in writing, and record the decision. That’s a perfectly good outcome. Many organisations will find the old system was solving a problem a cheaper, less intrusive tool solves just as well.

If you can justify it

Write it down. Our biometric proportionality worksheet gives you a structure, and our guide to the code explains what each part requires. Then fix notices, contracts and retention.

A red flag to watch for

The code restricts using biometrics to infer things like emotions, personality, mood or health, and to categorise people by sensitive characteristics. If a vendor is selling “sentiment analysis” or demographic insights from camera footage, read the code carefully before agreeing to anything.