Who the Biometric Processing Privacy Code covers, and what to do

The Biometric Processing Privacy Code 2025 is a binding code of practice made by the Privacy Commissioner under the Privacy Act. It applied from 3 November 2025 to biometric processing that started after that date, and from 3 August 2026 to processing that was already running. There is no longer a grace period for anyone.

If you use technology to recognise or analyse people by their bodies or behaviour, you need to read this.

Does it apply to you?

The code applies to biometric processing: the comparison or analysis of biometric information by a technological system. Biometric information relates to a person’s physical or behavioural features, such as their face, fingerprints, voice, iris or the way they walk or type.

It covers:

• Verification: checking someone is who they claim to be, such as a fingerprint door or timeclock, or voice verification on a phone line.
• Identification: picking someone out, such as facial recognition matching faces against a watchlist.
• Categorisation: analysing someone to put them in a category, such as estimating age.

It doesn’t apply to a health agency’s processing of health information, which stays under the Health Information Privacy Code.

Common examples in New Zealand workplaces and businesses include fingerprint or face timeclocks, biometric door access, facial recognition cameras in retail, voice verification in call centres, identity verification apps that match a selfie to an ID document, and some exam or online proctoring software.

If you buy a product that does this, you’re still the agency responsible. The vendor’s assurances don’t transfer your obligations.

The core test: is it justified?

Before you use biometric processing, the code requires you to assess whether it is necessary for a lawful purpose and proportionate, weighing the privacy risks against the benefits. In practice the Commissioner expects you to be able to show:

• Necessity and effectiveness. That it achieves your purpose, and actually works for the people it will be used on, including across different ages, ethnicities and disabilities.
• Proportionality. That the benefit outweighs the privacy risk, and that a less intrusive option wouldn’t do the job. For a timeclock, a card or PIN often does the job, which makes biometrics hard to justify.
• Safeguards. That you’ve put privacy protections in place, such as accuracy testing, human review of matches, security, retention limits and alternatives for people who don’t want to take part.

Write this down. The natural place is a privacy impact assessment. Our biometric proportionality worksheet gives you a structure.

Telling people

The code adds to the usual notice rules, so that people know biometric processing is happening before or when it happens, and what it’s for. Where processing happens in a physical space, in practice that means clear signs where people enter, backed by a fuller notice online. Check the code’s notice rule for the full list of matters. Since March 2026 the code also includes its own rule for information collected indirectly, matching IPP 3A.

Limits on categorisation

The code restricts using biometrics to infer sensitive things about people, such as their emotions, personality, mood or health, or to categorise them by protected characteristics. There are narrow exceptions. If a vendor offers “sentiment analysis”, “emotion detection” or demographic analytics on camera footage, treat that as a red flag and read the code before going further.

Overseas disclosure

The code sets conditions for sending biometric information overseas, aimed at making sure comparable safeguards apply. Check where your vendor processes and stores templates.

What to do now

1. Inventory your biometric processing. Include anything a vendor runs for you, and features switched on by default in security cameras or HR systems.
2. For each one, document the proportionality assessment. If you can’t justify it, switch it off and delete the templates.
3. Offer an alternative wherever you can, such as a card or PIN instead of a fingerprint.
4. Fix notices, including signs where processing happens in physical spaces.
5. Check retention and deletion, especially when staff leave or customers close accounts.
6. Check your vendor contracts for security, overseas processing, accuracy testing and breach notification.

When to get help

Facial recognition in public or customer-facing spaces, any use on children, or categorisation of any kind is high-risk. Read the Commissioner’s full guidance and consider specialist advice before starting.