Biometric proportionality worksheet

How to use this

Since 3 August 2026, the Biometric Processing Privacy Code applies to all biometric processing in New Zealand, including systems that were running before the code. You need to be able to show your processing is justified. Use this worksheet alongside a privacy impact assessment, and read the code and the Privacy Commissioner’s guidance for the exact tests. This worksheet structures your evidence; it doesn’t replace the code.

Biometric proportionality worksheet

System: [for example, fingerprint timeclock at the Hamilton depot] Vendor: [name] Owner: [name] Date: [date]

1. What processing happens?

• Type: [verification / identification / categorisation]
• Biometric information used: [face / fingerprint / voice / other]
• Whose: [staff / customers / public], approximately how many people
• Where processing and storage happen, including overseas: [details]
• Are templates or raw images kept? For how long?

2. Purpose

What specific problem does this solve? [For example, “buddy punching”, where staff clock in for each other, cost an estimated $X last year.]

Is the purpose lawful and connected to our functions? [Yes, explain]

3. Necessity and effectiveness

• What evidence shows the problem exists and is significant?
• What evidence shows this system solves it? Include accuracy figures and testing.
• Does it work equally well across ages, skin tones, disabilities and other relevant characteristics? What testing supports that?

4. Less intrusive alternatives

If an alternative would work about as well, the processing is unlikely to be proportionate.

5. Privacy risks

• What could go wrong for individuals (misidentification, exclusion, function creep, breach)?
• Who is most affected, and how badly?
• Any risk of categorising people by sensitive characteristics or inferring emotions, personality or health? (The code restricts this.)

6. Benefits

What benefits does it deliver, and to whom? Quantify where possible.

7. Safeguards

• [ ] An alternative option for people who don’t want to use biometrics
• [ ] Human review before any adverse action based on a match
• [ ] Accuracy testing before go-live and periodically
• [ ] Security: encryption, access controls, vendor security reviewed
• [ ] Retention: templates deleted when no longer needed (for example when staff leave)
• [ ] Notice to people before or when collection happens, including signs where relevant
• [ ] Overseas processing assessed against the code’s conditions
• [ ] Contract with vendor covers all of the above

8. Conclusion

Is the processing necessary, effective and proportionate, with adequate safeguards? [Yes / No, with reasons]

Decision: [proceed / proceed with changes / stop and delete templates]

Approved by: [name, role, date] Review date: [date]