The Biometric Processing Privacy Code 2025 — issued by the Office of the Privacy Commissioner on 21 July 2025 and in force since 3 November 2025 — regulates how New Zealand agencies collect and use biometric information: facial recognition, fingerprints, voice prints and similar.
Organisations that started biometric processing after the Code came into force have had to comply from the start. Organisations that were already using biometric systems before 3 November 2025 were given a transition period.
That transition period ends on 3 August 2026.
Who this catches
More businesses than expect it. Biometrics in ordinary SME use include:
- fingerprint or face-unlock time-and-attendance systems
- door access readers using fingerprints or faces
- facial-recognition CCTV or people-matching in retail
- voice identification in phone systems
If any of those were running in your business before November 2025, the clock that matters is 3 August 2026.
What “compliant” means under the Code
The Code sits under the Privacy Act 2020 and tightens how the Information Privacy Principles apply to biometric processing — in short: be clear about why you’re collecting biometrics and that the purpose justifies it, tell people, offer alternatives where practicable, secure the data, and don’t repurpose it. The OPC’s Code page linked below is the authoritative statement of the rules.
Note the timing detail from Amendment No 1 (made 25 March 2026): processing that began after 3 November 2025 had a 1 May 2026 compliance date; processing already underway transitions on 3 August 2026. If you’re reading this before August, you’re in the second group’s final window.
What to do now
- Inventory your biometric systems — including ones inside products you buy (attendance, access control, CCTV analytics).
- Check each against the Code — purpose justification, notice to staff and customers, alternatives, retention and security.
- Fix or switch off before 3 August 2026. If a system can’t be justified under the Code, the honest options are to change how it runs or stop using it.
- Our NZ Privacy Act 2020 guide tracks the Code’s dates on its change timeline.
Sources
- OPC — Biometric Processing Privacy Code
- OPC — Amendment No 1 to the Biometric Processing Privacy Code 2025
- Privacy Act 2020 (legislation.govt.nz)
This article is education, not legal advice. Dates and obligations are cited to the official sources above — the linked source is the authoritative wording. See how we verify.