Biometric Processing Privacy Code 2025 (New Zealand)

What it is

The Biometric Processing Privacy Code 2025 is a code of practice issued by New Zealand’s Privacy Commissioner under the Privacy Act 2020. A code of practice has the force of law. For the activities it covers, its rules take the place of the Act’s 13 Information Privacy Principles. The Commissioner issued it on 21 July 2025 after public consultation on a draft.

Facial recognition, voice analysis, gait analysis and similar systems all rely on machine learning to match or classify people. The code sets out when organisations may use them and what they must do, which makes it the most direct binding rule for those AI systems.

Who it applies to

The code applies to organisations that collect people’s biometric information in an automated process to verify, identify or categorise them. The Commissioner calls this biometric processing.

• Biometric verification is one-to-one matching, such as checking a face against a passport photo.
• Biometric identification is one-to-many matching, such as picking a face out of a watchlist.
• Biometric categorisation is inferring other information about a person, such as estimating age from a face or emotion from a voice.

Biometric information means information about how someone looks, moves or behaves, from faces, fingerprints and irises to the way a person walks, speaks, writes or types. It covers both samples, such as photos and recordings, and the templates algorithms derive from them. It does not cover biological or genetic material, or information about brain activity or the nervous system.

There are carve-outs. Health agencies using biometrics to provide health services are covered by the Health Information Privacy Code instead. The code generally does not reach personal consumer devices, and it generally does not place obligations on individuals acting in a personal capacity unless the risk is very high.

What it requires

The code has 13 rules, each matching one of the Information Privacy Principles. Three matter most for an organisation deploying a biometric AI system.

Rule 1, necessity and proportionality. An organisation may collect biometric information for biometric processing only if the purpose is lawful, the processing is necessary for it, privacy safeguards are in place, and the processing is proportionate to its likely impacts on people. Necessary means the system is an effective way of achieving the purpose and there is no reasonable alternative with less privacy risk. The proportionality assessment weighs the scope and degree of privacy risk against the benefit, and takes account of cultural impacts on Māori. The Commissioner’s guidance says that where the benefit goes only to the organisation, it must outweigh the risk by a substantial degree.

Rule 3, notification. People must be told key information, including the purpose and whether a non-biometric alternative is available, before or at the time of collection.

Rule 10, limits on use. Biometric information may be used only for the purpose it was collected for, unless an exception applies. Starting biometric processing on images, video or audio that were not collected for that purpose needs its own necessity and proportionality assessment and safeguards. Rule 10 also restricts biometric categorisation. Organisations must not use biometric information to obtain or infer information about a person’s health, to infer emotion, mood, personality, mental state or intention, or attention, fatigue or alertness, or to categorise people by grounds protected under the Human Rights Act. Age and other unprotected categories are not restricted. The exceptions are narrow, covering accessibility for people with disabilities, preventing serious threats to life, health or safety, ethically approved research, and express authorisation for health information.

The other rules cover source of collection, fair collection, security, access, correction, accuracy, retention, disclosure, overseas disclosure and unique identifiers. Rule 12 requires biometric information sent overseas to be adequately protected.

Key dates

• 21 July 2025. Code issued by the Privacy Commissioner.
• 3 November 2025. Code in force for biometric processing that starts on or after this date.
• March 2026. Amendment No 1 issued to reflect the new Information Privacy Principle 3A.
• 1 May 2026. IPP3A, on notifying people when their information is collected from someone else, takes effect.
• 3 August 2026. The nine-month transition for organisations already using biometrics ends.

How it relates to other frameworks

The code sits within the Privacy Act 2020 and the Commissioner’s AI guidance, which still govern AI systems that use personal information but are not biometric. Its limits on emotion inference resemble the EU AI Act, which bans emotion recognition in workplaces and education and treats remote biometric identification as high risk. New Zealand businesses using AI more widely can draw on MBIE’s Responsible AI Guidance for Businesses, and many structure their impact assessments with an international standard such as ISO/IEC 42001.

A note on this page

This is Aicura’s reading of the Biometric Processing Privacy Code 2025. It is not legal advice and it is not the code itself. Read the code and the Privacy Commissioner’s guidance, and take advice on how it applies to your organisation.