TL;DR: The Biometric Processing Privacy Code took effect on 3 November 2025; organisations already using biometrics had until 3 August 2026 to comply. It covers using your face, voice, gait or other traits to verify, identify or categorise you. Organisations must check it’s proportionate, add safeguards, tell you before or when collecting, and are restricted from intrusive uses like emotion prediction, attention tracking, or inferring ethnicity or sex. You can complain to the Privacy Commissioner.
The key dates
From the Privacy Commissioner’s summary:
| Date | What |
|---|---|
| 3 November 2025 | Code takes effect for new uses |
| 3 August 2026 | Deadline for existing biometric users to comply |
What counts as biometrics
Sensitive personal information about physical and behavioural traits: your face, voice, gait, and similar. Facial recognition is the obvious example: cameras in shops, apps that verify your face, systems that sort people into groups.
The core rules
The Code swaps the Privacy Act’s 13 principles for 13 biometric-specific rules. The big ones:
- Proportionality: is biometrics effective and proportionate here?
- Safeguards: steps to reduce privacy risk.
- Transparency: tell people when and why, before or at collection.
- Safe limits: emotion prediction, attention tracking, and inferring ethnicity or sex are restricted, allowed only in limited cases like helping people with disabilities, safety, or research.
So a shop can’t just scan faces to guess who looks grumpy and needs a discount. (That was never a good business plan anyway.)
The case that shaped it: supermarket facial recognition
The Code arrived months after the Privacy Commissioner’s inquiry into Foodstuffs North Island’s facial recognition trial. According to RNZ (June 2025):
| Trial detail | Figure |
|---|---|
| Supermarkets in the trial | 25, ending September 2024 |
| Faces scanned (including repeats) | About 226 million, with 99.999% deleted within a minute |
| Alerts raised | 1,742, of which 1,208 were confirmed watchlist matches |
| Shoppers misidentified and approached | 9, two of whom were asked to leave; all attributed to human error |
The Commissioner found the trial’s live model complied with the Privacy Act, because safeguards reduced a high level of intrusion to an acceptable one. Those safeguards included deleting non-matches immediately, only watch-listing people whose behaviour was seriously harmful, banning images of under-18s and vulnerable people, two trained staff verifying every alert, and not using images as training data.
But the inquiry also flagged that the system was developed overseas and not trained on a local population, so the Commissioner couldn’t be fully confident about technical bias, which could affect Māori and Pacific shoppers. Commissioner Michael Webster said such technology "will only be acceptable if the use is necessary and the privacy risks are successfully managed."
Under the Code, any business considering the same thing now has to show that same proportionality, safeguards and notice, in writing.
What it means for you
- You should be told when biometrics are used on you.
- Organisations should be able to justify it.
- If you think a business broke the rules and you’ve been harmed, you can complain to the Office of the Privacy Commissioner (how).
- You can ask what biometric data they hold on you through an access request (how).
How it’s enforced
The OPC monitors compliance, investigates complaints and can act proactively, weighing the public interest, the seriousness of the breach, the risk of harm and the organisation’s conduct. It has also published detailed guidance with examples. Since 3 August 2026, every organisation using biometrics, including those that started before the Code, has had to comply.
The bigger picture
The Commissioner is pushing for a stronger Privacy Act overall, including protections for automated decisions and real penalties (more). Biometric data is uniquely risky: you can change a password, but not your face.
A free exposure check shows which breaches already hold your email.
Frequently Asked Questions
When did New Zealand’s Biometric Processing Privacy Code start?
3 November 2025. Existing users had until 3 August 2026 to comply.
Does the Biometric Code ban facial recognition?
No. It sets rules: uses must be proportionate, transparent and safeguarded, and some intrusive uses are restricted.
Is emotion recognition allowed in NZ?
It’s restricted under the Code, allowed only in limited situations like aiding people with disabilities, safety or research.
Was the Foodstuffs facial recognition trial legal?
The Privacy Commissioner found in June 2025 that the trial’s live model complied with the Privacy Act because of its safeguards, while flagging concerns about bias.
How do I complain about biometric use?
Complain to the Office of the Privacy Commissioner if you’ve experienced privacy harm.
Sources
- Privacy Commissioner: What is the Biometric Code (summary)
- Privacy Commissioner: What is the Biometrics Code
- RNZ: Privacy Commissioner inquiry finds supermarket facial recognition use justified (Jun 2025)