New Zealand’s Privacy Commissioner has finalized a new Biometric Processing Privacy Code that will take effect on November 3, 2025. The regulation introduces strict requirements for how biometric data – such as facial recognition, fingerprints, and iris scans – can be collected and used across both public and private sectors. The new code is the country’s most comprehensive legal framework to date for addressing the risks posed by biometric technologies.
The code follows a public consultation process launched in December 2024 and reflects feedback from industry stakeholders, civil society groups, and government agencies. Organizations already using biometric systems will have until August 3, 2026, to bring their operations into compliance, allowing a 12-month transition period to implement technical and governance changes.
“Because of its sensitivity – it is the most sensitive personal information – we thought it was timely to create some stronger and clearer rules about the use of biometric technology,” said Privacy Commissioner Michael Webster. The announcement comes amid growing adoption of facial recognition and other biometric tools in New Zealand, including a recently approved facial recognition trial in supermarkets that highlighted gaps in existing guidance.
The code requires organizations to demonstrate that any use of biometric technology is necessary, effective, and proportionate to its intended purpose. It places strict limits on high-risk uses, generally prohibiting applications that attempt to predict emotions or infer protected characteristics such as ethnicity, sex, or personality traits. Narrow exceptions are permitted only in specific cases, such as improving accessibility or addressing immediate threats to safety. Covered entities must also implement privacy-by-design safeguards, conduct risk assessments, and ensure transparency in how biometric data is collected, stored, and used.
New Zealand’s regulatory push reflects broader regional momentum around privacy and emerging technologies. In June 2025, the country hosted the 63rd Asia Pacific Privacy Authorities Forum, where biometric surveillance and AI governance were central topics of discussion among regulators from across the region.
“We want New Zealanders to use technology well and in a privacy protective way to get both the benefit of new technology but to do it in a way that ensures that New Zealanders feel that their personal information, that their privacy, is being protected and respected,” Webster said.
The Office of the Privacy Commissioner has published detailed implementation guidance and will monitor compliance through a combination of complaint investigations and proactive enforcement, depending on risk level and public interest. The regulation is formally titled the Biometric Processing Privacy Code 2025 and is available on the Privacy Commissioner’s website.
–
By Cass Kennedy
