New Zealand’s Biometric Processing Privacy Code 2025 officially comes into force today, November 3, 2025, establishing one of the world’s most robust regulatory frameworks for the use of biometric technology. The Code, which operates under the Privacy Act 2020, applies to any organization using technologies like facial recognition to automatically collect and process biometric information.
The framework’s core is its stringent “necessity” and “proportionality” test, codified in Rule 1. This rule mandates that organizations may only collect biometric information if it is for a lawful purpose and is necessary and proportionate for that purpose. The Code sets a very high bar for “necessity”—an organization must be able to prove that its goal cannot be achieved as effectively through an alternative, less privacy-invasive method.
This is a significant step beyond the “lawful purpose” requirements of GDPR or the consent and disclosure rules of Illinois’ BIPA. It directly challenges the common industry justification of using biometrics for mere “efficiency” or “convenience” if other, non-biometric methods are viable. The approach reflects growing global concern about the proportionality of biometric deployment, particularly in contexts where facial recognition systems have sparked privacy controversies.
For new biometric processing initiated on or after November 3, compliance is immediate. Organizations with existing biometric systems in use before this date have a nine-month transition period, with a final compliance deadline of August 3, 2026. This grace period allows businesses to conduct necessity assessments and potentially pivot to alternative identification methods if they cannot justify their current biometric approach.
The Code’s impact extends beyond New Zealand’s borders. As organizations increasingly deploy biometric systems globally, New Zealand’s “prove necessity first” standard could influence regulatory approaches in other jurisdictions. The framework provides a model for regulators seeking to balance innovation with privacy protection, particularly as concerns about biometric surveillance continue to mount worldwide.
This “sleeper” code from New Zealand could become the new global high-water mark for biometric governance. By shifting the burden of proof entirely onto the organization to justify the modality itself, the framework provides a new gold standard that privacy advocates worldwide will likely seek to replicate. The Code arrives at a moment when biometric technology is rapidly expanding into retail, workplace, and public space applications, making its “necessity test” particularly timely and potentially transformative.
Sources: Russell McVeagh; Privacy.org.nz
—
By Ji-seo Kim
