Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

New Zealand Biometric Processing Privacy Code

In force New Zealand · In force Nov 3, 2025 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Transition endsAug 3 · 3 months ago · Source
Grace period ends for existing biometric processingAgencies already using biometrics before the code started must comply by this date.
Takes effectMay 1 · 6 months ago · Source
Amendment No. 1 applies (IPP 3A)The amended code, which reflects IPP 3A, is in force from 1 May 2026.
Takes effectNov 3, 2025 · 12 months ago · Source
Biometric code in forceThe Biometric Processing Privacy Code applies to new biometric processing.

Summaries for reference, not legal advice. Check the official text.

What it does

A binding code of practice under the Privacy Act 2020. It sets the privacy rules for organisations that collect and use biometric information, such as face, fingerprints, voice, keystroke patterns or gait, in automated biometric processing like facial recognition. Agencies already using biometrics had a nine-month grace period, which ended on 3 August 2026. Amendment No. 1 aligns the code with the new indirect collection principle (IPP 3A) from 1 May 2026.

Who it applies to
Agencies (public and private organisations) in New Zealand that use biometric processing.
Penalties
A breach of the code is treated as a breach of an information privacy principle, and can lead to complaints, compliance notices and Human Rights Review Tribunal remedies under the Privacy Act 2020.
Enforced by
Office of the Privacy Commissioner
Official name
Biometric Processing Privacy Code 2025
Citation
Code of practice issued under the Privacy Act 2020; Amendment No. 1 (March 2026)
Topics
Biometrics, Privacy
Verified 2026-09-25 justice.govt.nz
Research notes

The penalty description is a general statement of how codes work under the Privacy Act 2020. It was not taken from the code page.

Related

AmendedAustralia
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
In forceChina
China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022
In forceChina
China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026
In forceChina
China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024
AmendedChina
China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017
In forceChina
China Data Export Security Assessment MeasuresSets the CAC security assessment that must be passed before certain data leaves China, including exports of important data and large-scale personal information exports. Data handlers must run a self-assessment, then apply through the provincial CAC for a national CAC review. Transfers already under way had six months to come into compliance.In effect since Sep 1, 2022
In forceChina
China Data Security Risk Assessment MeasuresImplements the annual risk assessment duty for important data handlers under the DSL and Network Data Security Regulations. Important data handlers must assess risk every year and submit the report to their regulator within 20 working days of finishing; general data handlers are encouraged to assess at least every 3 years. Regulators can order an assessment by a certified third party after serious risks or large leaks.In effect since Aug 20, 2026
In forceChina
China Deep Synthesis ProvisionsRegulates deepfakes and other deep synthesis services such as synthetic text, voice cloning, face swapping and immersive scenes. Providers must verify user identity, review content, add technical marks to generated content, and add prominent labels where content could confuse the public. Providers with public opinion attributes must file algorithms, and app stores must check filings and security assessments.In effect since Jan 10, 2023
Questions about New Zealand Biometric Processing Privacy Code
What are the New Zealand Biometric Processing Privacy Code compliance deadlines?
Nov 3, 2025: Biometric code in force. May 1, 2026: Amendment No. 1 applies (IPP 3A). Aug 3, 2026: Grace period ends for existing biometric processing.
When does New Zealand Biometric Processing Privacy Code take effect?
New Zealand Biometric Processing Privacy Code took effect on Nov 3, 2025.
Who does New Zealand Biometric Processing Privacy Code apply to?
Agencies (public and private organisations) in New Zealand that use biometric processing.
What are the penalties under New Zealand Biometric Processing Privacy Code?
A breach of the code is treated as a breach of an information privacy principle, and can lead to complaints, compliance notices and Human Rights Review Tribunal remedies under the Privacy Act 2020.