New Zealand Biometric Processing Privacy Code
In force New Zealand · In force Nov 3, 2025 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
A binding code of practice under the Privacy Act 2020. It sets the privacy rules for organisations that collect and use biometric information, such as face, fingerprints, voice, keystroke patterns or gait, in automated biometric processing like facial recognition. Agencies already using biometrics had a nine-month grace period, which ended on 3 August 2026. Amendment No. 1 aligns the code with the new indirect collection principle (IPP 3A) from 1 May 2026.
- Who it applies to
- Agencies (public and private organisations) in New Zealand that use biometric processing.
- Penalties
- A breach of the code is treated as a breach of an information privacy principle, and can lead to complaints, compliance notices and Human Rights Review Tribunal remedies under the Privacy Act 2020.
- Enforced by
- Office of the Privacy Commissioner
- Official name
- Biometric Processing Privacy Code 2025
- Citation
- Code of practice issued under the Privacy Act 2020; Amendment No. 1 (March 2026)
- Topics
- biometrics, privacy
Verified 2026-09-25 justice.govt.nz
Research notes
The penalty description is a general statement of how codes work under the Privacy Act 2020. It was not taken from the code page.
Related
Questions about New Zealand Biometric Processing Privacy Code
- What are the New Zealand Biometric Processing Privacy Code compliance deadlines?
- Nov 3, 2025: Biometric code in force. May 1, 2026: Amendment No. 1 applies (IPP 3A). Aug 3, 2026: Grace period ends for existing biometric processing.
- When does New Zealand Biometric Processing Privacy Code take effect?
- New Zealand Biometric Processing Privacy Code took effect on Nov 3, 2025.
- Who does New Zealand Biometric Processing Privacy Code apply to?
- Agencies (public and private organisations) in New Zealand that use biometric processing.
- What are the penalties under New Zealand Biometric Processing Privacy Code?
- A breach of the code is treated as a breach of an information privacy principle, and can lead to complaints, compliance notices and Human Rights Review Tribunal remedies under the Privacy Act 2020.