New Zealand · Biometric Processing Privacy Code 2025

Show your biometric system is proportionate before it collects a single face

For agencies using facial recognition, fingerprint, voice or other biometric processing — AccessPoint runs the rule 1 proportionality assessment, including the cultural impacts and effects on Māori, the rule 3 and 3A notices, trials, and rule 6 access and rule 7 correction letters, beside the Privacy Act pack that runs your requests and breaches.

Start Free Trial Request a Demo

New Zealand — Biometric Processing Privacy Code at a glance

In force: 3 November 2025 for new processing; 3 August 2026 for processing that began earlier
Before collecting: A lawful purpose, necessity, reasonable safeguards, and a reasonable belief the processing is proportionate (rule 1)
Proportionality factors: The privacy risk, whether the benefit outweighs it, and the cultural impacts and effects on Māori
Trials: An initial period of up to 6 months, and one further period of up to 6 months
Categorisation: Inferring emotion, health or a demographic category is barred unless a rule 10 exception applies
Health agencies: Outside the Code where the biometric information is health information — the HIPC applies

Governing legislation

Biometric Processing Privacy Code 2025

Made under the Privacy Act 2020, s.32 (21 July 2025)

Rules 1–13 and 3A, which modify the information privacy principles for biometric verification, identification and categorisation by a technological system

Commencement

Clause 2

In force 3 November 2025 for biometric processing that had not begun before that date, and 3 August 2026 for processing that began on or before it

Privacy Act 2020

Parts 4, 5 and 6

Access and correction requests, complaints and notifiable privacy breaches about biometric information run under the Act — and failing to comply with a Code rule is treated as a breach of a principle for complaints (s.38)

Oversight

Office of the Privacy Commissioner

The Privacy Commissioner issued the Code, publishes guidance on applying it, and investigates complaints about biometric processing under the Privacy Act, where a failure to comply with a Code rule counts as a breach of an information privacy principle. The Commissioner will begin a review of the Code no later than 3 November 2028.

Built for New Zealand — Biometric Processing Privacy Code

One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.

The rule 1 assessment, as a template

Lawful purpose, necessity — the system works, and no alternative with less privacy risk would do as well — reasonable safeguards, and the proportionality conclusion, each recorded as a section of a guided assessment with a risk register and sign-off.

Cultural impacts and effects on Māori

The Code makes them a required factor in the proportionality assessment, not an optional appendix. The template gives them their own section, so the analysis is recorded and reviewable rather than assumed.

Trials with an end date

Where necessity cannot yet be shown, a trial can defer that one test — for up to 6 months, then one further 6 months. Every other rule still applies, including telling people about the trial. The trial notice and its period sit on the assessment.

Notices at and before collection

Rule 3 notices cover the fact of collection, each purpose, any alternative to biometrics, retention and where the assessment can be viewed; rule 3A covers biometric information collected from someone else. The pack ships a template for each, plus a trial notice.

Rule 6 access, including the type held

Individuals are entitled to confirmation of whether biometric information is held, what type it is — a sample or a template — and access to it. The rule 6 and rule 7 letters work with the Privacy Act request types on the pack you install beside this one.

In your own tenant

Assessments, notices and audit history stay inside your own Microsoft 365 and Azure tenant — no third-party cloud and no vendor access.

Proportionality is the test

The Code does not ask whether biometrics work. It asks whether they are worth the privacy risk — and expects the reasoning on record.

Rule 1 sets four conditions before biometric information is collected: a lawful purpose, necessity, reasonable privacy safeguards, and a belief on reasonable grounds that the processing is proportionate to its likely impacts on individuals. The proportionality weighing is specific. The privacy risk includes bias, chilling effects, scope creep and surveillance; the benefit outweighs it only where a public benefit does, a clear benefit to the individuals concerned does, or the agency's own private benefit does to a substantial degree; and the cultural impacts and effects on Māori must be taken into account. The rule 3 notice must then tell people where the assessment, or a summary of it, can be found. An agency asked to justify its system will need to show that analysis, not just its conclusion. AccessPoint makes the assessment a guided case with its risks, safeguards, conclusion and sign-off, so the reasoning exists before the cameras go live.

Rule 1(4) Public, individual or substantial private benefit, weighed and recorded.

Assessment first Completed and signed off before collection begins.

Review-ready The record a Commissioner investigation reads.

Configured out of the box

Installing the nz-biometrics jurisdiction pack seeds your tenant with everything this regime needs. It is a starting point built from public information about the legislation, not legal advice — your legal counsel validates and adjusts it for your tenant.

Pack content last reviewed: 2026-10-20

The Biometric Processing Privacy Code 2025 as the legal authority, with its commencement and transition dates
A biometric proportionality assessment covering lawful purpose, necessity, safeguards, privacy risk, benefit, and the cultural impacts and effects on Māori
A screener on whether the Code applies to the processing
Rule 3 and rule 3A collection notices and a trial notice
Rule 6 access and rule 7 correction response letters
Readiness obligations for notices, the proportionality assessment and security safeguards
A playbook on trials, watchlists, the limits on biometric categorisation, retention and overseas disclosure
Requests, complaints and breaches handled on the Privacy Act pack it installs beside

A jurisdiction pack's detail panel in AccessPoint settings, showing the pack description, version, what's new, and the checklist of items it imports: legal authorities, calendars, request statuses, request types, extension reasons, requestor categories and consultation types — What a pack looks like in Settings (the Ontario municipal pack shown): the description, the version and what changed in it, and every item it imports with its statutory basis. Anything you have customized is never overwritten on update.

New Zealand — Biometric Processing Privacy Code Questions

Who does the Biometric Processing Privacy Code apply to?

Any agency that uses a technological system to compare or analyse biometric information — faces, fingerprints, voices and other physical or behavioural features — for verification, identification or categorisation. It does not apply to biometric processing by a health agency, or to biometric information a health agency holds, where that information is health information; the Health Information Privacy Code applies instead (see the Health Information Privacy Code pack).

When did the Code come into force?

It was made on 21 July 2025 and came into force on 3 November 2025 for any type of biometric processing that had not begun before then. Processing that began on or before 3 November 2025 had until 3 August 2026. Amendment No 1 added rule 3A, on notice of indirect collection, from 1 May 2026.

Can we trial a biometric system before we can show it is necessary?

Yes. Rule 1 allows an agency to establish a trial and defer the necessity test until the trial ends. A trial period is no longer than its objectives need — an initial period of up to 6 months and, if the objectives are not met, one further period of up to 6 months. Every other rule applies during the trial, including making people aware of the trial and its period.

Can we use biometrics to infer emotion, health or age?

Only within rule 10. Biometric categorisation — inferring health information, mood, emotion, intention or mental state, fatigue or attention, or assigning a demographic category — is barred unless an exception applies: categorising by age or a category that is not a prohibited ground of discrimination, accessibility, a serious threat to health or safety, approved research, fatigue monitoring to prevent a safety risk, or inferring health information with the individual's express authorisation.

Does this pack handle access requests, complaints and breaches?

Those run under the Privacy Act 2020, so they come from the Privacy Act pack this one installs beside — the private-sector Privacy Act pack or the public-sector OIA and Privacy Act pack. This pack adds the Code itself: the proportionality assessment, the notices, the rule 6 and rule 7 letters, the playbook and the readiness obligations the Code imposes.

Where do our assessments and records reside?

Entirely within your own Microsoft 365 and Azure tenant, in the region you choose. Proportionality assessments, notices, requests, letters and audit history never leave your control — no third-party cloud and no vendor access.

Go deeper

Flat annual pricing, published in full. Every feature in every size — access requests, privacy impact assessments, breach response, complaints, video & audio redaction, the public portal, repository connectors, and AI Assist. No per-user or per-module fees.

Under 500 employees$2,990/yr
500–1,999 employees$7,990/yr
2,000–9,999 employees$14,990/yr
10,000+ employees$29,990/yr

See full pricing Build the business case

Run the Biometric Processing Privacy Code in Your Own Tenant

Try AccessPoint free for 30 days, configured for New Zealand biometric processing. No credit card required.

Start Free Trial Request a Demo