New Zealand to Enforce Biometric Privacy Code Starting November 2025

New Zealand has launched a new Biometric Processing Privacy Code, which sets specific legal requirements for collecting and using biometric data such as facial recognition and fingerprint scans. 

The regulation under the Privacy Act will start on November 3, 2025. Organizations need to follow the Code by August 3, 2026.

The Code applies to every business, government agency, and organizations that use the biometric technology in automated systems. It requires that organizations evaluate the necessity, effectiveness, proportionality, and privacy risks of biometric systems. Organizations must tell people before or during the collection of their biometric data. They should also put protections in place to stop unauthorized access or unfair use of that data.

Privacy Commissioner Michael Webster reportedly stated that, despite its usefulness, biometric data is highly sensitive because it is unique and directly linked to an individual’s identity. The Code will tend to achieve a balanced technological innovation with safeguards against mass surveillance, personal profiling, and algorithmic bias. 

According to the new rules, intrusive uses, such as predicting or inferring ethnicity or emotion, will be limited.

The Privacy Office also released detailed guidance with practical examples to help agencies comply, and they must conduct case-specific assessments to determine how the Code applies to their biometric system.

The law was finalized after extensive consultations and signals New Zealand’s commitment to responsible biometric governance.

Global Context

Globally, privacy concerns surrounding the use of biometric technologies are gaining momentum, prompting legislative action in several regions. In the EU AI Act, limits the use of biometrics (high-risk use) such as real-time identification in public areas. Canada has made suggestions on how it intends to update its Personal Information Protection and Electronic Documents Act (PIPEDA) to deal with AI-driven biometrics. 

In the U.S, Illinois and Texas are some of the states that implement the biometric privacy law, which states that consent to collect data must be obtained. Such initiatives are part of a larger international trend of reassessing and regulating surveillance technologies more heavily.