A deadline passed on Monday that a good number of New Zealand businesses did not know applied to them. From 3 August 2026, every organisation already using biometric technology has had to meet the Biometric Processing Privacy Code 2025 in full. The Code is not new. The Privacy Commissioner issued it on 6 August 2025 and it came into force on 3 November that year for anything switched on afterwards. What ended this week was the nine-month grace period for systems already running.
Almost all of the coverage has framed this as a supermarket story, because that is where the cameras are. The Code is much broader, and the businesses most likely to be caught out are ordinary companies that bought software with a biometric feature buried inside it and never thought of themselves as being in the biometrics business at all.
The Code sits under the Privacy Act 2020 and covers biometric processing, defined as the comparison or analysis of biometric information by a technological system. That happens in three ways. Verification is one-to-one matching, confirming you are who you say you are. Identification is one-to-many matching, finding you in a database. Categorisation is inferring something about you, such as estimating your age from your face. The information itself covers how someone looks, moves or behaves, so faces and fingerprints and irises, but also voice, gait, handwriting and typing patterns, and it applies to both the raw sample and the mathematical template derived from it.
Run that definition across a normal New Zealand company and the list gets long quickly. Voice authentication on a call centre line is verification. So is a fingerprint reader on a worksite time clock. So is an online account opening flow that asks a customer to photograph a driver licence and then take a selfie so the two can be matched, now routine in banking, insurance, rentals and anything with a know-your-customer requirement. Fraud tools that score how a user types are behavioural biometrics. None of these were sold as biometric programmes. They were sold as onboarding, or security, or payroll, and they arrived through a procurement process that treated them as features.
One distinction here changes the answer entirely. When a customer unlocks your app with Face ID, or signs in with a passkey using a fingerprint, the biometric match happens inside the secure hardware on the phone or laptop. The device checks the face or finger locally and then releases a cryptographic key. Your server receives a signed assertion and nothing else, so no face, no template and no image ever reaches you. The Code also carves out personal consumer devices used for personal purposes. Contrast that with an onboarding flow where the selfie is uploaded to your server, or posted to a vendor’s API for matching. That is biometric processing and you are the agency responsible for it.
The test is simple enough to apply in a meeting. Does biometric information, either the image or the template, ever reach a system you or one of your suppliers controls. If the answer is no, the Code is largely not your problem. If it is yes, or if nobody in the room is certain, you have work to do. That is also an argument for building authentication on passkeys where you can, which we looked at in June. Keeping the biometric on the customer’s own device is better security and it keeps you out of a regulated category.
What compliance requires starts before anything is switched on. Rule 1 obliges an organisation to complete a proportionality assessment, weighing whether the system is necessary, whether it will genuinely be effective, and whether the benefit is proportionate to the privacy risk. It must consider whether a lower-risk alternative would achieve the same purpose, and it must specifically consider cultural impacts and the effects on MΔori. This is the part that catches people, because the assessment is meant to inform the decision rather than justify one already made. Businesses only now reading the Code are writing the assessment backwards, and if it honestly concludes the system was never necessary, the honest response is to turn it off.
Rule 3 then expands what you must tell people, well past a link to a privacy policy. Before or at the time of collection, individuals need to know what is being collected, why, how long it will be kept, whether a non-biometric alternative is available, how to complain to you and to the Privacy Commissioner, and how to see the proportionality assessment. In a physical store that is signage. In a web or app flow it is an interface problem, and not one a checkbox at the bottom of a form solves. The notice has to be in front of the customer at the moment the camera turns on, which usually means designing a real screen for it. Rule 10 also puts hard limits on the most intrusive uses, including inferring emotional state, attention, health information or ethnicity, with narrow exceptions for accessibility, safety and research.
The supermarket case remains the most useful worked example, and it repays reading properly rather than by headline. Foodstuffs North Island trialled facial recognition in 25 stores between February and September 2024. The Privacy Commissioner’s inquiry findings, released on 4 June 2025, record 225,972,004 faces scanned, about 99.999 per cent of which were deleted within a minute, producing 1,742 alerts and 1,208 confirmed matches. The trial was found to comply with the Privacy Act, but the reasoning matters more than the verdict. The intrusion was high because every shopper’s face was collected, and it was the safeguards, including near-immediate deletion of non-matches and human review of alerts, that brought it back to an acceptable level. The Commissioner also could not be fully confident about technical bias in a system trained offshore, and flagged the potential for it to fall harder on MΔori and Pacific people.
On a similar watchlist model, Bunnings began rolling the technology out to 42 New Zealand stores from mid-April this year. Those retailers had lawyers, engineers and a regulator watching. A twelve-person business with a fingerprint time clock has none of that, and the Code makes no allowance for size. New Zealand privacy law has never had a small business exemption, which is why the sensible move this month is a short inventory rather than a legal opinion. Walk the list of systems that touch faces, fingers, voices or behaviour. Ask each vendor where the biometric data is processed and how long anything is retained. Where the match can happen on the customer’s device, move it there. Where it cannot, write the proportionality assessment, even if it runs to two pages, and fix the notice so it appears before the collection rather than after it.
There is also a reason not to file this away as done. Catherine Wedd’s member’s bill restricting social media for under-16s was introduced on 6 May 2025 and, as of May 2026, has been parked while a wider programme of work is developed, but Australia’s equivalent ban has been in force since December 2025 and the pressure has not gone anywhere. If age checking arrives here, face-based age estimation will be one of the methods offered to businesses, and it is categorisation under a Code that already applies. The organisations that handle that well will be the ones that spent this month working out what they already collect.
Roger McSaveney is General Manager of Forge Creative, an Auckland web design and development agency.
Does your workplace use fingerprints, face scans or voice checks for anything, and were you told what happens to the data. Share your thoughts in the comments below.
This article was written by AI, briefed to report the facts, hopefully without some of the bias people bring to the job π
Leave a Reply