The law library · New Zealand · Code of practice, fully binding
New Zealand: Biometric Processing Privacy Code 2025
Made under section 32 of the Privacy Act 2020 · in force 3 November 2025 for new biometric processing · binding on pre-existing processing since 3 August 2026
Page verified 13 August 2026 against the code text published by the Office of the Privacy Commissioner (version as at 1 May 2026), including the clause 2 commencement provision quoted below.
New Zealand’s biometric rules are now fully in force. Clause 2 of the code sets two dates: 3 November 2025 for any type of biometric processing that had not commenced before that date, and 3 August 2026 for any type of biometric processing that commenced on or before 3 November 2025. The second date has passed. Every agency doing biometric processing in New Zealand now answers to the code’s thirteen rules, including its limits on inferring emotion, mood or mental state from biometric information.
Status
- 3 Nov 2025Code in force for biometric processing commencing after this date.
- 1 May 2026Amendment No 1 in force, inserting Rule 3A (collection other than from the individual concerned, the code’s version of new IPP 3A).
- 3 Aug 2026Transition expired: the code now also binds biometric processing that commenced on or before 3 November 2025. Fully binding on all in-scope processing.
Who it applies to
- AgenciesOrganisations and businesses collecting and using biometric information in biometric processing, under the Privacy Act 2020’s agency concept.
- NotableThe code defines “biometric categorisation” to include automated analysis of biometric information to infer or detect health information or personal information about personality, mood, emotion, intention or mental state, or fatigue, alertness or attention, or to slot an individual into demographic categories. The code’s use limits attach to exactly the analyses AI vendors now sell.
The thirteen rules
- Rules 1-4Purpose of collection (Rule 1), source of the biometric sample (Rule 2), collection from the individual (Rule 3) and otherwise (Rule 3A), manner of collection (Rule 4).
- Rules 5-9Storage and security (5), access (6), correction (7), accuracy checks before use or disclosure (8), retention (9).
- Rules 10-13Limits on use (10), limits on disclosure (11), disclosure outside New Zealand (12), unique identifiers (13).
Why it is on this list
The site already carries the New Zealand Privacy Act 2020 page for the general IPPs and breach duties. This code sits on top of that act for one data class, and the 3 August 2026 date is why it earns its own page: the grace period for systems that were already running is over. An agency that was relying on “we deployed before the code” no longer has that answer.
What the signed record shows
Rule 8 is an accuracy check before use. A check is an event, and events can be sealed.
The code’s rules keep asking for the same shape of evidence: that a purpose was assessed before collection, that accuracy was checked before use, that a use stayed inside Rule 10’s limits. A signed, tamper-evident record of each check, made when it happened, is how an agency answers the Privacy Commissioner without reconstructing history. The biometric consent pack covers the neighbouring duty set.
Sources
Related
- The law library · AI rules by country
- New Zealand Privacy Act 2020, the parent act
- Illinois BIPA, the US biometric consent regime
Checked against the source 13 August 2026: the code text (version as at 1 May 2026) on privacy.org.nz, clause 2 and the rules read directly. Information, not legal advice.
Information, not legal advice. Every entry is verified against the issuing body’s own document; where a source is reporting rather than the document, we say so.