Source: Privacy Commissioner
About the code
The Biometric Processing Privacy Code 2025 was issued on 21 July 2025.
The Code will come into force on:
| 3 November 2025 | for biometric processing that starts after 3 November 2025 |
| 3 August 2026 | for biometric processing already in use on or before 3 November 2025 |
The Code, made under the Privacy Act, sets out the privacy rules for organisations and businesses who collect and use people’s biometric information in biometric processing.
Biometric processing is the use of technologies, like facial recognition technology, to collect and process people’s biometric information to identify them or learn more about them.
Biometric information relates to people’s physical or behavioural features. For example, a person’s face, fingerprints, voice, keystroke patterns, or how they walk.
Read the full Code
Biometric Processing Privacy Code 2025 (opens to PDF, 277KB).
Guidance about biometrics
We have full and detailed guidance for agencies wanting to use biometric technologies. Read the guidance and use case examples in our Resources and Learning section.
Read our summary factsheets
What’s changed?
We made some changes to the Biometric Processing Privacy Code based on the feedback received in our recent public consultation on a draft version. These changes are outlined in our ‘What’s changed’ document (opens to PDF, 180KB). Most of the changes are minor or drafting improvements. Many of the rules have stayed the same.
Submissions received
Between December 2024 and March 2025, we consulted on a draft version of the Code and received 146 submissions from members of the public, businesses, organisations, and government agencies. In line with our notification to submitters, we have published submissions received.
The draft Code was assessed for consistency with the New Zealand Bill of Rights and other human rights obligations by external legal counsel (Ben Keith, barrister). Read this assessment.