Facial recognition and biometrics: what New Zealand businesses need to check

A facial-recognition camera, fingerprint time clock or voice-verification service can introduce privacy questions that an ordinary software purchase does not resolve.

The Biometric Processing Privacy Code 2025 sets specific requirements for covered biometric processing in New Zealand. By October 2026, businesses should be assessing their existing arrangements as well as new technology proposals.

Which dates matter?

The Code came into force on 3 November 2025. Organisations already using biometrics had a transition period that ended on 3 August 2026. An amendment also took effect from 1 May 2026 to reflect the new rules concerning notification when information is collected indirectly.

An existing system is not exempt simply because it was purchased before the Code began. Check the current Code and Privacy Commissioner guidance against what the system actually does.

Start by understanding the technology

Biometric processing can involve physical or behavioural characteristics, including faces, fingerprints and voices, to identify people or learn information about them. The legal assessment needs to consider the particular processing and any applicable exclusions.

Ask the supplier for a plain-language description of the system. Does it compare a person against one stored identity, search a database for a match, or infer characteristics? What images, templates or other information does it collect? Where does that information go?

A product name or a general statement that the software is “privacy compliant” is not enough information for your own assessment.

Can you justify using biometrics?

Rule 1 requires a lawful purpose, necessity, appropriate safeguards and proportionate processing. Necessity includes whether the purpose can reasonably be achieved as effectively through an alternative with less privacy risk. Convenience or availability alone does not establish that test.

Define the problem you are addressing and the evidence that the system will help. Then document the alternatives and likely impacts. The assessment includes cultural impacts and effects on Māori, rather than considering business convenience alone.

A practical review might compare a proposed fingerprint time clock with cards or another attendance process. The answer depends on the actual purpose, effectiveness and risks; it should not be assumed from the technology itself. The Commissioner’s Rule 1 guidance explains the framework.

Review what people are told

Notification requirements include information that must be communicated clearly before or at collection, subject to the relevant rules and exceptions. Depending on the circumstances, people need to understand why the information is being collected and whether a non-biometric option is available.

Look at the real experience of an employee or customer. Would they notice and understand the information before the system captures their data? A lengthy policy somewhere on a website may not address the practical collection process.

Consent, where obtained, is not a substitute for checking the other Code requirements. If information comes from another source, assess the indirect-collection notification rules as well.

Check security, retention and accuracy

The Code addresses security, access and correction, accuracy, retention, use and disclosure. Biometric information should not be kept indefinitely merely because storage is inexpensive. Identify who can access it, when it is deleted and how deletion is carried out across connected systems.

Consider the consequences of a false match or other error. A process for human review and a clear way to challenge a result may be important safeguards. Staff need to know what to do when a system produces an uncertain or disputed result.

Put supplier arrangements under the same scrutiny

Ask where data is hosted, which subcontractors can access it, how incidents are reported and what happens when the contract ends. If information is disclosed overseas, assess the applicable overseas-disclosure requirements rather than assuming cloud storage settles the issue.

A useful review brings together the technical description, privacy assessment, notices, retention schedule and contract. Our commercial-contract services can help review the supplier terms alongside those operational arrangements.

A sensible next step for Canterbury businesses

If you already use a biometric system, identify any gaps and plan how to address them. If you are considering one, obtain the necessary information before committing to a purchase. Keep the assessment under review when the purpose or technology changes.

Canterbury Legal provides business and commercial legal advice to help organisations assess obligations and document arrangements. Contact our Christchurch team to discuss the system you use or are planning to introduce.

Sources and further reading

• Privacy Commissioner: current Code and commencement dates
• Rule 1: purpose, necessity, safeguards and proportionality
• Overview of the Code’s rules
• Code factsheet: rights, handling and enforcement

Information checked on 27 October 2026. This article provides general information about New Zealand law and is not a substitute for advice about your circumstances.