New Zealand’s Biometric Processing Code: Governing Facial Recognition and Voiceprints

New Zealand has put a specific set of rules around facial recognition and voiceprints, and for anyone who deployed the technology before it existed, the clock to comply runs out on 3 August 2026.

The Biometric Processing Privacy Code 2025, issued by the Office of the Privacy Commissioner under the Privacy Act 2020, came into force on 3 November 2025. Agencies already running biometric systems were given a grace period to migrate onto the new rules; that window closes on 3 August 2026. So this is not a horizon item. If your organisation captures a face, a voiceprint, a fingerprint or a gait signature in New Zealand, the substantive question is no longer whether the general privacy principles apply — they always did — but whether your deployment can survive a proportionality test it was never designed to pass.

What the Code actually changes

New Zealand did not pass a new statute. It used a mechanism the Privacy Act already provides: a code of practice that modifies how the thirteen information privacy principles apply to a particular activity. The Code sets out its own rules, mirroring the thirteen principles, but tightens several of them for biometric processing specifically. The three that matter most in practice are the rules on collection, notification and use — and they are more demanding than the baseline principles they replace.

The scope is drawn around biometric information used to identify or categorise a person by technological means. That is deliberately broad. It captures the obvious — facial recognition at a building entrance, voiceprint matching in a call centre — and the less obvious behavioural signals such as keystroke dynamics. If your architecture turns a physical or behavioural feature into a template and compares it, you are inside the Code.

The proportionality assessment is the real obligation

The collection rule is where most existing deployments will struggle. Before an organisation may collect biometric information, it must be satisfied that the processing is lawful, necessary, effective and proportionate — and it must be able to show that the benefits clearly outweigh the privacy risks. “We wanted to reduce fraud” is not an answer to that test. “Reduce fraud” is a purpose; proportionality asks whether biometrics is the least intrusive way to achieve it, whether the technology actually works for your population, and whether a less invasive control would have done the job.

Two features of this test have engineering consequences. First, effectiveness has to be evidenced — trials, performance metrics, error rates across demographic groups — not asserted. A facial-recognition system with a materially higher false-match rate for some faces than others is not merely a fairness problem; under this Code it undermines the effectiveness and proportionality on which the lawfulness of the whole deployment rests. Second, the assessment must weigh the cultural impact of biometric processing on Māori. That is a genuinely distinctive requirement, and it is not satisfied by a generic template lifted from an overseas privacy impact assessment. It requires engagement, and it needs to be documented.

The practical failure mode is familiar from other privacy regimes: the assessment is written after the system is live, to justify a decision already made. The Code expects the reasoning to precede the collection, and expects the artefact to exist and be produceable. If you cannot show the proportionality assessment, you are in the position of stated compliance without evidence of it.

Notification you can no longer bury

The notification rule raises transparency well above a line in a privacy policy. Individuals must be told, with due particularity, that biometric information is being collected and for what specific purpose; whether an alternative to the biometric option exists; how to complain, including to the Privacy Commissioner; and where the proportionality assessment can be accessed, where it has been made available. A camera with a small sign referencing a website no longer clears the bar if the specifics are not there.

The requirement to offer and disclose an alternative is the one that bites architecturally. If your only route through a process is to present your face or your voice, you have to be able to justify why no alternative is offered, and you have to design the estate so that the alternative — where one is required — is real, not a hidden fallback that staff have to be asked for twice. This is the same design tension that runs through age assurance and estimation systems, where a biometric check has to sit alongside a non-biometric path rather than replace it outright.

What you may not infer

The use rule draws a hard line around biometric categorisation. Using biometric information to infer a person’s emotions, mood, health, personality or protected characteristics is restricted, permitted only in narrow circumstances such as express consent or the delivery of a health service. This is the provision that rules out the emotion-recognition and “sentiment from voice” features that vendors increasingly bundle into contact-centre and analytics platforms. If a supplier is offering to tell you whether a caller is angry, or to estimate wellbeing from a face, that capability is presumptively off-limits under this Code unless you can fit it into an exception — and most deployments cannot.

The governance point is that this constraint has to be enforced at the level of what the system is configured to do, not what your policy says it does. A platform with emotion analytics switched on by default, processing New Zealand data, is a live exposure regardless of whether anyone reads the output.

Who this is for

• CTOs and product owners running facial recognition, voice biometrics or behavioural verification for New Zealand users or customers.
• Firms doing biometric identity verification for onboarding or AML checks, where the same face-match technology sits at the front door — the pattern also visible in private-sector digital ID onboarding across the Tasman.
• Compliance and privacy leads mapping this alongside the broader wave of privacy regimes going live in 2026, where biometric-specific rules increasingly sit on top of general privacy law.

Design it in, or retrofit it under deadline

The uncomfortable truth for anyone with a live deployment is that consent flows, alternative pathways, deletion of non-match templates and a defensible proportionality assessment are far cheaper to design in than to bolt on to a running system weeks before a compliance deadline. Retrofitting transparency onto a facial-recognition estate that was scoped purely for throughput means re-engineering the enrolment journey, the notices, the retention logic and, in some cases, the vendor contract, all at once. The Code has already been in force for months. The organisations that will struggle in August are the ones still treating a face and a voiceprint as ordinary data.