New Zealand
Privacy Act 2020 and Biometric Processing Privacy Code 2025
New Zealand has a dedicated code for biometric processing under its Privacy Act. The Biometric Processing Privacy Code came into force on November 3, 2025, and organisations already using biometrics had until August 3, 2026 to comply. It covers organisations that collect biometric information in an automated process to verify, identify or categorise people, including with facial recognition.
Key Provisions
- Collect only what is needed, and only where the benefits are proportionate to the likely impact on people
- Put privacy safeguards in place before collecting
- Tell people why you are collecting their information and whether alternatives exist
- Use it only for the purpose it was collected for
- Biometric categorisation is generally barred unless an exception applies
- Detecting health information needs the person's specific authorisation
Your Biometric Rights
- Right to know why your biometric information is collected
- Right to ask whether an organisation holds your biometric information
- Right to see it
- Right to have it corrected if it is wrong
- Right to complain to the Privacy Commissioner
Penalties for Non-Compliance
The Privacy Commissioner can issue compliance notices. The Human Rights Review Tribunal can award damages, including for humiliation, loss of dignity and injury to feelings. Certain offences, such as failing to comply with an access order, carry a fine of up to NZD $10,000.
What We Do Here
We file opt-out requests on your behalf with the face search engines we support, and re-file as necessary. The Privacy Act and the Biometric Processing Privacy Code give people in New Zealand rights of access and correction. We file through each engine's own opt-out process rather than under the Privacy Act, and a complaint to the Privacy Commissioner is yours to make.
Get ProtectedOfficial sources
Government, regulator, court and parliament pages we checked this page against. This is general information, not legal advice.