Fingerprint and face recognition access control: what the NZ Biometrics Code means for your business

If your doors, turnstiles or time clocks use fingerprints or faces, the Biometric Processing Privacy Code 2025 applies, and since 3 August 2026 it applies to older systems too. Here is what that means in practice for an Auckland business.

By the Com4 team, Penrose · Updated 26 October 2026

Short answer: yes, a fingerprint reader, face recognition reader or biometric time clock on your site is covered by the Biometric Processing Privacy Code 2025. The Code applied to new systems from 3 November 2025, and to systems already running before then from 3 August 2026. You need to be able to show the biometric option is necessary and proportionate, tell people clearly before you enrol them, offer an alternative where you have one, protect the templates and delete them when people leave. Ordinary CCTV that nobody runs facial recognition on is not covered by the Code, but the Privacy Act still applies to it.

What is the Biometric Processing Privacy Code?

The Biometric Processing Privacy Code 2025 is a code of practice issued by the Privacy Commissioner under the Privacy Act 2020. It was issued on 21 July 2025 and sets out 13 rules for organisations that collect and use people's biometric information. For biometric processing that started on or after 3 November 2025, it applied straight away. Organisations that were already using biometrics had a nine-month transition period, which ended on 3 August 2026. In other words, if you have had fingerprint readers on your doors for years, the Code now applies to them.

The Code applies to all organisations, including businesses, schools, NGOs and government agencies. It was amended in March 2026 (Amendment No 1, in force from 1 May 2026) to line up with the new IPP 3A notification rule.

Does it apply to my access control or time clock?

It applies when a system compares or analyses biometric information to verify who someone is, identify them, or categorise them. The Privacy Commissioner's guidance gives fingerprints, palm prints, face images, iris scans and voice as common examples. For a typical commercial site, that means:

Covered: fingerprint or face readers on doors, gates and turnstiles; biometric time and attendance clocks; face recognition at a site entry; fingerprint login on shared terminals; facial recognition analytics run on CCTV footage.
Not covered by the Code: card, fob, PIN and mobile phone credentials; CCTV footage that is only watched by people; a staff photo printed on an ID card; camera analytics that detect a person or vehicle without identifying who they are.

Anything outside the Code is still personal information under the Privacy Act if it is about an identifiable person. Our CCTV and Privacy Act guide covers the rules for ordinary camera systems.

What do we have to do to comply?

The Code has 13 rules. For access control and time clocks, these are the ones that drive most of the practical work.

Rule 1: be able to justify it

You need a lawful purpose, and the biometric processing must be necessary (it is effective, and you cannot reasonably achieve the purpose as effectively with something less privacy-intrusive), have appropriate safeguards, and be proportionate to the impact on people. The Privacy Commissioner expects you to look at alternatives such as cards, fobs or PINs, and to weigh up things like the power imbalance in an employment relationship and cultural impacts for Māori, for example where people wear moko. Write the assessment down. It is what you will rely on if a staff member or the Commissioner asks why you chose biometrics.

Rule 3: tell people, clearly, before you collect

Before or when you collect, you must tell people in a "clear and conspicuous" way that biometric information is being collected, why, and whether there is an alternative, plus where to find more information. You also need to tell them who will receive it, your name and address, what happens if they decline, their rights to access, correction and to complain to the Privacy Commissioner, and a summary of how long you keep it. For staff, the natural time to do this is at enrolment, with a sign at the reader as a reminder. You do not need to repeat the full notice every time someone scans in.

Rule 5: protect the templates

Biometric information needs layered security that matches its sensitivity. The guidance specifically suggests keeping only templates rather than raw images where you can, storing locally or on the device where appropriate, keeping biometric data separate from other systems, individual admin logins, patching, and checking what a cloud or software provider does with the data. If a provider holds it for you, you are still responsible.

Rule 9: delete it when you no longer need it

Do not keep biometric information longer than your purpose requires. In practice that means removing a person's templates as part of offboarding when they leave or no longer need access, and setting up automatic deletion where the system allows it.

Other rules cover fair collection, access and correction requests, accuracy, limits on use and disclosure, overseas transfers and categorisation (such as inferring mood or age), which most door access systems do not do.

Is a fingerprint reader still a good idea for our doors?

Sometimes. The Privacy Commissioner's own examples show biometrics can be justified, for example fingerprint verification to protect highly sensitive information, or face recognition to control access to a dangerous worksite where workers in protective gear cannot easily use cards. They also show where it is not justified: face recognition to pay at a school cafeteria was assessed as neither necessary nor proportionate.

For most offices and warehouses, a modern encrypted card, fob or mobile credential does the job with far less privacy risk and paperwork. Where biometrics earns its place is usually high-security rooms (server rooms, pharmacies, cash and evidence stores), sites where shared or passed-on cards are a real problem, or as a second factor alongside a card on the doors that matter most. When we design access control, we start with the risk and the doors, not the gadget.

We already have biometric readers. What should we do now?

List every biometric device on site: door readers, time clocks, turnstiles, and any face recognition features switched on in CCTV software.
For each one, write down why you use it and whether a card, fob, PIN or phone would do the same job.
Check where templates are stored (reader, controller, server or cloud), who can access them, and whether raw images are kept.
Make sure leavers' templates are deleted as part of offboarding, and clear out old enrolments.
Put a clear notice at each reader and in your staff privacy information, and offer an alternative credential where you can.
Talk to your staff. The Privacy Commissioner's examples consistently include consulting the people affected.
If a device no longer earns its place, switch it to card or mobile and delete the stored biometric data.

A security audit is a straightforward way to get this list together across one or several sites, and our design and consulting service can help you plan a change of credentials without disrupting the business.

How Com4 can help

Com4 has been installing commercial security in Auckland since 2011, as Com4 since 2023, and holds PSPLA licence 25-128630. We can audit what is on your doors, show you where biometric data actually lives in your system, tighten admin access and deletion settings, or move you to card or mobile credentials. We are security contractors, not lawyers, so for the written necessity and proportionality assessment, use the Privacy Commissioner's guidance or your own legal adviser. We work across Auckland, from Penrose and East Tāmaki to the CBD, for commercial and industrial sites, construction projects and healthcare. Call 0800 266 444 or use the form below.

Frequently asked questions

Does the Biometrics Code apply to fingerprint time clocks?

Yes. A time clock that compares a worker's fingerprint or face against an enrolled template is biometric processing by a biometric system, so the Code applies. Systems that were already running before 3 November 2025 have had to comply since 3 August 2026.

Is ordinary CCTV covered by the Biometric Processing Privacy Code?

Not if the footage is only viewed by people. The Privacy Commissioner's guidance says CCTV footage that is not processed by a biometric system is outside the Code, although the Privacy Act still applies. If you switch on facial recognition or similar identification features, the Code applies to that processing.

Do we have to offer staff an alternative to fingerprints?

The Code requires you to tell people whether an alternative is available and how to use it. Whether you must offer one depends on your rule 1 assessment: if a card or PIN would achieve your purpose as effectively with less privacy risk, it is hard to show biometrics is necessary. In the Privacy Commissioner's examples, offering a choice is one of the ways organisations reduce the impact on employees.

How long can we keep fingerprint templates?

No longer than you need them for your purpose. For access control and time clocks, that usually means deleting a person's templates when they leave or no longer need access, and telling people your retention approach when they enrol.

What happens if we do not comply?

People can complain to the Privacy Commissioner about any action the Code applies to, and a failure to comply with any of its rules can be an interference with someone's privacy. The Commissioner uses its guidance as the benchmark when investigating and decides on compliance action based on factors such as the seriousness of the breach, the risk of harm and how the organisation has behaved.

Sources

Office of the Privacy Commissioner, Biometric Processing Privacy Code 2025
Office of the Privacy Commissioner, Guidance on complying with the Biometrics Code
Office of the Privacy Commissioner, Who and what does the Code apply to?
Office of the Privacy Commissioner, Rule 1: Purpose of collection and Rule 1 examples
Office of the Privacy Commissioner, Rule 3: Tell people about the information you collect
Office of the Privacy Commissioner, Rule 5: Security of biometric information and Rule 9: Retention
Office of the Privacy Commissioner, Complaints under the Code
Office of the Privacy Commissioner, Using facial recognition to control access to a dangerous worksite
New Zealand Gazette, Biometric Processing Privacy Code 2025 notice (commencement dates)
New Zealand Legislation, Privacy Act 2020

This guide is general information, not legal advice. For your specific situation, see the Privacy Commissioner's guidance or get legal advice.

Request a quote

Tell us what you need secured and where. Paul or one of the Com4 team will come back to you, usually to arrange a site visit so the quote is based on your actual doors, cabling routes and network.

Commercial and industrial sites across Auckland
New installs, upgrades and takeovers of existing systems
Tender and builder pricing welcome
Free site survey

Not sure what you need yet? Choose Free 15-minute security consultation in the form and one of our team will call you to talk it through, no obligation.

Prefer to talk? Call 0800 266 444 or email info@com4.nz.