Who does the Biometrics Code apply to?

The Biometrics Code applies to organisations that collect people’s biometric information in an automated process to verify, identify or categorise them i.e. carry out biometric processing(external link). 

There are a few cases where the Biometrics Code will not apply:

• If the organisation is a health agency and carries out biometric processing using health information, the Code won’t apply (they are covered by the Health Information Privacy Code instead). But the Biometrics Code will apply to health agencies doing biometric processing on biometric information that is not health information – e.g. if the health agency is using facial recognition to confirm the identity of its employees.
• The Code generally does not apply to personal consumer devices like smartwatches, fitness trackers, or VR headsets.
• Some rules do not apply to the New Zealand Security Intelligence Service and the Government Communications Security Bureau because of the special nature of their work (and is similar to how these agencies are treated under the Privacy Act).
• The Code generally does not apply obligations to individual people in their personal capacity, unless what they are doing is unlawful or highly offensive (this is how individuals are treated under the Privacy Act).

It’s important to remember that even if the Code doesn’t apply, the Privacy Act may still apply. For example, the Act applies to manual uses of biometric information. The Privacy Act also applies to the results of biometric processing e.g. match alerts, similarity scores, age-estimates.

The Biometrics Guidance contains more information on who the Code applies to.

Updated November 2025