The Biometric Privacy Code Deadline Has Passed. Voice AI Is In Scope.
On 3 August 2026 the grace period under New Zealand's Biometric Processing Privacy Code ended. Businesses that were already processing biometric information had been given until that date to come into compliance, and that runway is now gone. If your business uses facial recognition, fingerprints or voiceprints, the code applies in full today, on top of your existing obligations under the Privacy Act 2020.
What the code covers, including the part people miss
The code sets out thirteen rules covering the collection, use and management of biometric data, and explicitly names facial recognition, fingerprints and voiceprints. The voiceprint inclusion is the one catching businesses out, because it pulls a category of AI deployment into scope that most owners never filed under "biometrics". If a system builds a voice profile to recognise a caller, that is biometric processing. Health agencies operating under the Health Information Privacy Code are carved out, as are select national security agencies, and biometrics on personal devices like a phone or watch generally sit outside the law. Almost nobody reading this is inside those exemptions.
Necessary and proportionate is the real test
The central test is that any collection and use of biometric information must be necessary and proportionate. That is a higher bar than consent, and it is not satisfied by a line in a privacy policy. It asks whether you could achieve the same outcome without the biometric data. In most commercial deployments the honest answer is yes, which means the compliant design is the one that does not collect it. This is a case where the legal requirement and the sensible engineering decision point the same direction: do not store what you do not need, because stored data is a liability with a maintenance cost.
Voice AI without biometric processing
The good news for anyone running or considering AI on their phone line is that voice AI does not require biometric processing. A voice AI agent that answers a call, understands what the caller wants, books the job and writes it into your system is doing speech recognition, not voice identification. It converts audio to text and acts on the text. No voice profile is created and no caller is identified by the characteristics of their voice. Built that way, an AI receptionist sits outside the code entirely, which is how we build them.
What to tell callers, and when
The distinction matters commercially as well as legally. Voice identification is usually pitched as a convenience feature, recognising a returning customer without them saying who they are. Weigh that against the compliance obligations it triggers and it rarely survives the comparison. Asking a caller for their name or job number costs two seconds and no regulatory exposure.
Where this leaves existing deployments
Whatever you deploy, callers should be told what is happening. Where you are collecting biometric information you must get it straight from the people concerned where possible, tell them why, and say whether an alternative exists. Even where you are not, an AI answering the phone should say so, and there should be a route to a human. That is not a legal requirement in every case, it is what stops the deployment damaging the relationship it was meant to protect. Our full position is on the responsible AI page.
If you already have something running that touches voice, face or fingerprints, the transition period is over and the question is no longer whether to review it. Work out first whether you are doing biometric processing at all, because many businesses find they are not and the exercise ends there. If you are, the tests are necessity and proportionality, and those are design questions before they are paperwork questions. We are happy to look at what you have running and tell you which side of the line it falls on. Start a conversation.
Ready to put AI to work in your business?
We find the one workflow costing you the most time or the most leads, ship it into production, and prove what it saved. Businesses across New Zealand.
Citation
@online{kiwidynamics2026biometricprivacycodeandvoice,
author = {Kiwi Dynamics},
title = {The Biometric Privacy Code Deadline Has Passed. Voice AI Is In Scope.},
date = {2026-08},
year = {2026},
url = {https://kiwidynamics.co.nz/blog/biometric-privacy-code-and-voice-ai-in-new-zealand},
}Was this helpful?
Thanks, that helps.
Related content
-
Australian SMEs Are Reporting Bigger AI Gains Than Enterprises
Australian small and medium businesses implementing AI report 25 to 35% productivity gains, against 15 to 20% for large enterprises. Why the smaller operation has the structural advantage.
Read more -
Where Does Your Business Data Actually Go When You Use AI?
Privacy and security is the single most cited barrier to AI adoption in New Zealand. A plain-language guide to what happens to your data, and how to build so the answer is one you can defend.
Read more -
The Missing Role Blocking AI Projects in NZ and Australia
Research into Australian AI adoption names an acute shortage of "AI Translators", people who understand both the technology and the operation. That gap, not the technology, is why most AI projects stall.
Read more