Biometric Time and Attendance Systems: Useful… but Risky
Biometric time and attendance systems that rely on fingerprints, facial scans, or voice prints promise fewer “buddy punches” and more accurate payroll. But the very systems that make this possible handle some of the most sensitive information an organisation can collect about its staff.
From 3 November 2025, the Biometric Processing Privacy Code 2025 introduces enforceable rules for these systems. Organisations already using them have until 3 August 2026 to comply.
The risks aren’t small. Biometric time and attendance systems create several privacy challenges:
Irreplaceable identifiers – unlike a password, biometrics can’t be reset. A breach follows someone for life.
Function creep – a tool for timesheets can quickly become a tool for monitoring staff movements, performance, or behaviour.
Accuracy issues – errors in identification can cause payroll mistakes and raise discrimination risks if some groups are less accurately recognised.
Under the Code, organisations will need to:
Demonstrate the system is necessary, effective, and proportionate, and that less intrusive options (like cards or PINs) won’t reasonably achieve the same outcome.
Be transparent: explain what’s being collected, why, how it’s stored, who can access it, where it’s held, and what alternatives exist. Staff must be given a genuine choice to opt out, with no repercussions.
Minimise data: use templates rather than raw images wherever possible.
Ensure robust offboarding: delete biometric data promptly when individuals leave.
It’s also considered best practice to complete a Privacy Impact Assessment and engage openly with employees and unions before and during use.
Biometric time and attendance systems can still be used in New Zealand, but only when they are the least intrusive workable option, implemented transparently, and carefully managed. If a swipe card, PIN, or geofenced app can achieve the same result, you’ll need to be ready to justify why biometrics are truly required.
If you’d like help reviewing your time and attendance system and its alignment with the Biometrics Code, we’d be happy to support you.