Written by Kiwi Dynamics Team 1What the code covers, including the part people miss
The code sets out thirteen rules covering the collection, use and management of biometric data, and explicitly names facial recognition, fingerprints and voiceprints. The voiceprint inclusion is the one catching businesses out, because it pulls a category of AI deployment into scope that most owners never filed under "biometrics". If a system builds a voice profile to recognise a caller, that is biometric processing. Health agencies operating under the Health Information Privacy Code are carved out, as are select national security agencies, and biometrics on personal devices like a phone or watch generally sit outside the law. Almost nobody reading this is inside those exemptions.
2Necessary and proportionate is the real test
The central test is that any collection and use of biometric information must be necessary and proportionate. That is a higher bar than consent, and it is not satisfied by a line in a privacy policy. It asks whether you could achieve the same outcome without the biometric data. In most commercial deployments the honest answer is yes, which means the compliant design is the one that does not collect it. This is a case where the legal requirement and the sensible engineering decision point the same direction: do not store what you do not need, because stored data is a liability with a maintenance cost.
3Voice AI without biometric processing
The good news for anyone running or considering AI on their phone line is that voice AI does not require biometric processing. A voice AI agent that answers a call, understands what the caller wants, books the job and writes it into your system is doing speech recognition, not voice identification. It converts audio to text and acts on the text. No voice profile is created and no caller is identified by the characteristics of their voice. Built that way, an AI receptionist sits outside the code entirely, which is how we build them.
4What to tell callers, and when
The distinction matters commercially as well as legally. Voice identification is usually pitched as a convenience feature, recognising a returning customer without them saying who they are. Weigh that against the compliance obligations it triggers and it rarely survives the comparison. Asking a caller for their name or job number costs two seconds and no regulatory exposure.
5Where this leaves existing deployments
Whatever you deploy, callers should be told what is happening. Where you are collecting biometric information you must get it straight from the people concerned where possible, tell them why, and say whether an alternative exists. Even where you are not, an AI answering the phone should say so, and there should be a route to a human. That is not a legal requirement in every case, it is what stops the deployment damaging the relationship it was meant to protect. Our full position is on the responsible AI page.
If you already have something running that touches voice, face or fingerprints, the transition period is over and the question is no longer whether to review it. Work out first whether you are doing biometric processing at all, because many businesses find they are not and the exercise ends there. If you are, the tests are necessity and proportionality, and those are design questions before they are paperwork questions. We are happy to look at what you have running and tell you which side of the line it falls on. Start a conversation.