Your regulation, in plain terms
Biometric attendance laws compared
| Law | Lawful basis | Retention | Transfers abroad |
|---|---|---|---|
| EU: GDPR | Explicit consent or a specific national law, plus proof that biometrics are necessary | Only as long as the purpose needs | Adequacy decision or safeguards such as standard contractual clauses |
| US: Illinois, Texas | Illinois: written policy, then written consent before collection. Texas: notice and consent | Illinois: when the purpose ends or three years after the last interaction, whichever comes first. Texas: within a year of the purpose ending | No transfer rules. Selling the data is restricted |
| India: DPDP Act | Written consent under the SPDI Rules until 13 May 2027. After that, consent or the “legitimate use” for employment purposes | Erase once the purpose is served | Allowed unless the government restricts the destination |
| Türkiye: KVKK | A 2026 Board decision treats biometric time-keeping as unlawful, even with consent. Biometric access control is assessed case by case | Delete, destroy or anonymise when the purpose ends | Adequacy decision or safeguards such as the Board’s standard contract |
| Gulf: Saudi and UAE PDPL | Consent in most cases. The UAE law also allows employment-obligation grounds | No longer than the purpose requires | Allowed where set conditions are met, such as adequate protection abroad |
Washington also has a biometric law, but it targets commercial uses such as marketing and generally doesn’t cover attendance.
Fines and penalties under each law
Illinois is the only one of these laws that lets employees sue directly. Everywhere else, a regulator or state attorney general enforces.
| Law | Maximum penalties |
|---|---|
| GDPR | €20 million or 4% of worldwide annual turnover, whichever is higher |
| Illinois and Texas | Illinois: $1,000 per negligent violation and $5,000 per intentional or reckless one, counted per person, plus legal fees. Texas: up to $25,000 per violation |
| India DPDP Act | Up to ₹250 crore for failing to protect data, ₹200 crore for failing to report a breach and ₹50 crore for other breaches |
| Türkiye KVKK | Up to TRY 17,092,242 in 2026 for data security failures, with limits raised each January. Unlawfully recording personal data is also a criminal offence |
| Saudi and UAE PDPL | Saudi Arabia: a warning or up to SAR 5 million, doubled for repeat offences, and up to two years in prison or SAR 3 million for disclosing sensitive data to cause harm or for gain. UAE: penalties not yet published |
In 2020 the Dutch regulator fined an employer €725,000 for fingerprint attendance without a valid GDPR exception, and found that former employees’ templates had been blocked but never deleted.
Before you enrol the first employee
- Give notice. Tell staff what is captured (a template, not a photo), why, who can see it, how long it’s kept and how to object. Illinois also requires a public written retention policy.
- Record your lawful basis. If it’s consent, collect it before enrolment and make sure refusing carries no penalty.
- Assess the impact. The GDPR usually requires an impact assessment before go-live. Elsewhere, write down why a card or PIN wouldn’t do the job.
- Set two retention periods. Templates should go when someone leaves at the latest. Attendance records follow payroll and employment-law rules.
- Offer an alternative. Keep RFID, barcode or manual check-in available for anyone who declines.
The free templates below cover the consent and retention steps.
Cloud or on-premises
NCheck Cloud is hosted and run by NCheck. NCheck On-Premises runs on your own server, so biometric data never leaves your network or your country, which suits employers who’d sooner keep data in-country and sites whose security policy rules out third-party hosting. It’s the same product either way, and you can move from cloud to on-premises later. More on data residency and biometric data.
How NCheck helps everywhere
On-premises deployment · encrypted templates · photo retention you set · retention limits & deletion · audit trail.
Consent form & retention policy templates
Enter your work email and download both as editable .docx files. Adapt them with your counsel.
This page and the templates are general guidance, not legal advice. Laws change; confirm current requirements with your counsel.
Common in these industries
Healthcare · Education · Government · Manufacturing · Retail · Construction · all industries
Further reading: Biometric attendance and GDPR: a practical guide · Biometric attendance and data privacy
Frequently asked questions
Is biometric attendance legal?
In many countries it is, as long as the employer meets the local conditions, which broadly match the checklist above. The exceptions are significant: Türkiye’s regulator has treated biometric time-keeping as unlawful since June 2026, even with consent, and regulators in Italy and Spain take a similarly restrictive view. Check your national guidance before enrolling anyone.
Do employees have to consent?
Illinois requires written consent before collection, India requires it in writing until May 2027, and consent is the usual basis for biometrics in Saudi Arabia. Under the GDPR, consent is hard to rely on at work because of the imbalance of power, so some EU countries use a specific national law instead. In Türkiye, consent no longer makes biometric attendance lawful.
What if an employee refuses?
Offer another way to check in and make sure refusing costs them nothing. NCheck supports RFID cards, barcodes and manual check-in on the same account, so their hours land in the same timesheet.
Do these laws apply if only templates are stored?
Yes, because a template is what the system uses to recognise someone, so the laws on this page treat it as biometric data. It does lower the risk if a device is compromised, since a template can't be turned back into a picture.