What the law requires
- Biometric data used to identify a person is special-category data. Processing it requires both a lawful basis under Article 6 and an exception under Article 9. For attendance, the exceptions employers usually consider are explicit consent (Art. 9(2)(a)) and a specific national law or collective agreement (Art. 9(2)(b)).
- Member states may set further conditions for biometric data (Art. 9(4)), so requirements differ between EU countries.
- A data protection impact assessment (DPIA) before deployment (Art. 35). Biometric processing of employees meets several of the risk criteria regulators apply, and authorities including the CNIL and AEPD expect one.
- Data minimisation, storage limitation and security of processing (Art. 5 and 32): encryption, access controls, no keeping data longer than needed.
- Transparency and rights: a clear privacy notice, records of processing, and honouring access, erasure and consent-withdrawal requests.
- Transfers outside the EU/EEA require safeguards (adequacy decision or standard contractual clauses).
How EU regulators view biometric attendance
The GDPR applies uniformly across the EU, but national supervisory authorities interpret it in light of their own laws and guidance. Several have addressed biometric attendance directly.
| Country | Position |
|---|---|
| Spain AEPD guidance | Guidance published in November 2023 considers employee consent valid only in exceptional cases and finds no general basis for biometric attendance in Spanish law. Sanctions applying the guidance began in 2024. |
| France CNIL model regulation | The 2019 model regulation permits biometrics to control access to premises, devices and applications, but not to record working time. The CNIL regards biometric time recording as excessive save in exceptional circumstances. |
| Italy Garante | The Garante’s position is that no Italian law permits biometric attendance and that employee consent is not a valid basis. In 2024 it fined five companies a combined €103,000, and separately a car dealership €120,000. |
| Netherlands AP decision | Dutch law permits biometrics where necessary for authentication or security. In 2020 the AP fined an employer €725,000, finding that fingerprint time registration met neither that test nor the standard for valid consent. |
Outside the EU, the UK Information Commissioner applied similar reasoning under the UK GDPR in February 2024. It ordered Serco Leisure and associated trusts to stop facial recognition and fingerprint attendance for more than 2,000 employees, as less intrusive means such as cards or fobs were available.
These positions leave more room for biometrics in access control to restricted areas, where a security case can be made, than in routine time recording. NCheck supports RFID, barcode and manual check-in on the same account as face, fingerprint and iris, so organisations can confine biometrics to the areas where they are justified.
Fines and penalties under the GDPR
Article 83 sets two tiers of administrative fine. The enforcement cases above rested mainly on the absence of a valid Article 9 exception, which falls in the higher tier.
| Infringement | Maximum fine |
|---|---|
| Processing without a valid Article 6 basis or Article 9 exception, or breaching the core principles, data subject rights or transfer rules | €20 million or 4% of worldwide annual turnover, whichever is higher |
| Failures in controller obligations, including the DPIA and security of processing | €10 million or 2% of worldwide annual turnover, whichever is higher |
Supervisory authorities can also order processing to stop and data to be erased, as in the Italian and UK cases. Employees may claim compensation under Article 82.
Before you enrol the first employee
- Review your national regulator’s guidance. In Spain and Italy, it currently leaves little or no room for biometric attendance.
- Complete a DPIA before go-live, recording why less intrusive methods such as cards or fobs would not meet the need.
- Document both legal grounds: an Article 6 lawful basis and an Article 9 exception. Where consent is relied on, it must be explicit and freely given, with an equivalent alternative and no detriment for declining.
- Update the privacy notice and your records of processing (Art. 30).
- Define retention and deletion. Erase departing employees’ templates in full; the Dutch fine cited templates that had been blocked but never deleted.
Free templates: Download the free consent-form and retention-policy templates →
How NCheck supports it
As the employer, you are the data controller, so the decision to use biometrics, and the legal basis for doing so, rests with you. NCheck provides controls that help you meet your obligations once that decision is made.
- Full on-premises deployment, so biometric data stays on your own servers and in your own country. NCheck Cloud is also available. See on-premise attendance software.
- Encrypted, non-reversible templates. Event photos can be deleted automatically after a period you set.
- RFID, barcode or manual check-in available for employees who decline biometrics.
- Retention limits and deletion tools, plus a full audit trail for accountability.
Where data is held forms part of the DPIA. For NCheck Cloud, hosting arrangements should be reviewed against your assessment. NCheck On-Premises keeps templates on your own infrastructure, with no third-party hosting involved. More on data residency and biometric data.
Common in these industries
Healthcare · Government · Enterprise · Precious metals · High security · all industries
Further reading: Biometric attendance and GDPR: a practical guide
Frequently asked questions
Is biometric attendance permitted under the GDPR?
The GDPR does not prohibit it outright, but biometric data may only be processed under an Article 9 exception, and few apply to routine attendance. Regulators in Spain and Italy do not generally accept employee consent for this purpose, and Dutch law permits biometrics only where necessary for authentication or security. Employers should review national guidance and complete a DPIA before deciding.
Must the system run on our own servers?
No. The GDPR does not require on-premises hosting, but where data is held forms part of the DPIA. NCheck Cloud stores encrypted templates and deletes event photos on your schedule, and NCheck On-Premises keeps all data within your own network.
How long may biometric templates be kept?
Only as long as the purpose requires. Templates should be erased when an employee leaves, with a separate retention period for attendance records set by payroll and employment-law obligations. NCheck supports deletion per employee and configurable record retention.
What should the employee privacy notice include?
The data captured (a template, not an image), the purpose, the legal basis, the retention period, who has access, the alternative method and how to withdraw consent. NCheck’s free consent and retention templates address these points.
This page is general guidance, not legal advice. Laws change; confirm current requirements with your counsel.
Deploy it the compliant way
Run NCheck fully on your own server — data never leaves your network — or in NCheck Cloud. Either way, matching uses encrypted templates, and event photos can be deleted automatically after a period you set. About on-premises → · Security & compliance →