By the SightShield team · · 3 min read
Biometric templates are personal data
When an attendance terminal enrols a fingerprint or face, it stores a mathematical template linked to an employee. Under India’s Digital Personal Data Protection Act, 2023, that is personal data. Unlike the older 2011 rules, the DPDP Act does not create a separate "sensitive" category — but a leak of biometric data is serious, because people cannot change their fingerprints or face.
This is general information, not legal advice.
Employment use
The Act allows employers to process personal data without separate consent for the purposes of employment and to safeguard the employer from loss or liability. Commentators generally read this as covering attendance biometrics, though its exact reach is still being discussed. Even so, employers should tell staff what is collected and why, and protect it.
Face recognition cameras and privacy →What to tell employees
- What is collected: a face or fingerprint template, not a stored photo, where that is the case.
- Why: attendance, payroll and premises security.
- Where it is stored: on the device, an on-premise server, or a cloud service, and in which country.
- Who can access it: named roles such as HR and IT administrators.
- How long it is kept: deleted when employment ends, or within a set period.
- Alternatives: a card or PIN for anyone who cannot use biometrics.
- Whom to contact with questions.
Timelines and penalties
- DPDP Rules notified in November 2025.
- Most obligations — notices, security safeguards, breach reporting, retention and individuals’ rights — start around May 2027 (18 months after the Rules).
- Penalties go up to Rs 250 crore for failing to keep reasonable security safeguards.
If there is a breach
Under the DPDP Act and Rules, a data fiduciary must inform the Data Protection Board of India and each affected person of a personal data breach. The Rules set out what the notice should include and require a fuller report to the Board within 72 hours of becoming aware of the breach. Practically, that means knowing in advance who in your organisation decides, who contacts the vendor, and how you will notify employees. The Rules also expect logs to be retained for a minimum period so that breaches can be investigated.
Practical safeguards
- Choose terminals and software that store templates securely (on the device or encrypted).
- Use liveness detection so templates cannot be misused with photos.
- Limit administrator access to the terminal and software; change default passwords.
- Put terminals on a secure network, not open to the internet.
- Delete templates promptly when employees and contract workers leave.
- With cloud software, check where data is stored and how it is protected.
- Write a short policy on biometric attendance and share it with staff.
Questions to ask your vendor
- Are templates stored encrypted on the device and in the software?
- Can raw images be disabled, keeping only templates?
- Where are cloud servers located, and who can access the data?
- Does the device support liveness detection?
- How are firmware security updates delivered?
- Can we export and delete an individual’s data on request?
- What logs of administrator access are kept?
Quick answers
Do employers need consent for biometric attendance?+
The DPDP Act allows processing for employment purposes without separate consent, but employers should still inform staff and protect the data.
Is biometric data "sensitive" under the DPDP Act?+
The Act has no separate sensitive category, but biometric data is personal data and a breach is high-impact, so strong safeguards are expected.
What happens to biometric data when an employee leaves?+
Delete their templates from terminals and software in line with your retention policy.
Can employees refuse biometric attendance?+
Employment use may allow processing without consent, but offering an alternative such as a card or PIN for those with genuine reasons is good practice and avoids disputes.
Are face photos stored on the machine?+
Many devices store mathematical templates; some also store enrolment photos. Check the settings and disable photo storage where it is not needed.