Biometric Attendance Under DPDP: Fingerprints, Face Recognition and the Law

ConsentifyAI Team24 August 20263 min read

TL;DR

Biometric attendance is common in Indian workplaces, and the DPDP Act does not ban it. Attendance is an employment purpose under Section 7(i), but biometrics cannot be changed if they leak, so the bar for security and proportionality is high. Use templates rather than images, encrypt them, limit access, contract the device vendor properly, offer alternatives where practical and delete biometric data promptly when employees leave.

Who this is for: HR, facilities, security and procurement teams that run or buy biometric attendance and access systems.

Fingerprint scanners at the office entrance and face-recognition attendance apps for field staff are everywhere in India. They are convenient and resistant to "buddy punching". They also involve data that is uniquely permanent: an employee can change a leaked password, but not a leaked fingerprint.

The DPDP Act does not create a special category for biometric data. Under the earlier framework, the 2011 rules under Section 43A of the IT Act treated biometrics as sensitive; the DPDP Act omits Section 43A, and with it that classification falls away as the new regime takes effect. That does not make biometrics low-risk. It means the protection must come from how you handle them.

The lawful basis

Recording attendance and controlling access to premises are employment purposes and protect the employer from loss, so biometric attendance can generally rely on Section 7(i). You do not need consent, and asking for it would be unreliable given the employment relationship.

But a lawful basis does not settle proportionality. Ask:

Does attendance genuinely need biometrics, or would a card, PIN or app check-in work?
Can employees with a valid reason (injury, religious concerns, worn fingerprints) use an alternative?
Is face recognition capturing visitors or passers-by who never enrolled?

Security: the heart of the obligation

Section 8(5) and Rule 6 require reasonable security safeguards, and for biometrics, reasonable means strong:

Templates, not images. Store mathematical templates rather than raw fingerprint or face images.
Encrypt templates at rest and in transit, on devices and servers.
Local where possible. On-device matching reduces central databases.
Restrict access. Very few administrators should be able to export biometric data.
Log and monitor access, and keep logs for at least a year.
Patch devices. Attendance terminals are often forgotten network devices.

A biometric breach must be reported to affected employees and the Data Protection Board like any other personal data breach, and failing to take reasonable safeguards carries the highest penalty under the Act, up to ₹250 crore. See the Rule 7 playbook.

The device vendor is your processor

Biometric systems are usually supplied and often hosted by a vendor. Under Section 8(2), you need a valid contract that covers:

where templates are stored and processed, and whether they leave India (Section 16)
encryption and access controls
breach notification within a short window
no use of your employees' biometrics for the vendor's own purposes, including training face-recognition models
deletion of templates on request and at contract end

See data processing agreements in India.

Retention

Delete an employee's biometric templates promptly when they leave, from devices, servers and vendor systems. Attendance records (dates and times) may need to be kept for labour-law purposes, but the biometric template itself is not the record and should not be kept with it. See HR records retention.

Tell employees

Explain in your employee privacy notice that biometric attendance is used, what is stored, where, for how long, who can access it and how to request an alternative.

Checklist

Purpose and basis recorded in the ROPA
Alternatives available where practical
Templates stored, not images; encrypted everywhere
Hosting location and vendor contract checked
Restricted, logged administrative access
Templates deleted promptly on exit
Face recognition limited to enrolled employees
Employees informed

How ConsentifyAI helps

ConsentifyAI records biometric processing in your ROPA with its purpose, basis, vendor, hosting location and retention, links it to the vendor's contract, and triggers deletion tasks when employees leave, so you can show that biometric data is controlled from enrolment to exit.

Sources & references

DPDP Act, 2023 — Section 7(i)
DPDP Act, 2023 — Section 8(2), 8(5), 8(6), 8(7)
DPDP Act, 2023 — Section 16
DPDP Rules, 2025 — Rule 6, Rule 7

Frequently asked questions

Is biometric attendance legal under the DPDP Act?

Yes. Attendance is an employment purpose under Section 7(i). But biometric data is highly sensitive in practice, so security, minimisation and retention must be strong.

Do we need employee consent for biometric attendance?

Not necessarily, because attendance falls within employment purposes. Consent from employees is hard to call free in any case. Telling employees clearly and offering an alternative where practical are good practice.

Is biometric data a special category under DPDP?

No. The DPDP Act has no special categories. But a biometric breach cannot be fixed by resetting a password, so it carries high risk and attracts strict scrutiny.

What should we do with biometric data when employees leave?

Delete their templates from devices and servers promptly, and confirm deletion with the vendor, unless a law requires retention.

Are face recognition systems riskier than fingerprint readers?

Often, yes. Cameras can capture people who never enrolled, images may be stored rather than templates, and cloud processing adds vendor and transfer risk.