Are Biometric Time & Attendance Systems Legal in the UK? A 2026 Guide for Employers

Blog by Adam | Posted on Thursday October 15 2026

What counts as biometric data?

Biometric data is information derived from someone’s physical, physiological or behavioural characteristics and processed using technology so that they can be uniquely identified.

For time and attendance systems, this most commonly includes:

• fingerprints;
• facial recognition;
• iris or retinal scanning; and
• in some applications, voice recognition.

A biometric system will typically convert the characteristic being measured into a biometric template that can subsequently be used to verify or identify the individual.

This distinction is worth understanding. A fingerprint clocking terminal, for example, does not necessarily need to continually work with a conventional photograph of an employee’s fingerprint. Modern systems can instead use mathematical biometric templates for matching.

However, that does not mean the information falls outside data protection law.

When biometric data is used to uniquely identify somebody – as it normally is when an employee clocks in using their face or fingerprint – it is classed as special category personal data under UK data protection legislation and receives additional protection.

So, are biometric clocking systems legal?

Yes.

There is no blanket UK ban on employers using facial recognition, fingerprints or other biometric technologies for time and attendance. But an employer cannot simply decide that biometric clocking is convenient and assume that is sufficient justification.

The Information Commissioner’s Office (ICO) says organisations should consider whether biometric processing is necessary and proportionate and whether a less intrusive method could reasonably achieve the same objective.

For example, alternatives might include:

• RFID cards or fobs;
• PIN numbers;
• mobile applications;
• or smart cards

This doesn’t mean that an alternative will always be better than biometrics.

An employer may have legitimate reasons why a biometric system is particularly appropriate for its environment.

The important point is that the organisation should have considered the alternatives and documented why it has chosen biometrics.

Can employees genuinely consent?

For consent to be valid, it must be freely given.

That’s more difficult in an employer/employee relationship because there is an obvious imbalance of power. An employee may feel that refusing a request from their employer could adversely affect them, even if the employer has no intention of doing so.

This doesn’t mean employers can never rely upon consent.

The ICO specifically indicates that consent may be appropriate where employees are given a genuine choice, including a suitable alternative for people who don’t want their biometric information processed.

For example, an employer might allow staff to choose between: Facial or fingerprint recognition or an RFID card or PIN.

An employee choosing the non-biometric option should not be penalised or disadvantaged as a result. Where consent is the basis being relied upon, employees must also be able to withdraw that consent.

A DPIA is required

Before introducing biometric identification for employees, businesses should carry out a Data Protection Impact Assessment (DPIA)*.

In fact, the ICO states that a DPIA must be completed when biometric data will be processed for the purpose of uniquely identifying workers, because this type of processing is considered high risk.

The DPIA should be completed before the system goes live.

Among other things, it gives the employer an opportunity to document:

• why the system is being introduced;
• what biometric information will be processed;
• who will have access to it;
• where information will be stored;
• how long it will be retained;
• what security measures are in place;
• what risks exist for employees;
• how those risks will be mitigated;
• what alternatives to biometrics were considered;
• why the chosen approach is necessary and proportionate; and
• how employees can raise concerns or exercise their data protection rights.

This shouldn’t simply be viewed as paperwork to complete after deciding which biometric terminal to buy.

Ideally, privacy and data protection considerations should form part of the selection and implementation process from the beginning.

*At Idency we can help you with a DPIA, please contact us for more information.

Employees must know what’s happening to their data

Transparency is another fundamental requirement.

Employees should be clearly informed about the biometric system and how their personal information is being used.

The ICO says workers should be told information including:

• how the system works;
• what personal information is collected;
• how that information will be used; and
• the purpose of the monitoring.

This will normally form part of the organisation’s employee privacy information and biometric policy.

The explanation should be written in language employees can actually understand rather than being hidden inside a lengthy data protection document.

Think carefully about security

A forgotten password can be changed. Your fingerprint can’t.

This is one of the fundamental reasons biometric information requires careful protection.

Employers should therefore understand exactly what information their chosen system stores and where it is stored.

Questions worth asking your biometric supplier include:

• Does the system store images or biometric templates?
• Where are biometric templates held?
• Are they stored on the device, centrally, or both?
• Is the information encrypted?
• Who can access it?
• Is biometric data transferred outside the UK?
• How is information deleted when an employee leaves?
• What happens if a clocking terminal is lost, stolen or compromised?
• What contractual arrangements are in place between the employer and its technology suppliers?

Organisations should also apply the principle of data minimisation: collect and retain only the information genuinely required for the stated purpose.

Accuracy and fairness matter too

Biometric recognition isn’t infallible.

Employers should consider false matches, failed identifications and whether a technology works consistently for the workforce.

The ICO particularly highlights the need to consider the performance and fairness of facial recognition technology across different groups of people.

Businesses should therefore have a mechanism for quickly resolving problems.

An employee should not, for example, lose pay simply because a biometric terminal incorrectly failed to recognise them.

The ICO recommends making manual review available when workers experience problems caused by automatic identification errors.

Fingerprint, facial recognition or RFID?

Compliance doesn’t necessarily mean every organisation should make the same technology choice.

Different working environments require different approaches.

Facial recognition can provide fast, contactless clocking and may be particularly useful in environments where employees can’t conveniently use cards or touch a fingerprint sensor.

Fingerprint recognition provides a simple biometric method that has been widely used for time and attendance applications.

RFID cards and fobs provide a non-biometric alternative and may be preferable where an organisation cannot sufficiently justify biometric processing or where individual employees choose not to use biometrics.

A time and attendance platform capable of supporting different authentication technologies can therefore give organisations far more flexibility than requiring every employee to use the same method.

A practical biometric time & attendance checklist

Before introducing a biometric clocking system, employers should be able to answer the following questions:

• Do we have a clearly defined reason for using biometrics?
• Have we considered less intrusive alternatives?
• Can we demonstrate that our approach is necessary and proportionate?
• Have we identified an appropriate lawful basis?
• Have we identified a valid condition for processing special category data?
• Have we completed a DPIA?
• Have employees been properly informed?
• If we rely upon consent, is it genuinely optional?
• Can we provide an appropriate non-biometric alternative?
• Do we understand exactly what biometric information is stored?
• Is the information adequately secured?
• Do we have suitable retention and deletion procedures?
• Can incorrect clocking or identification results be manually reviewed?
• Do our suppliers provide appropriate data protection and security information?

If the answer to any of these is “no” or “we don’t know”, that area should be investigated before the system is introduced.

Considering biometric time & attendance?

If you’re considering fingerprint, facial recognition, RFID or an integrated time and attendance system, Idency can help you explore the available options and identify the approach that best suits your organisation.

We can also help you understand how physical clocking terminals can integrate with your existing HR systems through IdencyTime, reducing duplicated administration and giving your business access to accurate, live attendance information.

Talk to the Idency team about your time & attendance requirements.

This article provides general information about biometric time and attendance systems and should not be regarded as legal advice. Data protection requirements depend upon the circumstances of each organisation. Employers should refer to current ICO guidance and obtain specialist legal advice where appropriate.