Biometric Data
Data about a person’s physical or behavioural traits, used to identify them, such as fingerprints, iris and face.
Biometric data is information from the body or behaviour of a person, like a fingerprint, iris, face or voice, that is used to recognise them. You cannot change it if it leaks, so it deserves extra care.
Meaning of Biometric Data
The DPDP Act has no special category for biometrics, but they are high-risk because they cannot be changed. Use the least intrusive method that does the job, secure them tightly, and keep them only as long as needed.
Biometric data covers physical traits such as fingerprints, palm veins, iris, face geometry and voice, and behavioural patterns such as typing rhythm or gait. What makes it distinct is that a system usually converts the trait into a mathematical template, which is then matched against a new sample to say "yes, this is the same person". Both the raw image and the template identify someone, so both are personal data.
The DPDP Act, 2023 does not carve out biometrics as a special category. Section 2 defines personal data as any data about an individual who is identifiable by or in relation to it, and a fingerprint template plainly qualifies. All the usual duties follow: a notice under Section 5 and Rule 3, valid consent under Section 6 unless a Section 7 legitimate use applies, security safeguards under Section 8(5) and Rule 6, and erasure under Section 8(7) once the purpose is over. The old SPDI Rules 2011 listed biometrics as sensitive personal data, but that label goes away as the DPDP Act takes effect.
The absence of a special tag does not mean low risk. A password can be reset; a fingerprint cannot. If a template database is stolen, affected people carry the risk for life. The Board will judge whether safeguards were "reasonable" by looking at the nature of the data, so a stronger standard is expected for biometrics than for, say, a newsletter list. An employer should also remember that employment-related processing under Section 7(i) covers purposes like safeguarding the employer from loss or liability, and a fingerprint attendance system should still be tested against necessity and proportion.
Biometric data under the Aadhaar Act is a separate track. Core biometric information collected for Aadhaar can be used only as that Act permits, and Section 29 bars sharing it. If your system uses a face or fingerprint you capture yourself, the Aadhaar Act does not govern it, but the DPDP Act does. Where children are involved, Section 9 requires verifiable parental consent and bars tracking or behavioural monitoring, so face recognition of pupils at a school gate needs particular care.
Examples of Biometric Data
A factory uses fingerprint attendance. It should explain why, store templates securely and delete them when a worker leaves.
A factory with 600 workers uses fingerprint attendance. It tells staff what is captured, stores only templates in an encrypted database, offers an ID-card option to anyone who objects, and deletes templates within 30 days of a worker leaving.
A co-working operator wants face recognition at its doors. It makes the feature opt-in through the app, matches faces on the member's own phone, and keeps only an access log, so no central face database exists to be breached.
A payments app offers fingerprint login using the phone's built-in sensor. The app never receives the fingerprint, only a confirmation from the operating system, and it still lists the feature in its notice and gives a PIN alternative.
Why Biometric Data matters
Biometric incidents are costly. A failure to maintain reasonable security safeguards can attract a penalty of up to ₹250 crore, and failing to inform the Board and each affected person about a breach up to ₹200 crore. Because a leaked fingerprint cannot be re-issued, the harm to individuals is lasting, and so is the damage to trust.
Biometrics also create fairness and accuracy issues. Face recognition can perform worse for some skin tones, ages and lighting conditions, causing wrongful denials of wages, attendance or entry. Section 8(3) requires accuracy where data is used for decisions affecting the person, so organisations need a fallback route and a way to correct errors.
How it works in practice
- 1Justify the choice first. Document why a card, PIN or mobile app would not do, and what harm the biometric method is preventing. If a less intrusive option works, adopt it.
- 2Give a clear notice and a real alternative. Say what is captured, whether the raw image is kept, who sees it, and how long it stays. Offer an equally easy alternative to people who decline, particularly in employment settings.
- 3Store templates, not images, and protect them. Use encryption, keep the template database separate from the identity database, restrict administrator access and log all access, in line with Rule 6.
- 4Prefer on-device matching where possible. When the template stays on the person's own phone or smart card and only a yes/no result reaches your server, a server breach exposes far less.
- 5Set a deletion rule. Delete a worker's or customer's template when the relationship ends or consent is withdrawn, and test that backups are purged on schedule.
- 6Run a risk assessment before launch and after any vendor change, and make sure the vendor contract covers breach alerts and deletion.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming biometrics are fine because the DPDP Act lacks a special category. The risk-based test for reasonable safeguards means biometrics need stronger controls, not weaker.
Keeping raw fingerprint or face images when a template would be enough. Store the minimum and discard the rest.
Making biometric enrolment the only way to be paid or enter a building. Offer an alternative where practicable and record the reason if you cannot.
Forgetting that vendors hold the data too. As the Data Fiduciary you remain responsible under Section 8(1) for what your attendance-device supplier does with templates.
Compliance tips
Ask suppliers where templates are stored, whether they leave India, and whether the device vendor can read them.
Add biometric systems to your breach response plan, because Rule 7 expects the Board and each affected person to be informed and a detailed report to follow within 72 hours.
Delete test and pilot data when a trial ends; old pilot databases are a common source of forgotten exposure.
Review the retention period every year and shorten it where the business can manage.
Common questions about Biometric Data
Is biometric data sensitive personal data under the DPDP Act?
The DPDP Act has no sensitive category, so biometric data is treated as personal data. The earlier SPDI Rules 2011 did call it sensitive. Even so, its permanence means regulators and courts will expect stronger safeguards than for ordinary data.
Do I need consent for fingerprint attendance?
Usually you need consent through a clear notice, or you must show that a Section 7 legitimate use applies. Employment purposes under Section 7(i) are limited, so test your facts and offer an alternative where you can. This is general information, not legal advice.
Can a school use face recognition for pupils?
Pupils are children under Section 9, so verifiable parental consent is needed and tracking or behavioural monitoring is barred. Rule 12 and its Fourth Schedule exempt only specific educational purposes. A school should take advice before using face recognition.
What happens if biometric data is leaked?
The organisation must report to the Board and each affected person under Section 8(6) and Rule 7. It may face a penalty of up to ₹250 crore for weak safeguards, and individuals cannot change their fingerprints, which makes prompt, clear communication vital.