The short answer
Biometric clocking in is legal in the UK. No statute prohibits it. What the law does is set a higher bar for the data involved, because a person's face is special category data under the UK GDPR. Clear that bar and you are on solid ground.
In practice, lawful biometric attendance comes down to six things:
- A lawful basis for the processing under Article 6.
- A separate Article 9 condition for the special category data.
- A clear privacy notice telling workers what you collect and why.
- A completed data protection impact assessment (DPIA).
- Proportionate safeguards — minimised data, encryption and retention limits.
- A genuine non-biometric alternative for anyone who objects.
This guide reflects the UK GDPR, the Data Protection Act 2018 and published ICO guidance. It is general information to help you ask the right questions — it is not a substitute for your own legal advice or your own DPIA.
Why faces are special category data Art. 9
Article 9 of the UK GDPR singles out a set of especially sensitive personal data — health, ethnicity, religion and so on — and adds biometric data processed to uniquely identify a person. A facial-recognition clock-in does exactly that: it turns a face into a template and uses it to confirm who someone is.
Processing special category data is prohibited by default. It only becomes lawful when you can point to a condition in Article 9 as well as a lawful basis in Article 6. That is the higher bar — and it is the whole reason biometric attendance needs a little more thought than a fob or a spreadsheet.
"Biometric data is banned in the workplace, so facial clock-in is illegal."
It is restricted, not banned. With an Article 9 condition, a DPIA and safeguards, it is lawful.
Choosing a lawful basis Art. 6
Every processing activity needs a lawful basis under Article 6. For workforce attendance, two are usually in the frame. You pick the one that genuinely fits — you cannot swap between them later to suit yourself.
Legitimate interests
Preventing buddy-punching, paying people accurately and keeping an accurate on-site record are legitimate interests. Use this and you must complete a legitimate interests assessment that balances your aim against the worker's rights — and that balance is easier to win when you offer a non-biometric option.
Consent
Consent can be your Article 6 basis, but in an employment relationship the ICO treats it with caution because of the power imbalance. If you rely on consent it must be freely given and as easy to withdraw as to give. See the next section.
Whichever you choose for Article 6, you still need a matching Article 9 condition for the biometric data itself. Explicit consent is the most common condition for workplace biometrics, which is why consent tends to reappear even when legitimate interests is your Article 6 basis.
Where explicit consent fits — and where it does not
Explicit consent is a valid Article 9 condition, and it is the route many employers reach for first. But consent only counts if it is freely given. The ICO is clear that an employee who feels they have no real choice has not truly consented.
To rely on explicit consent for biometric clock-in, make sure it is:
- Specific to facial recognition for clocking in — not buried in a contract clause.
- Informed, with a plain-language notice the worker actually reads before enrolling.
- Freely given, with a workable alternative so refusing carries no penalty.
- Easy to withdraw, switching the worker to the alternative without fuss.
Making biometric clock-in the only way to get paid removes the worker's free choice — which can invalidate consent and undermine the whole deployment. The alternative is not a nice-to-have; it is what keeps the approach lawful.
The DPIA you almost certainly need Art. 35
A data protection impact assessment is mandatory under Article 35 where processing is likely to result in a high risk to people. The ICO lists large-scale use of biometric data among the activities that trigger one — so for facial-recognition attendance, assume you need a DPIA and complete it before you go live.
A good DPIA documents:
- What you collect, how it is processed, and your lawful basis and Article 9 condition.
- Whether biometrics are necessary and proportionate, or a lighter option would do.
- The risks to workers, and the safeguards that reduce each one to an acceptable level.
- The non-biometric alternative and how someone opts out.
If a residual high risk remains after your safeguards, you must consult the ICO before starting. In most attendance deployments, irreversible templates, UK hosting, a tight retention period and a PIN alternative bring the risk well below that line.
What the ICO actually expects
The Information Commissioner's Office is the UK regulator, and its published guidance on biometric data is the practical yardstick. In 2024 the ICO took enforcement action against an employer that used facial recognition and fingerprint scanning for attendance without offering a less intrusive alternative — the lesson being that necessity and proportionality are not optional.
Read across its guidance and the expectations are consistent:
- Necessity first. Use biometrics only where a lighter method genuinely will not do.
- An alternative always. No one should be forced to give biometrics to do their job.
- Transparency. Tell people clearly what is collected, why, and for how long.
- Data minimisation. Store a template, not a photo library, and keep nothing extra.
Storage, retention and deletion Art. 5(1)(e)
The storage-limitation principle says you may keep personal data only for as long as you need it. For biometric templates that means a defined retention period, deletion tied to the end of employment, and a separation between the biometric signature and the timesheet record it helped create.
Enrolment
The face becomes an irreversible vector signature. No photograph is retained.
In service
Each clock-in compares live to the stored signature. Only the match score and location are written to the timesheet — not a new image.
Leaver
The biometric signature is deleted on your schedule once the engagement ends — it no longer has a purpose.
Records retained separately
The timesheet and pay record can be kept for the period your payroll and tax duties require — without holding the biometric data any longer.
You must offer an alternative
This is the single point that most often separates a lawful deployment from a risky one. A worker who declines facial recognition must still be able to clock in, be paid correctly and appear on the live register. The alternative does not need to be high-tech — a PIN on the same kiosk is enough.
Offering it does two jobs at once: it respects the worker's choice, and it strengthens your necessity-and-proportionality case, because you can show that biometrics are an option you offer rather than a condition you impose.
"Face scan or you cannot clock in." No real choice — and consent collapses.
"Use your face, or a PIN — your choice." A genuine option keeps it proportionate.
How TempClock handles it
TempClock is built so that the compliant way is the default way. Each obligation above maps to something the product already does — so you are deciding how to deploy, not building safeguards from scratch.
A compliance checklist
A short list to take into a deployment conversation. Tick all of these and you are in good shape — and you will have the paperwork to show it.