Talk to usTry the demo

Biometric Data Under GDPR and UK GDPR: What Verification Teams Settle Before Launch

KYC, AML and digital identification

For: Data protection officer or counsel reviewing a face verification flow

When a face template is special category data, which lawful bases and conditions apply, and what the UK regulator says about alternatives, thresholds and retention.

You are a data protection officer or counsel, and a product team wants to add selfie-to-document face matching to onboarding. Before launch, three questions have to be settled: when is a face template special category data, which lawful basis and which separate condition apply, and what do regulators expect about alternatives, errors and retention? This article walks through the text of the EU General Data Protection Regulation and the guidance of the UK Information Commissioner's Office on biometric recognition, quoting the primary sources and adding no opinion of its own.

For information; not legal advice.

What counts as biometric data

Article 4(14) of Regulation (EU) 2016/679 defines biometric data as "personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data". The definition has three parts: the data relate to characteristics of a person, they result from specific technical processing, and they allow or confirm unique identification.

The ICO's guidance makes the second part concrete. A photograph shows physical characteristics, but that is not enough to make it biometric data; it is only when something else happens to the photo, a discrete processing operation that extracts features and allows or confirms unique identification, that the result becomes biometric data. Biometric feature extraction and template generation are named as stages of such processing. The guidance adds that information produced by these technical processes is covered regardless of how long it exists, and that the test concerns the properties of the information, not what you intend to use it for.

When it becomes special category data

Article 9(1) prohibits the processing of the special categories of personal data it lists, and the list includes "biometric data for the purpose of uniquely identifying a natural person". The ICO notes that not all biometric data is automatically special category biometric data: it only becomes so if you use it to uniquely identify someone, which makes your purpose for processing important.

The ICO explains the consequence for a verification flow. A system that compares a probe with a reference, whether one-to-one verification or one-to-many identification, uses biometric data to uniquely identify someone, so the processing is special category biometric data. The guidance gives an example close to onboarding: customers upload a scan of a driving licence and a photo of themselves, and the company compares the two images to verify that they show the same person; this involves processing special category biometric data. It also states that processing starts from the moment of collection, not from the attempt at comparison, and that this holds even if no match is found, or if you do not need to know who the person is.

Transient processing does not change this. The ICO states that it is still processing if information is only briefly created, collected or stored, and that data protection requirements apply regardless of how quickly the information is deleted. It adds that transient processing can help to demonstrate data minimisation, storage limitation and security.

Two choices, not one

Under the ICO's guidance you must identify a lawful basis and a separate condition for processing special category biometric data, and there is no requirement that the two match. The six lawful bases in Article 6(1) are consent, contract, legal obligation, vital interests, public task and legitimate interests. The special category condition comes from Article 9(2), and the guidance describes the conditions as deliberately stringent.

Article 9(2)(a) provides that the prohibition does not apply if "the data subject has given explicit consent to the processing of those personal data for one or more specified purposes", with an exception where Union or Member State law provides that the prohibition may not be lifted by the data subject. Article 9(2)(g) covers processing necessary for reasons of substantial public interest on the basis of Union or Member State law that is proportionate to the aim pursued. Article 9(4) allows Member States to maintain or introduce further conditions, including limitations, with regard to biometric data.

The ICO states that explicit consent is likely to be the most appropriate condition for special category biometric data, because there is no specific condition for identification or verification that fits the various circumstances. It lists what valid consent requires: it must be specific and informed, set apart from other terms, freely given with a real choice, and withdrawable at any time without detriment. The guidance says you must offer a suitable alternative to people who choose not to consent, and that explicit consent has to be affirmed in a clear statement, since it cannot be inferred from what someone does.

The Regulation itself contributes parallel rules for consent. Under Article 7, the controller must be able to demonstrate consent, a request for consent in a wider declaration must be clearly distinguishable, the data subject may withdraw consent at any time, Article 7(3) states "It shall be as easy to withdraw as to give consent.", and when assessing whether consent is freely given, utmost account is taken of whether performance of a contract is made conditional on consent to processing that is not necessary for the contract.

The ICO's guidance covers the situation where a genuine choice cannot be offered. A basis other than consent requires that processing biometric data is necessary to achieve the overall purpose, which means more than useful or desirable, and the guidance says that if the purpose could be achieved in a less intrusive way or by processing less information, necessity is not shown. It lists considerations for proportionality, including the known or expected false acceptance and rejection rates, groups for whom results are likely to be less accurate, and alternatives that were considered. It names substantial public interest, including prevention or detection of unlawful acts, as a likely alternative special category condition, with its own requirements such as an appropriate policy document. If no valid condition can be identified, the guidance states that a biometric recognition system must not be used.

Principles that follow the data

Article 5(1)(c) requires personal data to be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed", and Article 5(1)(e) requires them to be kept in a form which permits identification of data subjects "for no longer than is necessary for the purposes for which the personal data are processed". Article 5(2) makes the controller responsible for demonstrating compliance with these principles.

Article 35(3)(b) requires a data protection impact assessment in the case of "processing on a large scale of special categories of data referred to in Article 9(1)". The assessment has to contain at least a systematic description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of the risks to the rights and freedoms of data subjects and the measures envisaged to address them.

The ICO's example of a gym that offers a PIN as an alternative to face recognition shows how the pieces fit: the written statement of consent, the non-biometric option and the data protection impact assessment are documented together.

Scope notes

The ICO's guidance says it does not cover law enforcement or the security services, does not cover biometric classification or categorisation systems, and is not intended as a comprehensive guide to compliance. It also carries a notice that, because of changes made by the Data (Use and Access) Act, the guidance is under review and may change.

The European Data Protection Board's Guidelines 05/2022 concern the use of facial recognition technology in the area of law enforcement. The final version is dated 17 May 2023. By their title they address that setting, and this article therefore does not draw requirements from them.

A pre-launch list of questions

  1. Is the processing biometric data, and is its purpose unique identification?
  2. Which lawful basis applies, and which separate special category condition?
  3. If explicit consent is used, what is the statement, where is it recorded, how is it withdrawn, and what is the alternative path?
  4. Are the error rates of the face comparison known, and have groups with weaker results been considered?
  5. What is retained, for how long, and how is erasure carried out and confirmed?
  6. Has the impact assessment been completed, and does it document the alternative that was offered?

How NeuroVision fits

A NeuroVision integration has controls that serve retention and erasure decisions: retention in days is a setting of each scenario, erasure endpoints and an erasure confirmation webhook are available, and a callback can be configured to omit names, document data and images and keep only the session identifier, which links to the session. Callback bodies can be encrypted.

To discuss your retention and consent design, contact the team.

Sources

All sources were fetched on 27 October 2026.

Ready to talk?

Tell us what you are building and we will help you plan the integration.

Talk to us