Biometric Attendance and the DPDP Act

Published on 10/18/2026 • Updated on 10/22/2026

Fingerprint and face-scan attendance machines are common at factory gates and office entrances. They solve buddy punching and save time. They also collect data about the body of every employee, which is among the most sensitive data a company can hold, because a person cannot change a fingerprint after a leak.

This guide explains how the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 apply to biometric attendance, what notice and safeguards to put in place, how long to keep templates and what alternatives exist. It is general information, not legal advice. Confirm your approach with your legal adviser.

How the Act applies

The Act covers digital personal data. The Act does not set a separate category called sensitive personal data, so biometric data is personal data like any other for the purpose of the Act, with the same duties of notice, purpose limitation, security and erasure. Higher risk still means higher expectations for safeguards in practice.

An employer is a Data Fiduciary for attendance data. The Act has a legitimate use for processing by an employer for employment purposes and safeguarding the employer from loss or liability, in section 7. Whether a biometric system fits that use, or needs consent, is a question for your legal adviser. Do not assume.

Notice to employees

Rule 3 of the DPDP Rules asks for a notice in plain language that lists the data, the purpose and how to complain. For biometrics the notice should say whether you store the raw image or a mathematical template, where it is stored, who can see it and when it is deleted.

The retention period in the example is an assumption. Pick yours with your adviser, since payroll and labour laws may need attendance records for longer than templates.

Safeguards that matter most

Rule 6 sets minimum safeguards, including encryption, access control, logs and monitoring, backups and contract terms with processors. The highest penalty tier in the Schedule, up to Rs 250 crore, applies to a failure to take reasonable security safeguards.

• Store templates, not images, and encrypt them.
• Limit admin access to named people and log it.
• Check that the vendor does not use your templates for other purposes.
• Find out where the vendor's cloud servers are and what the contract says about breaches.
• Delete templates when people leave.

Ask the vendor in writing how a template is stored and whether it can be turned back into an image. A clear written answer is worth having in the file.

Alternatives to biometrics

Alternatives reduce risk and give people a choice. They also help if an employee objects.

Many sites use a card or QR code for most staff and keep biometrics only for a few high-security zones. This cuts the amount of biometric data held and the risk with it.

What to ask the device vendor

Most biometric devices come with software the vendor controls. Before you renew or buy, ask the vendor the following and keep the replies.

• Is the stored data a template or an image, and is it encrypted at rest?
• In which location is the server held, and who at the vendor can open the data?
• Can you export and delete all templates on request, and how is deletion confirmed?
• How will the vendor tell you of a breach, and within how many hours?
• Does the vendor use anonymised or other data for any other purpose?
• Does the contract name security duties, as Rule 6 expects for processors?

A vendor that cannot answer in writing is a risk, whatever the price. Switching vendors is easier before thousands of templates are enrolled than after. Set a calendar reminder to repeat these checks at each contract renewal, and ask for any change in storage location to be told to you in advance.

Three situations HR meets

An employee refuses to enrol

Offer a card or PIN and note the choice in the file. Do not mark the person absent for refusing, since that creates a complaint with no benefit to the business.

A device is stolen from a gate

Treat it as a possible breach, check whether templates were encrypted and follow your breach plan. Our DPDP breach reporting guide sets out the steps, and a short dry run of it with the gate team is worth an hour of their time. Keep the device inventory current, so you know in minutes which gate and which model is missing.

A worker leaves on bad terms

Delete the template on the last day and keep only the attendance records you need for payroll and labour records. Ask the vendor for confirmation of deletion from the device and the server.

A worked example for a plant

The review took a week and mostly changed settings and paperwork.

Employee rights and complaints

The Act gives people the right to access information about their data, to correct it, to seek erasure and to have a grievance heard. Rule 14 expects a response to a grievance within ninety days. Tell staff who to write to and keep a log of requests. A worker who asks to be moved to a card should get a clear answer, not a warning.

Common mistakes

Another mistake is reusing attendance biometrics for something else, such as access to the server room, without a fresh review. A new purpose needs a new look at notice and consent.

A third is leaving the devices on a default admin password. Change it on installation and record who holds it.

A two-week biometric review

Review the system before the commencement date.

Repeat the review each year or whenever you change the vendor. Write the findings on one page and send it to management, so the cost of any fix is agreed before the next renewal and not after an incident.

Five-minute self-check

Check your attendance system against these points.

Two or more no answers mean this is worth fixing before anything else on your list.

Reader Q&A

Bottom line

Biometric attendance can be kept within the DPDP Act, but it carries the highest security expectations of the common workplace systems. Give a clear notice, store templates and not images, lock down access and delete on exit.

Where a lighter method works, use it. Where biometrics stay, document why, and review the reason each year.

Author of the Blog Post

Aadeshwar Modi

Technical Content Writer at VisitorFlow

Aadeshwar Modi is a marketing technical content writer who loves writing on technology and AI topics.