Biometric Data
What is Biometric Data?
Personal data resulting from specific technical processing relating to the physical, physiological, or behavioural characteristics of a natural person, such as facial images or fingerprint data. Classified as special category data under GDPR.
Terms that appear alongside biometric data
Each of these is named in at least one of the same controls as biometric data. The number is how many controls name both.
- consent 58 shared controls
- gdpr 34 shared controls
- genetic data 27 shared controls
- data subject 27 shared controls
- health data 26 shared controls
- sensitive personal data 24 shared controls
- data protection 17 shared controls
- profiling 12 shared controls
Frameworks that govern biometric data
What the standards actually require on biometric data
Requirements naming biometric data across 6 standards, quoted from the control text.
Article 12 of the Kazakhstan PDPL establishes the data localization requirement for biometric personal data of Kazakhstan citizens and residents - a key sovereignty provision strengthened by the 2022 amendment.
KZ-PDPL-Biometric-Data-Localization-Article12-Server-Kazakhstan-On-Soil-Data-Storage-Citizens-Residents · Kazakhstan PDPL Biometric Data Localization + Article 12 + Mandatory Server Storage in Kazakhstan + 2022 Amendment + Citizens + Residents + Foreign Cloud Provider Restrictions + Data Sovereignty + State Service for Information Security Oversight →Processing employees' biometric data for recording working time and for entry/exit to official premises is permitted where prescribed by law, or as an alternative to another time/access solution, provided the employee gave explicit consent under the GDPR.
HR-GDPR-Art.23 · Biometric Data of Employees (Time and Access) →Capturing webcam shots or footage is particularly unlikely to be justified; keystroke monitoring counts as behavioural biometric data when typing rhythm can identify a worker.
uk-ico-employment-practices-and-data-protection-monitoring-workers-2023::3.11(c) · 3.11(c) Device activity monitoring: webcam capture rarely justified, keystroke logging is behavioural biometric data, and private use of own devices kept out →Particular caution must be exercised in any project processing genetic or biometric data, because such data are unique, can reveal health predispositions, inherited diseases and kinship, affect relatives as well as participants, cannot be changed and remain fo...
edpb-guidelines-1-2026-on-processing-of-personal-data-for-scientific-research-purposes::8.4 · 8.4 Genetic and biometric data: particular caution, restrictive purposes, pseudonymisation, ethical approval, federated storage with secure access, role-based controls, and community information for isolated populations →Controllers should delete raw data (face images, speech, gait) and make sure deletion is effective, and must delete it when no lawful basis remains;
edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::5.2(d) · 5.2(d) Delete raw biometric data effectively, on unauthorised access and at the device's end of life →Per 152-FZ Articles 10 + 11: special categories + biometric. Requirements include (a) Special Categories of Data (Article 10) prohibited processing without specific consent or legal basis including race + ethnicity + political + religious + philosophical + hea...
RUSPD-4 · Special Categories, Biometric Data →Questions people ask about biometric data
What is Biometric Data?
Why is Biometric Data important for compliance?
Which compliance frameworks address Biometric Data?
Where can I learn more about Biometric Data?
See how Biometric Data applies across compliance frameworks
Our platform maps 1,027 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.