Fingerprints Are Not a Faster Door: Interrogating Biometric Access Control Before the Contract Is Signed

The pitch is familiar. No more lost fobs, no more shared PINs, no more reception staff printing visitor cards. A fingerprint reader at the turnstile, a palm-vein scanner in the plant room, a camera at the staff entrance. Entry becomes frictionless, and the spreadsheet of credentials finally becomes a list of people.

Frictionless entry is a convenience argument. It is rarely sufficient on its own, and treating it as though it were is where facilities teams get into difficulty. Biometric access control processes special category personal data, and the governance burden falls on the organisation that operates the system — not on the supplier who installed it.

Why biometrics is not simply another credential type

A card can be reissued. A PIN can be reset. A fingerprint template, once compromised, cannot be changed.

That asymmetry is the reason UK data protection law treats biometric data used for the purpose of uniquely identifying a person as special category data under Article 9 of the UK GDPR. The distinction matters in practice: the lawful basis is narrower, the documentation is heavier, and the tolerance for “we will sort the paperwork later” is effectively zero.

Suppliers sometimes argue that a mathematical template is not personal data because it cannot be reverse-engineered into an image. That argument has never been a reliable foundation for procurement. Templates are generated from an identifiable individual, are stored against an identity record, and are used to authenticate that individual. They are personal data, and where the purpose is unique identification, they are special category data.

Necessity and proportionality: the question that must be answered on paper

Consent is the route most often proposed and the least often valid in a workplace. Where there is an imbalance of power between employer and worker, the ICO's expectation is that consent is unlikely to be freely given — and a system where the alternative is being unable to enter the building is a textbook example of that imbalance.

That leaves the other conditions in Article 9, several of which run through Schedule 1 of the Data Protection Act 2018 and carry their own documentation requirements. Whichever route is relied upon, two questions have to be answered in writing, before the purchase order:

• Necessity. What is the specific problem, evidenced, that biometrics solves and that a card, PIN, mobile credential or staffed reception cannot solve?
• Proportionality. Is the intrusion into staff and visitor privacy proportionate to the risk being managed, given the alternatives available and their cost?

A high-security pharmaceutical facility and a 1990s office block with 140 staff and a single reception desk will not produce the same answer. That is entirely reasonable. What is not reasonable is reaching the same answer in both cases without documenting why.

The DPIA is a precondition, not a postscript

A data protection impact assessment is effectively mandatory here. Biometric processing for access control, at scale across a workforce, engages the criteria the ICO expects to see assessed, and the assessment should be completed before the supplier is chosen — not retrofitted once the hardware is on the wall.

The DPIA should record the alternatives considered and rejected, the retention period for templates, the deletion process at contract end, the accessibility fallback, and the outcome of staff consultation. An assessment that contains no rejected alternatives reads as a justification exercise rather than an assessment.

Contract terms that shift risk back to the supplier

Procurement is where most of the practical protection is won or lost. The following should be non-negotiable in any biometric deployment:

1. Processor obligations. A compliant Article 28 data processing agreement, with the template hosting location, the sub-processor list and a change notification mechanism specified.
2. Purpose limitation. Explicit prohibition on using templates, images or derived data for time and attendance analytics, occupancy reporting, wellness monitoring or product development without a separate written agreement.
3. Deletion on exit. A defined process for exporting and then certifying deletion of templates at contract termination, with a short timeframe and a written certificate.
4. Liveness and presentation attack detection. Documented performance against spoofing, with the test methodology disclosed rather than asserted.
5. Audit and breach notification. Rights to audit or receive independent assurance reports, and a breach notification window measured in hours, not weeks.
6. Change control. Any firmware update that alters matching thresholds, retention or data flows should trigger notification and, where relevant, a DPIA refresh.
7. Indemnity and exit. Clear allocation of liability for regulatory action, and an exit plan that does not leave the organisation dependent on a single vendor for access to its own door system.

A supplier that resists these terms at tender stage is telling you something useful about the operational phase.

Staff consultation and the Equality Act 2010

Biometric enrolment is a change to the way people work, and it should be handled as one. Where a recognised trade union or works council exists, early informal discussion prevents a routine deployment becoming a dispute. Where none exists, briefing sessions and a written explanation of alternatives still serve a compliance purpose: they evidence that the workforce was informed and that objections were considered.

The Equality Act 2010 does not disappear because the technology is new. Manual workers may have worn or damaged fingerprints. Some staff will have skin conditions, disabilities or religious or cultural objections that make hand or face-based enrolment impractical or unacceptable. A biometric system without a genuinely equivalent alternative route — not a visitor pass issued grudgingly at reception — creates a discrimination risk that sits with the employer, not the vendor.

Facial recognition warrants particular caution. It is harder to confine to a single purpose, easier to repurpose, and attracts more public scrutiny than a fingerprint reader on a staff door. The regulator has repeatedly questioned the proportionality of live facial recognition in publicly accessible settings, and a facilities team should assume that scrutiny applies to its own deployment.

When the right answer is no

Not every site needs biometrics, and a decision not to proceed is a legitimate professional outcome, provided it is documented. A short written note recording the options assessed, the cost of each, the risks accepted and the reasoning is a far stronger artefact in an audit than a hastily assembled DPIA defending a system nobody can quite explain the purpose of.

The uncomfortable question for any facilities manager is straightforward: if the entry speed were identical, would we still choose biometrics? If the answer is no, the business case has not yet been made — and the compliance case almost certainly has not.