Skip to content

Knowledge base · AI in HR

May we use fingerprint or face recognition for time registration or access?

For time registration, as a rule not. Biometric data used to uniquely identify a person is a special category of personal data. The Dutch implementing act allows it only if necessary for authentication or security, and only to the extent necessary for a substantial public interest in lawful access to certain places, buildings or systems. The Dutch Data Protection Authority fined a company that used fingerprints for attendance and time registration, and according to the AP, employees' consent is in principle no way out. A scheme on this requires the works council's consent.

In force now (since 25 May 2018)Trusq editorial · checked against the official textLast verified:

Next step: Map your AI tool

Biometrics is a special category of personal data

Processing biometric data for the purpose of uniquely identifying a person is prohibited in principle [1].

The Dutch exception

The prohibition does not apply if the processing is necessary for authentication or security, and only to the extent necessary for a substantial public interest in lawful access to certain places, buildings, services, products, information systems or work process systems [2].

Time registration or access

Recording working hours is something different from securing access to a place. The Dutch Data Protection Authority fined a company where employees had to have their fingerprint scanned for attendance and time registration [8]. A pass or PIN code usually suffices there, so biometrics is not necessary. For access to, for example, a safe, a server room or a secured store of valuable or dangerous goods, the substantial interest may well be present. Record your assessment.

Consent

Employees' consent usually offers no way out. According to the AP, an employer may in principle not ask for it, because employees depend on their employer and often cannot refuse [9].

The works council

A scheme on facilities suitable for monitoring attendance requires the works council's consent [3] [4], as does a scheme on the processing of personnel's personal data [5].

And the AI Act

A system that only confirms that someone is who they claim to be is expressly outside the high-risk category of remote biometric identification [6]. Biometric verification is a one-to-one comparison with previously provided data [7]. The GDPR rules continue to apply.

Sources

  1. [1] GDPR Art. 9(1) (General Data Protection Regulation (GDPR), Regulation (EU) 2016/679). Processing of biometric data for unique identification is prohibited in principle.
    1. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.
    Source, retrieved on 3 October 2026.
  2. [2] UAVG Art. 29 (Dutch GDPR Implementation Act (UAVG); Dutch law, unofficial translation). Exception for biometrics that is necessary for authentication or security because of a substantial public interest in lawful access. Original Dutch text:
    Gelet op artikel 9, tweede lid, onderdeel g, van de verordening, is het verbod om biometrische gegevens met het oog op de unieke identificatie van een persoon te verwerken niet van toepassing, indien de verwerking noodzakelijk is voor authenticatie of omwille van beveiligingsdoeleinden en slechts voor zover dit noodzakelijk is vanwege een zwaarwegend algemeen belang van rechtmatige toegang tot bepaalde plaatsen, gebouwen, diensten, producten, informatiesystemen of werkprocessystemen.
    Source, retrieved on 3 October 2026.
  3. [3] WOR Art. 27(1), introductory wording (Dutch Works Councils Act (WOR); Dutch law, unofficial translation). The works council's consent is required for the schemes in Article 27(1). Original Dutch text:
    De ondernemer behoeft de instemming van de ondernemingsraad voor elk door hem voorgenomen besluit tot vaststelling, wijziging of intrekking van:
    Source, retrieved on 3 October 2026.
  4. [4] WOR Art. 27(1)(l) (Dutch Works Councils Act (WOR); Dutch law, unofficial translation). Consent is required for a scheme on facilities for monitoring attendance, behaviour or performance. Original Dutch text:
    l. een regeling inzake voorzieningen die gericht zijn op of geschikt zijn voor waarneming van of controle op aanwezigheid, gedrag of prestaties van de in de onderneming werkzame personen;
    Source, retrieved on 3 October 2026.
  5. [5] WOR Art. 27(1)(k) (Dutch Works Councils Act (WOR); Dutch law, unofficial translation). Consent is required for a scheme on the processing of personnel's personal data. Original Dutch text:
    k. een regeling omtrent het verwerken van alsmede de bescherming van de persoonsgegevens van de in de onderneming werkzame personen;
    Source, retrieved on 3 October 2026.
  6. [6] AI Act, Annex III, point 1(a) (AI Act, Regulation (EU) 2024/1689). Biometric verification that only confirms that someone is who they claim to be falls outside Annex III, point 1(a).
    (a) remote biometric identification systems. This shall not include AI systems intended to be used for biometric verification the sole purpose of which is to confirm that a specific natural person is the person he or she claims to be;
    Source, retrieved on 3 October 2026.
  7. [7] AI Act Art. 3(36) (AI Act, Regulation (EU) 2024/1689). Definition of biometric verification.
    ‘biometric verification’ means the automated, one-to-one verification, including authentication, of the identity of natural persons by comparing their biometric data to previously provided biometric data;
    Source, retrieved on 3 October 2026.
  8. [8] AP Art. nieuwsbericht 30 april 2020 (Dutch Data Protection Authority (AP); Dutch law, unofficial translation). The AP ruled that a company should not have processed employees' fingerprints for attendance and time registration. Original Dutch text:
    Werknemers van een bedrijf hebben hun vingerafdrukken moeten laten scannen voor aanwezigheids- en tijdsregistratie. De Autoriteit Persoonsgegevens (AP) heeft na onderzoek geconcludeerd dat het bedrijf geen vingerafdrukken van medewerkers had mogen verwerken.
    Source, retrieved on 3 October 2026.
  9. [9] AP Art. nieuwsbericht 30 april 2020 (Dutch Data Protection Authority (AP); Dutch law, unofficial translation). According to the AP, an employer may in principle not ask for consent to process fingerprints. Original Dutch text:
    Vraagt een werkgever om toestemming aan medewerkers om hun vingerafdruk te verwerken? Dat mag in principe niet. Medewerkers zijn afhankelijk van hun werkgever, dus vaak niet in een positie om te kunnen weigeren.
    Source, retrieved on 3 October 2026.

Related questions

May we use AI to track employees' productivity or behaviour?Does our works council have a right of consent if we introduce an AI tool for HR?Do we have to carry out a DPIA before we use AI in recruitment or personnel management?

Next step

Describe one AI tool, for example your recruitment or planning software, in four questions. You see at once which rules may apply, with the source, before you enter any data.

Map your AI tool

Looking for a specialist? We will look with you for a suitable specialist; mediation is not guaranteed.

This page gives general information based on the text of the law. It is not legal advice for your situation.