Biometric and Facial Recognition Data Under the DPDP Act

Introduction

Fingerprint readers at office doors, face scanners at housing society gates and airport boarding gates, live photographs at SIM counters: biometric capture is now routine in Indian daily life.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) treats a fingerprint like any other personal data. There is no special category. That does not make biometrics easy. Other laws still draw hard lines, and the Act's general duties weigh more when the data is a body measurement that stays with a person for life.

This article sets out the position as of October 2026, the ground that fits each common use, and the safeguards a biometric template needs. Trayambic's sector studies cover several settings in depth; this piece connects them.

The legal position

The DPDP Act. Personal data is "any data about an individual who is identifiable by or in relation to such data" (s.2(t)), which plainly includes a face image or a fingerprint template. The organisation that decides why and how it is processed is the data fiduciary; the individual is the data principal. Processing needs consent (s.6) or a legitimate use from the closed list in s.7. The general duties then apply: accuracy where data drives a decision (s.8(3)), reasonable security safeguards (s.8(5) and Rule 6), breach notices (s.8(6) and Rule 7), erasure when the purpose ends (s.8(7)) and, for anyone under 18, the children's rules in s.9. These provisions commence on 13 May 2027.

The SPDI Rules, for now. The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the SPDI Rules) define biometrics to include "facial patterns" used for authentication (r.2(1)(b)), list biometric information as sensitive (r.3), require consent "in writing through letter or Fax or email" before collection (r.5(1)) and bar keeping it longer than required (r.5(4)). They were made under s.87(2)(ob) read with s.43A of the IT Act. Section 44(2) of the DPDP Act omits both when it commences, on about 13 May 2027. In our view the SPDI Rules lapse then, for the reasons Trayambic's Insight on the SPDI Rules and section 43A sets out. Until then, written consent is required.

Aadhaar. The Aadhaar Act, 2016 separates "biometric information" (photograph, fingerprint, iris scan and other specified attributes, s.2(g)) from "core biometric information" (fingerprint, iris scan and other specified attributes, s.2(j)). Core biometric information collected or created under the Act may not be "shared with anyone for any reason whatsoever" or used except to generate Aadhaar numbers and authenticate (s.29(1)). Authentication needs the individual's consent (s.8(2)(a)) and is open only to entities the Authority allows (s.4(4)). A requesting entity must capture biometrics on registered devices (reg 7) and ensure core biometric information is "not stored, shared or published for any purpose whatsoever" (reg 17(1)(a) of the Aadhaar (Authentication and Offline Verification) Regulations, 2021).

Telecom. Section 3(7) of the Telecommunications Act, 2023 requires biometric identification of users of notified services. The User Identification Rules, 2026 use Aadhaar e-KYC or document-based KYC with live face capture, and bar point-of-sale staff from storing biometric information; Trayambic's telecom study covers them.

Analysis

No special category, but not a free pass

From May 2027, in our view, no written consent is needed for biometrics; the ordinary grounds apply. Sensitivity does not vanish from the Act, though. The Centre weighs "the volume and sensitivity of personal data" when designating a Significant Data Fiduciary (s.10(1)(a)), and the Data Protection Board weighs "the type and nature of the personal data affected" when setting a penalty (s.33(2)(b)). A leaked face database will be judged as what it is.

The ground follows the setting

The same camera can need different grounds in different places.

Three readings drive the table. Employment covers attendance, as Trayambic's manufacturing study and its article on employee monitoring explain, but not productivity analytics. For members and visitors, face entry is a convenience with obvious alternatives, so consent, which must be free and as easy to withdraw as to give (s.6(4)), is the safer ground even where s.7(a) is arguable. And the offences exemption in s.17(1)(c) follows purpose: a retail watchlist aimed at theft may use it, as our retail study explains, but recognising a returning customer to sell to her may not. Our housing society and aviation studies cover gates and Digi Yatra, including the pending Kerala High Court challenge.

Children

Section 9(3) bars "tracking or behavioural monitoring of children". In our view a face log of a child's comings and goings is tracking. Under Rule 12 and the Fourth Schedule, educational institutions, crèches and child transport providers are exempt from s.9(1) and 9(3) for limited safety and educational purposes, so in our view a school's face-based attendance can fit; Trayambic's article on children's data in schools covers the limits. Gyms, societies, malls and co-working spaces have no such exemption. Their safest course is not to enrol children at all.

Securing templates

Biometric data is permanent, so the security duty bites hardest here. Rule 6 sets the floor: encryption or tokenisation, access control, logs kept a year, backups, detection and processor contracts. For biometrics we would add:

• store templates, not images, and match on the reader or on a card where possible rather than in a central database;
• protect templates so they can be revoked and re-issued, the property ISO/IEC 24745:2022 calls renewability;
• test liveness against photos and masks, using the presentation attack detection framework in ISO/IEC 30107-1:2023;
• bar the vendor from using templates to train its models, in the s.8(2) contract;
• send any adverse match, such as a denied entry or a watchlist hit, to a person before action, because s.8(3) demands complete and accurate data where it drives a decision about someone.

A leaked template is a personal data breach, and Rule 7 notices should say plainly that the data cannot be changed and what the fiduciary is doing about it.

When the State is the one watching

The State is a "person" under the Act, but s.17(1)(c) lifts most duties for processing to prevent or investigate offences, and s.17(2)(a) lets the Centre exempt notified instrumentalities. In our view the constraint on police face recognition is therefore mainly constitutional. Justice K.S. Puttaswamy v Union of India, (2017) 10 SCC 1, requires an intrusion on privacy to rest on law, pursue a legitimate aim and be proportionate; in 2018 the Supreme Court refined proportionality into four steps, which NITI Aayog's 2022 discussion paper on facial recognition summarises: a legitimate goal, suitable means, the least restrictive equally effective option, and no disproportionate impact on the right holder.

The Criminal Procedure (Identification) Act, 2022 counts photographs and iris and retina scans as "measurements" that listed persons must give, and the National Crime Records Bureau keeps them for 75 years, destroying them for people without a prior conviction who are released, discharged or acquitted, unless a court directs otherwise. In our view that Act governs taking and keeping measurements; it does not expressly address matching faces captured in public spaces against them, which is where the legality and proportionality questions sit.

Practical implications

Worked example: a co-working operator retires fingerprints

An operator runs 14 centres with 9,000 members, most of them employees of client companies, plus 250 staff of its own. Fingerprint templates sit on the access vendor's central server. In October 2026 it decides to move to face entry. Figures are illustrative.

1. 1.Clean up first. Templates of departed members and staff are deleted now, under SPDI r.5(4); the vendor deletes its copies, as s.8(7)(b) will require, and certifies that it has.
2. 2.Ground by group. Everyone enrolling gives written consent while the SPDI Rules last. From May 2027, own staff fall under s.7(i) and members stay on consent. Where a client asks the operator to record its employees' attendance, the operator acts as the client's processor, on the client's ground.
3. 3.Design. Templates are matched on the door reader, no images are kept, and liveness detection is switched on.
4. 4.Alternatives. Every door accepts an app QR code or card, at no extra cost, so consent stays free.
5. 5.Outsiders. Visitors, contractors' staff and children at member events receive passes, never face enrolment.
6. 6.Retention. Templates go within 30 days of a membership ending; entry logs stay one year (Rule 6).
7. 7.Breach plan. If templates leak, the operator tells the Board and each member, explains the risk and re-enrols with new template parameters.

Checklist

Key takeaways

The DPDP Act does not label biometrics sensitive, but sensitivity returns through the Board's penalty factors, the Aadhaar Act and the children's rules. Choose the ground by setting, give everyone a non-biometric way in, keep templates local and revocable, and plan for a breach whose effects are permanent.

• The DPDP Act has no special category for biometrics; in our view the SPDI Rules' written-consent rule lapses when s.43A is omitted on about 13 May 2027, and applies until then.
• Aadhaar core biometrics may not be shared with anyone (Aadhaar Act s.29(1)), and requesting entities may not store them (reg 17(1)(a) of the 2021 Regulations).
• The ground depends on the setting: s.7(i) for staff attendance, consent for members, residents, travellers and shoppers, s.17(1)(c) only for genuine offence prevention.
• Section 9(3) bars tracking children; outside schools, crèches and child transport, do not enrol them.
• Biometric data is permanent: keep templates on the device, make them revocable, test liveness and bar vendors from reuse.