Plan the complete data lifecycle
Before using face recognition, the deploying organisation should assess the applicable laws and document how personal and biometric data will be handled.
- Identify and document an appropriate lawful basis and, where required, an applicable condition for processing biometric data.
- Provide clear notices explaining the purpose, controller, retention period, recipients and individual rights.
- Collect only the data needed, restrict access, protect stored data and define deletion procedures.
- Assess whether a Data Protection Impact Assessment or other local assessment is required before deployment.
- Provide an appropriate alternative route where required by law or by the organisation’s policy.
For EU/UK deployments, biometric data used for uniquely identifying a person can be subject to special-category rules under data-protection law. US requirements vary by state and use case, including specific biometric privacy laws. Obtain advice from qualified privacy counsel for the intended deployment. This page is product information, not legal advice.