Can UK employers use face recognition for staff attendance?
Biometric attendance is not automatically lawful or unlawful in the UK. Employers must establish a lawful basis and special-category condition, assess necessity and proportionality, and review less intrusive alternatives. In 2024 the ICO found Serco's attendance processing unlawful. On-device matching changes the data flow, not the employer's legal responsibilities or the need for assessment.
Last reviewed: 18 October 2026 · FaceTagr team
What should be decided before rollout?
| Decision | What to document |
|---|---|
| Purpose and necessity | Why a less intrusive method is insufficient for this specific workflow |
| Lawful processing | Lawful basis and biometric-data condition; consent where required |
| Worker choice | A practical non-face route and a human exception process |
| Data flow | Capture, enrolment reference, template, match result and any sync destination |
| Retention | Deletion schedule, access permissions and audit responsibilities |
What did the ICO find in the Serco case?
In February 2024 the ICO ordered Serco Leisure, Serco Jersey and seven associated trusts to stop facial-recognition and fingerprint attendance processing affecting more than 2,000 workers at 38 sites. It found necessity and proportionality had not been demonstrated and workers had not been proactively offered an alternative. Destruction within three months was a remedy in those notices, not a general retention limit for all employers.
When should you choose a less intrusive method?
If a card, QR code, supervisor approval or another method adequately meets the purpose, record why biometrics would be necessary before choosing them. Consult your data protection adviser; workplace consent is not automatically freely given.
What does FaceTagr change?
Offline matching can reduce dependence on a remote face API. Your organisation still owns the assessment, notice, alternatives, retention and decisions about how results affect workers. ICO guidance may change, so check the current guidance before rollout.
Plan a pilot around your workflow
For privacy or deletion requests, contact support@facetagr.com. Read our privacy policy.
Sources
- ICO: Serco Leisure biometric attendance enforcement (February 2024)
- ICO: biometric recognition guidance
Product capabilities describe FaceTagr's supported workflows, not third-party endorsement. This page is general information, not legal advice. Check your obligations with your data protection officer or adviser.
Frequently Asked Questions
Does processing on the device remove privacy obligations?
Face templates are biometric data, even when capture photos are not retained. Define the lawful basis, notice and consent where required, retention, access controls and a workable non-face alternative before rollout. On-device processing does not by itself establish legal compliance.
Are workers' photos stored?
Configured mobile attendance workflows can avoid retaining check-in photos or video. Enrolment references, templates and attendance records still need a documented retention policy. Customer-built SDK apps and CCTV may store images according to their configuration; confirm the data flow before deployment.