Can employees refuse to give biometric data under DPDP?
Biometric attendance is widespread in Indian organisations. Here is what the DPDP Act says about employee rights to refuse.
Is biometric attendance lawful under DPDP?
Biometric attendance is lawful under DPDP if: employees provide explicit, informed consent before their biometric data is enrolled; a non-biometric alternative is offered to those who do not wish to enrol; biometric data is encrypted and stored with the highest security standards; and it is deleted when employment ends. It is not lawful to make biometric enrolment a non-negotiable condition of employment or to deny benefits (salary, leave approvals) to employees who use the alternative attendance method.
What must employers do to make biometric consent valid?
For biometric attendance consent to be valid under DPDP: inform employees specifically about what biometric data is collected (fingerprint template vs raw fingerprint image vs facial geometry); how it is stored and who can access it; how long it is retained; that a non-biometric alternative exists; and that they can withdraw consent at any time. Obtain written consent — a signed form or an in-system acceptance with a clear description of the above. Ensure employees understand they have a genuine choice. Consent obtained by implying that biometric enrolment is mandatory when it is not is not valid.
Do employees have the right to have their biometric data deleted?
Yes. Under DPDP, the right to erasure covers biometric data. An employee who withdraws consent from a biometric attendance system has the right to have their biometric template deleted from the system. The employer must: delete the biometric template from the attendance system; confirm deletion to the employee; and provide the alternative attendance method. Employers cannot retain biometric templates 'for audit purposes' after the employee withdraws consent — biometric templates serve no purpose beyond authentication and must be deleted immediately on withdrawal.
What happens to biometric data when an employee leaves?
On termination of employment, biometric data should be deleted immediately — there is no legitimate reason to retain a former employee's fingerprint or facial template. Build an automated deletion trigger: when an employee is offboarded in your HRMS, their biometric template should be deleted from the attendance system within 24–48 hours. Retain a record that the biometric data was deleted (date, time, confirmation) as part of your data deletion audit log.
Can Aadhaar-based biometric authentication be used for attendance?
Using Aadhaar biometrics for attendance authentication raises additional concerns beyond DPDP: the Aadhaar Act and UIDAI regulations prohibit private entities from performing Aadhaar biometric authentication for attendance purposes. Aadhaar-based biometric authentication is restricted to specific use cases authorised by UIDAI. Many organisations that use 'Aadhaar attendance' systems are operating outside the permitted use cases. Separately from DPDP, check your Aadhaar authentication use against UIDAI's authorised use list.
What are the operational implications of DPDP for large biometric deployments?
Organisations with large biometric attendance deployments — factories, offices with hundreds of employees — need to: audit whether valid consent was obtained at the time of enrolment (most systems did not obtain written consent in the required form); implement a retroactive consent re-validation exercise; design and deploy an alternative attendance method; handle employees who withdraw consent; and ensure biometric templates are deleted on termination. This is an operational programme, not just a policy change. Budget for it as part of your DPDP compliance programme.
Frequently asked questions
Can we include biometric consent in the employment contract?
Bundling biometric consent into the employment contract is problematic because the power imbalance between employer and employee means the consent may not be 'free' — employees may feel coerced. A standalone, clearly explained consent form for biometric attendance, with a prominent disclosure that an alternative method is available, is the right approach. The consent should be obtained separately from the employment offer, after the individual has started work and has the security of employment, not as a condition of the offer.
Does DPDP change anything about GPS tracking of field employees?
GPS location tracking of field employees (delivery agents, sales reps, field technicians) is personal data processing that requires disclosure in the employee privacy notice and, for tracking beyond working hours or at granular levels, explicit consent. Tracking employees' location only during working hours for operational purposes (route optimisation, attendance confirmation) may be covered by the employment basis. Tracking location outside working hours, tracking at a granularity beyond what is operationally necessary, or using location data for disciplinary purposes requires explicit consent and policy transparency.
What if an employee already enrolled their biometrics before DPDP enforcement?
For existing biometric enrolments made before DPDP enforcement, you need to either: obtain retroactive consent in the correct form (explicit, with disclosure of alternatives); or transition to alternative attendance methods for employees who do not wish to re-consent. A retroactive consent campaign — re-enrolling employees with proper consent documentation — is the correct approach. Employees who decline to re-consent must be offered the alternative attendance method without penalty.
Review your biometric attendance DPDP compliance
Niti Bharat's Employee Data Audit covers biometric consent validation, alternative attendance design, deletion protocols, and retroactive re-consent programmes for DPDP compliance.
Start Employee Biometric Audit