Biometric data in schools: consent, privacy and the law
Biometrics are sensitive personal data. Used correctly — with consent and alternatives — they are both lawful and trusted.
HAWA Published Updated 1 min read
Fingerprints and faces are sensitive personal data in most legal systems, including under the GDPR and many African data-protection laws. That does not mean you cannot use them — it means you use them carefully.
Get explicit, informed consent
Explain what is collected, why, how long it is kept, and who can see it. Record the consent. For minors, consent usually comes from a parent or guardian.
Always offer an alternative
Anyone who declines biometrics must be able to use a card or PIN instead, with no penalty. A system that supports all three methods makes this easy and keeps you compliant.
Minimise what you store
Store a mathematical template, not the raw fingerprint image, and only the data you actually need. Never keep more, or longer, than necessary.
Set a retention period
Define how long attendance and biometric data are kept, and delete it on schedule. Document the policy.
Secure it
Encrypt sensitive data, limit who can access it, and keep an audit trail. A breach of biometric data is far more serious than a lost password.
Handled this way, biometric attendance is lawful, proportionate and — crucially — trusted by staff and families.
