Quick answer

A Philippine employer may use fingerprints, facial recognition, or another biometric system to record attendance, but management prerogative does not override the Data Privacy Act of 2012. The employer must have a lawful and specific reason for processing the data, collect only what is necessary, clearly explain how the system works, protect the data, limit access and retention, and respect employees’ data-subject rights.

Employees do not have an automatic right to reject every biometric attendance system. However, they may question or object to processing that is excessive, unexplained, insecure, unrelated to attendance, or unsupported by a valid legal basis. An employer should also consider a reasonable non-biometric method when an employee cannot safely or reliably use the system, or when the same attendance purpose can be achieved through a less intrusive method.

Whether a particular system is lawful depends on its design and operation—not merely on the fact that it uses biometrics.

Why biometric attendance data requires special care

Biometric systems analyze characteristics associated with a person, such as fingerprints, facial features, iris patterns, or voice. The resulting image, measurement, template, or identifier is personal data when it can identify or authenticate an employee.

Philippine law defines sensitive personal information by specific statutory categories. It does not expressly declare every biometric identifier sensitive personal information in every situation. Classification therefore depends on what the system collects and what other information is linked to it. Even when a biometric template does not fall within a statutory sensitive-information category, it remains personal information and may present a serious privacy and security risk because it is used to establish identity and cannot be replaced as easily as a password.

The governing framework is Republic Act No. 10173, or the Data Privacy Act of 2012, together with its Implementing Rules and Regulations and National Privacy Commission (NPC) issuances.

What makes a biometric attendance system lawful

There must be a valid legal basis

An employer must identify the applicable basis under Sections 12 or 13 of the Data Privacy Act, depending on the data involved. Possible bases may include:

processing necessary to perform or administer the employment contract;
compliance with a legal obligation;
processing necessary or desirable in the context of the employer-employee relationship, where the statutory conditions apply;
a legitimate interest that is not overridden by the employee’s constitutional or statutory rights; or
valid consent, when consent is genuinely appropriate.

Recording time worked is a legitimate employment function. The Labor Code recognizes rules on compensable hours, wages, and attendance-related obligations. But the need to maintain attendance records does not automatically prove that collecting biometric data is necessary. The employer should be able to explain why the selected biometric method is appropriate and proportionate to the actual attendance problem.

Consent is not a cure-all

An employer should not assume that a signed consent form makes any biometric system lawful. Under NPC Circular No. 2023-04 on consent, valid consent must be freely given, specific, informed, and evidenced by written, electronic, or recorded means.

Because employees depend on their employer for work and income, there may be a power imbalance. Consent is doubtful if refusing means discipline, loss of pay, exclusion from work, or another disadvantage and the employee has no meaningful choice. If the processing is actually necessary for a contract or legal obligation, the employer should identify that basis honestly instead of presenting compulsory processing as optional consent.

Withdrawing consent also does not necessarily stop processing if another lawful basis independently applies. The employer must identify and document the basis it is relying on.

The system must follow the three core data-privacy principles

The employer, as the personal information controller, must observe:

Transparency: Employees must be told what is collected, why it is collected, how it is used, who receives it, how long it is kept, what rights they have, and whom they can contact.
Legitimate purpose: Biometric data must be used only for declared, lawful purposes compatible with employment. Attendance data should not quietly become a tool for unrelated surveillance, profiling, marketing, or undisclosed law-enforcement access.
Proportionality: Collection must be adequate, relevant, suitable, necessary, and not excessive. If an employee number, access card, PIN, manual log, or another less intrusive measure can reliably meet the need, the employer should be ready to explain why biometric processing is still justified.

What employees should be told before enrollment

A clear privacy notice should ordinarily be provided before biometric data is captured. It should state, in understandable language:

the employer’s identity and contact details;
the Data Protection Officer’s contact details;
whether a fingerprint image, facial image, mathematical template, or another identifier is collected;
whether raw images are immediately converted or deleted;
the purpose and legal basis for processing;
whether enrollment is mandatory and the consequences of not providing the data;
what non-biometric alternatives or exception procedures exist;
where the information is stored and whether storage is local, cloud-based, or outside the Philippines;
who may access it, including HR, payroll, security personnel, affiliates, and vendors;
whether the data is shared or processed by a third-party attendance provider;
the retention period or objective criteria used to determine it;
how the data will be securely destroyed or anonymized;
how employees may exercise their rights; and
how complaints and suspected breaches may be reported.

A vague statement such as “for company purposes” is not an adequate explanation of purpose.

Security duties of the employer and system provider

The employer remains accountable even when a vendor supplies the device, hosts the database, or manages the attendance platform. The parties should have a proper processing agreement defining instructions, confidentiality, security, breach response, deletion or return of data, audit responsibilities, and restrictions on subcontracting and reuse.

Reasonable safeguards should reflect the sensitivity, volume, location, accessibility, and risks of the data. Under NPC Circular No. 2023-06 on security of personal data, relevant controls may include:

storing protected biometric templates instead of reusable raw images where feasible;
encryption during transmission and storage;
strict role-based access and prompt removal of access when personnel change roles;
multifactor authentication for administrators;
access logs and monitoring for unauthorized queries, exports, or changes;
secure device configuration, patching, vulnerability management, and backups;
physical protection of terminals and servers;
segregation of biometric records from ordinary HR or payroll records where appropriate;
contractual controls over vendors and cloud providers;
a tested incident-response process; and
irreversible deletion or secure disposal when retention is no longer justified.

The NPC’s Privacy Impact Assessment guidance treats a PIA as a process for identifying privacy effects and addressing risks. A biometric rollout presents the kind of identity, security, proportionality, and employee-rights issues that should be assessed before implementation and whenever the system materially changes.

How long may biometric data be kept?

There is no single universal retention period for every private-sector biometric attendance system. Retention must be tied to a lawful and declared purpose, applicable labor, tax, accounting, evidentiary, or sector-specific requirements, and any genuine need to resolve attendance or payroll disputes.

The employer should adopt a written retention schedule for different records instead of keeping everything indefinitely. A biometric enrollment template may require a different retention period from ordinary time-in/time-out logs.

When employment ends or the attendance purpose expires, the employer should review whether continued retention remains legally necessary. Data that is no longer needed must be securely deleted, destroyed, anonymized, or otherwise put beyond further unauthorized processing. “The system keeps it automatically” is not, by itself, a lawful retention basis.

Your rights as an employee

Subject to the Data Privacy Act’s conditions and lawful limitations, an employee may exercise the following rights:

Right to be informed: You may ask for a complete privacy notice and an explanation of the processing.
Right of access: You may request reasonable access to personal data being processed, its sources, recipients, purposes, processing methods, disclosures, storage period, and relevant automated processes.
Right to object: You may object where processing is based on consent or legitimate interest. The right is not absolute; processing may continue when another lawful ground applies, including certain contractual, legal, or employment-related necessities.
Right to rectification: You may dispute inaccurate or erroneous attendance information and ask for correction.
Right to erasure or blocking: In the circumstances recognized by law, you may seek deletion, removal, blocking, or destruction—for example, when data is incomplete, outdated, unlawfully obtained, used for unauthorized purposes, or no longer necessary. Valid legal-retention duties may limit this right.
Right to data portability: When the statutory requirements are met and data is processed electronically in a structured and commonly used format, you may obtain a copy for further use.
Right to damages: You may claim compensation when legally entitled for harm caused by inaccurate, incomplete, outdated, unlawfully obtained, or unauthorized use of personal data.
Right to complain: You may bring a qualifying privacy complaint before the NPC.

The detailed guidance appears in NPC Advisory No. 2021-01 on data-subject rights.

What to do if you are concerned about the system

1. Ask precise questions in writing

Write to HR and the Data Protection Officer. Identify the concern and request:

the privacy notice and attendance policy;
the exact biometric element collected;
the purpose and legal basis;
the retention and deletion rules;
the identities or categories of recipients and vendors;
the procedure for access, correction, objection, and deletion requests;
the alternative process for failed matches, disability, injury, illness, religious concerns, or other exceptional circumstances; and
confirmation of whether a PIA was performed, without demanding confidential security details that could expose the system.

Keep proof that the request was received.

2. Request an alternative when justified

Explain why biometric enrollment or scanning is unsafe, unreliable, inaccessible, or disproportionate in your circumstances. Attach appropriate supporting documents where relevant. Possible alternatives include a proximity card, employee PIN, authenticated application, supervisor-certified log, or another auditable method.

The law does not guarantee that an employee may select any preferred method. Management may assess operational requirements, security, fraud risks, cost, and equal treatment. The decision should nevertheless be reasonable, documented, and consistent with privacy and labor obligations.

3. Challenge incorrect attendance promptly

Do not wait for payroll deductions or disciplinary action. Save the disputed schedule, payslip, attendance report, device error, supervisor messages, and proof that you were working. Ask HR to preserve the relevant system logs and vendor records.

A biometric “no match” does not necessarily prove absence. Any adverse employment decision should account for device error, failed enrollment, connectivity problems, authorized fieldwork, approved leave, and other available evidence.

4. Use the organization’s privacy process

Send the complaint to the DPO or the office identified in the privacy notice. State the remedy you want, such as access, correction, an explanation, restriction of access, deletion after the lawful retention period, or investigation of an unauthorized disclosure.

5. Escalate to the proper agency if necessary

For a privacy violation, the NPC generally expects the complainant first to inform the personal information controller or concerned entity in writing. Under the NPC’s rules, a formal complaint generally requires lack of timely or appropriate action—or no response within 15 days—and must generally be filed within six months from the violation or breach, or 30 days from the last communication with the organization, whichever is earlier. The NPC may waive requirements in circumstances allowed by its rules. Because the “whichever is earlier” rule can shorten the practical filing window, do not delay.

The NPC provides the current complaint form, filing options, and fee information on its official complaint page. A formal complaint is generally verified or made through the prescribed complaint-assisted form, notarized, and supported by evidence.

If the dispute concerns unpaid wages, an attendance-based deduction, suspension, dismissal, retaliation, or another labor issue, privacy proceedings may not provide the complete remedy. A worker may separately seek assistance through DOLE’s Single Entry Approach and Assistance for Request Management System. Privacy and labor remedies can involve different requirements and deadlines.

Evidence to preserve

Keep lawful copies of:

the privacy notice, consent form, employee handbook, and biometric policy;
enrollment instructions and acknowledgments;
emails or messages with HR, the DPO, supervisors, and the vendor;
screenshots or photographs of error messages that do not expose coworkers’ data;
time records, work schedules, payslips, leave approvals, and payroll deductions;
proof of presence or work, such as authorized system logins, job tickets, or supervisor-confirmed records;
requests for access, correction, objection, deletion, or an alternative method;
the employer’s replies and proof of delivery;
notices of a breach or unauthorized disclosure; and
medical or accessibility documents relevant to an exception request.

Do not obtain evidence by accessing accounts without permission, bypassing security, recording protected communications unlawfully, or copying coworkers’ personal data unnecessarily.

Common mistakes to avoid

Assuming that an employer can collect any information merely because attendance monitoring is legitimate.
Assuming that every biometric system is automatically illegal.
Treating a mandatory enrollment form as conclusive proof of freely given consent.
Objecting only verbally and keeping no record.
Demanding immediate deletion despite a valid legal or evidentiary retention requirement.
Posting screenshots, attendance reports, or coworker data on social media.
Ignoring incorrect time entries until after discipline or wage deductions.
Filing with the NPC without first notifying the employer in writing, unless a recognized waiver or exceptional ground applies.
Missing the NPC complaint period while waiting through an extended internal exchange.
Treating a privacy complaint as a substitute for timely labor remedies.

When help is urgent

Seek prompt advice from a privacy or labor lawyer, your union, the NPC, or DOLE if:

biometric information has been leaked, sold, publicly posted, or accessed by an unauthorized person;
a vendor appears to be reusing biometric data for another product or purpose;
raw fingerprint or facial images are stored without a clear explanation;
the employer refuses to identify the DPO, vendor, purpose, or retention period;
inaccurate attendance data is causing wage loss or disciplinary action;
you are threatened, suspended, or dismissed after raising a privacy concern;
the system creates an accessibility, health, safety, or discrimination issue;
you receive a breach notice or observe signs of identity misuse; or
a complaint deadline may be approaching.

If a breach is suspected, report it immediately to the employer’s DPO and preserve the notice and surrounding evidence. Mandatory notification obligations depend on the nature and risk of the breach. Where notification is required, NPC rules generally require notice to the Commission and affected data subjects within 72 hours of knowledge or reasonable belief that the qualifying breach occurred. The employer—not the employee—has the statutory reporting responsibility. Current official instructions are available on the NPC’s breach-reporting page.

Frequently asked questions

Can my employer require fingerprint or facial enrollment?

Possibly. A requirement may be lawful if it rests on an appropriate legal basis and is transparent, necessary, proportionate, secure, and fairly implemented. Calling enrollment “company policy” does not dispense with those requirements.

Can I refuse to give consent?

You may withhold consent when consent is genuinely the proposed basis. But refusal does not automatically prevent processing supported by another lawful basis. Ask the employer to identify the precise basis and explain whether an alternative attendance method is available.

Must the company offer a non-biometric option?

There is no blanket rule guaranteeing every employee an unconditional opt-out. An alternative deserves serious consideration when biometrics are unreliable or inaccessible for the employee, create a substantiated risk, or are unnecessary because a less intrusive method can meet the same purpose. The result depends on the facts and applicable employment obligations.

May the employer use attendance biometrics for security or investigations?

Only if that additional processing has a lawful, specific, and compatible purpose and employees receive the required information. A system introduced solely for attendance should not silently be expanded into general surveillance or profiling.

Can HR show my attendance records to my supervisor?

Access may be proper when the supervisor genuinely needs the information for attendance, scheduling, payroll, or performance administration. Access should be limited to authorized personnel and the minimum information necessary. Public posting or unnecessary disclosure to coworkers may violate privacy obligations.

Can I ask for my biometric data to be deleted when I resign?

Yes, you may request deletion and an explanation of continued retention. Immediate deletion is not guaranteed if the employer can identify a valid legal or evidentiary reason to retain particular records. The employer should distinguish the biometric template from ordinary attendance, payroll, and employment records and delete each when its justified retention period ends.

Who is responsible when a third-party provider suffers a breach?

The vendor may have direct obligations as a personal information processor, but outsourcing does not remove the employer’s accountability as personal information controller. Contractual arrangements between them do not take away the employee’s rights under the Data Privacy Act.

Where can I verify the rules?

The principal official sources are the Data Privacy Act, its Implementing Rules and Regulations, the NPC’s advisories and circulars, and the NPC complaint guidance.

This article provides general Philippine legal information, not legal advice for a particular employee, employer, or dispute. Outcomes depend on the system design, privacy documents, employment terms, applicable sector rules, and evidence. Official sources and procedures were checked as of July 27, 2026.