Quick answer

A Philippine employer may use fingerprint, facial-recognition, or similar technology to record attendance. But “for attendance” does not automatically make every biometric system lawful.

The employer must comply with the Data Privacy Act of 2012 and applicable National Privacy Commission (NPC) rules. It should have a specific lawful basis, collect only what is genuinely necessary, explain the system clearly, protect the data, limit access and retention, and remain accountable for outside vendors.

There is no general law requiring every employee to surrender biometric data. Labor rules require employers to maintain time records, but they recognize non-biometric methods such as Bundy clocks, timekeepers, and daily time records. On the other hand, an employee does not necessarily have an absolute right to refuse a lawful, proportionate attendance policy. Whether an employer can insist on biometrics depends on the system, its stated purpose, the data collected, the available alternatives, and the employer’s actual legal basis.

Why biometric attendance raises special privacy concerns

Biometric systems may process fingerprints, facial images or measurements, iris patterns, voice features, or other characteristics used to recognize a person. They may retain the original image, a mathematical template derived from it, matching results, device logs, and attendance records.

Biometric data that identifies or can reasonably identify an employee is personal information. The Data Privacy Act does not expressly classify every form of biometric data as sensitive personal information. However, a system may also process sensitive personal information—such as age, health information, or government-issued identifiers—which is governed by the stricter rules in Section 13 of the Act.

Biometrics also deserve heightened care because they are closely connected to a person’s physical identity and cannot ordinarily be changed like a password. The NPC’s breach rules expressly treat biometric data as information that may be used to enable identity fraud.

When biometric attendance may be lawful

A compliant system should satisfy all the following requirements.

The purpose must be specific and legitimate

Recording work attendance, computing hours worked, preventing “buddy punching,” or controlling access may be legitimate business purposes. The employer should identify the actual purpose before collecting data.

“Security,” “company policy,” or “future business needs” is not enough if left vague. Attendance biometrics should not quietly be reused for unrelated facial analytics, location tracking, productivity scoring, employee profiling, marketing, or testing another product.

A new and incompatible use requires its own assessment and lawful basis.

The employer must identify the correct lawful basis

For ordinary personal information, Section 12 of the Data Privacy Act recognizes several possible bases, including consent, contractual necessity, legal obligation, and legitimate interest. Merely purchasing biometric equipment does not create a lawful basis.

If the employer relies on legitimate interest, NPC Circular No. 2023-07 requires a documented assessment showing:

A clearly established lawful interest;
A necessary, lawful, and proportionate method; and
A balance showing that the employer’s interest does not override employees’ fundamental rights and freedoms.

The assessment should consider less intrusive methods and what employees could reasonably expect. Legitimate interest applies only to personal information—not sensitive personal information or privileged information.

If the system processes sensitive personal information, the employer must rely on one of the narrower grounds in Section 13 of the Data Privacy Act.

Consent must be genuinely voluntary when it is used

Consent is not always required. If another lawful basis properly applies, the employer should identify that basis instead of collecting unnecessary signatures.

When consent is the basis, NPC Circular No. 2023-04 requires it to be freely given, specific, informed, and evidenced in writing, electronically, or through another recorded means. Vague or blanket consent is invalid.

Consent is not freely given when pressure, intimidation, an inability to exercise free will, or possible adverse consequences for refusal removes the employee’s genuine choice. A signature obtained under a threat of discipline is therefore not automatically valid consent. Acknowledging receipt of a privacy notice is also different from affirmatively consenting to specific processing.

Collection must be necessary and proportionate

The employer should be able to explain why biometrics are reasonably necessary for the declared purpose and why a less intrusive system would not adequately achieve it.

Relevant questions include:

Is the device storing a raw fingerprint or face image, or only a derived template?
Can matching occur locally without uploading biometrics to a central or overseas server?
Would an ID card, PIN, timekeeper, signed logbook, or other method work adequately?
Does the system collect location, temperature, photographs, or other information that attendance does not require?
Can the system work without retaining the original enrollment image?
Is a non-biometric method available for employees who cannot reliably enroll or match?

The law does not create a universal requirement to offer an alternative in every workplace. However, the availability of a less intrusive method is relevant to necessity and proportionality. An alternative is particularly important where the system repeatedly rejects an employee or cannot accommodate a physical condition.

Employees should receive clear information

As a rule, employees should be told:

What biometric and related data will be collected;
Whether raw images, templates, or both will be stored;
The precise purposes and lawful basis;
How enrollment and matching work;
Whether decisions or payroll calculations are automated;
Who may access the data;
The identity and role of the system vendor;
Where the data will be stored, including any overseas processing;
How long each type of data will be retained;
How the data will be destroyed;
The employer’s and Data Protection Officer’s contact details; and
How employees can exercise their rights or complain.

The Data Privacy Act contains a limited exception from the timing of its detailed notice requirement for certain obvious processing necessary or desirable in an employer-employee relationship. This is not a blanket exemption from transparency, lawful processing, proportionality, security, or data-subject rights.

The system must undergo risk assessment and strong security controls

NPC Circular No. 2023-06 calls for a privacy impact assessment for systems that process personal data. The assessment should cover the data’s full life cycle—from enrollment to deletion—and address risks to employees’ rights and to the data’s confidentiality, integrity, and availability.

Appropriate controls may include encryption, need-to-know access, authentication, access logs, vulnerability management, tested incident-response procedures, secure deletion, and restrictions against unauthorized copying or export.

The employer is not necessarily required to give employees its complete privacy impact assessment or confidential security architecture. It should nevertheless be able to provide meaningful information about the risks, safeguards, and processing affecting them.

Retention must be justified by data type and purpose

Personal data may be retained only as long as necessary for the declared purpose, legal claims, legitimate business purposes, or another period required by law. “We may need it someday” is not a sufficient retention policy.

Philippine labor rules generally require employment records, including required time records, to be preserved for at least three years from the last entry. That does not automatically mean raw facial images or biometric templates must remain stored for the same period. The attendance record and the biometric credential used to create it are different data, and retention of each should be separately justified.

When employment ends or the system is replaced, the employer should determine whether continued retention of the biometric template is still necessary. Data no longer needed should be securely deleted or anonymized.

The employer remains responsible for its vendor

A cloud provider, payroll processor, or biometric-device supplier may process data for the employer. Outsourcing does not transfer the employer’s accountability.

The employer should use a contract that restricts the vendor to documented instructions, requires appropriate security, controls subcontractors and transfers, provides for return or secure deletion, and supports data-subject requests and breach response. A vendor that uses employee biometrics for its own product development or independent purposes may need a separate lawful basis and may itself become a personal information controller.

Employee rights that still apply at work

Subject to lawful exceptions, an employee may exercise the following rights:

Right to be informed: Ask whether biometric data is being processed and obtain meaningful information about the purpose, basis, method, recipients, retention, and automated processing.
Right of access: Request reasonable access to the employee’s personal data, its source, recipients, manner of processing, disclosure reasons, and relevant automated processes.
Right to correction: Dispute inaccurate attendance entries or matching results and request prompt correction.
Right to object: Object to processing and require the employer to explain its lawful basis. This right is not an automatic veto where processing is necessary for a contract, legal obligation, subpoena, or a justified employer-employee purpose.
Right to erasure or blocking: Seek suspension, blocking, removal, or destruction when data was unlawfully obtained, is inaccurate, is used for an unauthorized purpose, or is no longer necessary. Deletion may be denied where another lawful ground, recordkeeping duty, or legal claim justifies retention.
Right to complain and seek indemnity: File a complaint with the NPC and, in an appropriate case, seek indemnity for injury caused by unlawful processing.

Withdrawal of consent should stop processing without undue delay when consent is the only lawful basis. It will not necessarily stop processing if the employer can establish a separate and applicable lawful ground.

What to do if you have concerns

1. Ask the employer in writing

Send HR or the Data Protection Officer a concise request asking for:

The biometric attendance privacy notice;
The exact data collected and retained;
The system’s lawful basis;
The retention and deletion periods;
The identity and location of vendors or cloud providers;
The process for correcting a false match or missed attendance entry; and
Any available non-biometric method.

Keep proof of sending and receipt.

2. Explain any personal difficulty and request a workable alternative

If fingerprint damage, disability, skin condition, facial-recognition errors, religious concerns, or another documented circumstance affects enrollment or matching, explain it in writing. Request a badge, PIN, signed log, supervised time entry, or another reliable method.

Do not provide unnecessary medical details. Submit only what is reasonably needed to support the request.

3. Correct attendance and payroll errors immediately

If a device records an absence or tardiness incorrectly, report it before payroll closes if possible. Ask for human review and correction of both the attendance record and any resulting wage computation.

Preserve:

Schedules and approved shift changes;
Device error messages or lawful screenshots;
Manual logs, access-card records, and payslips;
Emails or messages reporting the failure;
The employer’s privacy notice and attendance policy;
Show-cause notices, disciplinary notices, and your written replies; and
Names of witnesses who saw you report for work.

Do not alter equipment, enroll another person, share credentials, or secretly bypass the system. Those acts may create separate disciplinary issues.

4. Use internal and union remedies

Escalate unresolved issues to the Data Protection Officer, HR, grievance committee, compliance office, or union representative. If a collective bargaining agreement or personnel policy provides a grievance process, follow it while keeping copies of every submission.

5. Complain to the NPC when internal action fails

Under the 2021 NPC Rules of Procedure, as amended, a complainant ordinarily must first inform the employer, vendor, or other concerned entity in writing and give it an opportunity to act. A complaint may proceed when no response is received within 15 calendar days, or when the response is not timely or appropriate. The NPC may waive this exhaustion requirement for good cause or a serious violation, including circumstances involving grave and irreparable harm.

A formal complaint generally must be written, signed, verified, and supported by the relevant evidence, correspondence, witness affidavits if any, requested relief, and certification against forum shopping. Filing fees apply unless an exemption or waiver is available.

Use the NPC’s current complaint page for the latest form, fees, addresses, and authorized filing methods. The rules recognize personal filing, registered mail, courier, and electronic filing when authorized by the Commission.

6. Use labor remedies for wage deductions or discipline

A privacy complaint does not replace a labor claim. If inaccurate biometric records cause unpaid wages, suspension, forced resignation, or dismissal, consider a union grievance or a Request for Assistance through the DOLE Assistance for Request Management System.

Management may adopt reasonable workplace rules, but management prerogative remains limited by special laws and employee rights. If termination for an alleged violation is contemplated, the employer must establish a valid cause and observe due process. For just-cause termination, Supreme Court rulings require a detailed first notice, a reasonable opportunity to answer—generally at least five calendar days—and a written decision notice.

Do not wait for the outer deadline. Ordinary labor money claims generally prescribe in three years from accrual, while an illegal-dismissal action generally prescribes in four years from dismissal. The correct claim and reckoning date can depend on the facts.

If biometric data may have leaked

Report a suspected leak immediately to the employer’s Data Protection Officer. State what happened, when you discovered it, which device or account was involved, and what evidence you have. Avoid publicly posting other employees’ data.

Under NPC Circular No. 16-03, biometric data is among the information that may enable identity fraud. Mandatory notification applies when:

The compromised data involves sensitive personal information or other information that may enable identity fraud;
There is reason to believe an unauthorized person acquired it; and
The unauthorized acquisition is likely to create a real risk of serious harm.

When those conditions are met, the employer, as personal information controller, generally must notify the NPC and affected employees within 72 hours from knowledge or reasonable belief that the breach occurred, subject to the Circular’s rules on delay, postponement, or exemption. Outsourcing the system does not remove the employer’s notification responsibility.

Common mistakes

Mistakes by employers

Treating employee consent as a cure for excessive collection;
Threatening discipline while claiming consent is voluntary;
Using a vague, one-page notice that does not identify the data, vendor, retention period, or lawful basis;
Keeping raw images or templates indefinitely;
Reusing attendance data for surveillance or profiling without a compatible purpose and lawful basis;
Allowing broad HR, IT, vendor, or supervisor access;
Assuming the vendor alone is responsible for security;
Deducting wages based on device errors without a correction process; and
Failing to provide a fallback when a worker cannot reliably use the device.

Mistakes by employees

Assuming the Data Privacy Act completely bans workplace biometrics;
Refusing immediately without first making a written objection or alternative request;
Signing a form without keeping a copy;
Reporting only verbally and leaving no record;
Waiting until several payroll periods have passed before disputing inaccurate entries; and
Filing only a privacy complaint when there is also an urgent wage or dismissal issue.

Possible consequences for unlawful processing

The NPC may order compliance, restrict or ban processing, award indemnity when legally supported, impose administrative fines, or recommend prosecution to the Department of Justice.

Under NPC Circular No. 2022-01, major infractions may carry administrative fines of 0.25% to 2% of the preceding year’s annual gross income, while grave infractions may carry 0.5% to 3%. The total administrative fine for a single act resulting in one or more infractions may not exceed ₱5 million.

The Data Privacy Act also creates separate criminal offenses for conduct such as unauthorized processing, negligent access, improper disposal, concealment of certain breaches, and malicious or unauthorized disclosure. Liability and penalties depend on the offense proved; criminal punishment may be imposed only through the proper prosecution and court process.

Frequently asked questions

Can my employer make biometric attendance mandatory?

Possibly, but not merely by calling it company policy. The employer should establish a lawful basis, necessity, proportionality, transparency, and adequate security. A reasonable alternative or a valid objection may change the result in an individual case.

Does my employer always need my consent?

No. Consent is only one possible lawful basis. An employer may rely on contractual necessity, legal obligation, or legitimate interest when all legal requirements are met. It should not ask for “consent” when employees have no genuine choice.

Can I withdraw my consent after enrollment?

Yes, if consent was the basis. Processing should stop if no other lawful basis applies. Withdrawal does not make past lawful processing unlawful and may not require deletion of records that must still be retained for legal claims or valid recordkeeping purposes.

Can I demand a copy of my biometric data?

You may request reasonable access to your personal data and information about its processing. The right does not automatically entitle you to other employees’ data, proprietary source code, confidential security details, or the employer’s entire privacy impact assessment.

Can the employer give my data to the device vendor?

The vendor may process it under a proper outsourcing arrangement. The employer remains accountable and must ensure comparable protection. Independent vendor use for product training, analytics, or other purposes requires separate legal justification.

Must biometric data be deleted when I resign?

Not necessarily on the same day. The employer may retain data needed for lawful recordkeeping or legal claims. It should separately justify retaining the biometric credential itself and securely delete it once it is no longer necessary.

What if the scanner repeatedly fails?

Report every failure in writing, request correction of attendance and payroll records, and ask for a reliable alternative. The Data Privacy Act requires personal data used for decisions to be accurate, relevant, and corrected when inaccurate.

Are government employees covered by the same rules?

The general privacy principles still matter, but a government agency may rely on a constitutional or statutory mandate rather than consent. Government recordkeeping, security, and public-authority rules may also apply. Any exemption should extend only to the minimum processing necessary for the official function.

Official references

This article provides general legal information, not legal advice for a particular employment dispute. Outcomes depend on the employer’s documents, system design, actual processing, applicable workplace rules, and the employee’s circumstances. Sources checked as of 27 July 2026.