Quick answer

An employer in the Philippines may use fingerprint, facial-recognition, iris, voice, or similar biometric technology to record attendance, but management prerogative does not override employee privacy rights. The system must comply with the Data Privacy Act of 2012, its Implementing Rules and Regulations, and applicable National Privacy Commission (NPC) issuances.

At a minimum, the employer should:

identify a valid and specific purpose, such as accurate timekeeping and payroll administration;
establish an appropriate lawful basis for processing;
tell employees what data will be collected and how it will be used;
collect no more biometric data than necessary;
protect biometric templates, attendance logs, and related records against unauthorized access;
retain them only as long as genuinely necessary;
provide a procedure for access, correction, objections, and complaints; and
avoid using the data for an undisclosed or incompatible purpose.

Employees do not have an absolute right to reject every biometric attendance system. But they may question an unexplained, excessive, insecure, inaccurate, or unnecessarily intrusive system and may exercise their rights under the Data Privacy Act.

Why biometric attendance data is legally protected

Biometric systems use physical or behavioral characteristics to recognize or verify a person. Examples include:

fingerprints;
facial geometry;
iris or retinal patterns;
voice characteristics; and
other measurable features linked to a particular individual.

Republic Act No. 10367 defines biometrics in the voter-registration context as quantitative analysis that provides positive identification through features such as a voice, photograph, fingerprint, signature, or iris. The NPC has likewise recognized that biometric information capable of uniquely linking data to an individual is personal information.

A biometric template need not be a conventional photograph or readable fingerprint image to be protected. A mathematical representation, feature map, or identifier generated from a fingerprint or face is still personal data when it identifies, authenticates, distinguishes, or can be linked to an employee.

Biometric information is not expressly listed as a separate category of “sensitive personal information” in Section 3(l) of the Data Privacy Act. It is nevertheless protected personal information. It may also be processed together with sensitive information, such as health details, government-issued numbers, or records relating to alleged offenses. The proper legal classification therefore depends on the actual information collected and linked by the system—not merely on the vendor’s label for it.

Unlike a password, a fingerprint or facial characteristic generally cannot be replaced after compromise. That makes strict necessity, limited access, and effective security especially important.

An employer needs a lawful basis—not merely a convenient device

The collection, conversion, storage, matching, retrieval, disclosure, and deletion of biometric data are all forms of processing. An employer must therefore identify an applicable lawful basis under Section 12 of the Data Privacy Act. If sensitive personal information is also processed, one of the narrower grounds under Section 13 must separately apply.

For ordinary employee personal information, potentially relevant grounds may include:

processing necessary and related to the employment contract;
processing necessary to comply with a legal obligation; or
processing necessary for a legitimate interest pursued by the employer or another party, provided the employee’s fundamental rights and freedoms do not override that interest.

The selected ground must fit the facts. An employer should not simply list every lawful basis in its privacy notice without determining which one actually supports the biometric system.

Contractual necessity

An employer may rely on contractual necessity only when the processing is genuinely necessary and related to fulfilling the employment contract. A generic clause stating that an employee must obey company rules does not automatically prove that biometric collection is necessary.

The employer should be able to explain why the particular biometric method is needed for timekeeping and why a less intrusive method would not reasonably achieve the same purpose.

Legitimate interest

When relying on legitimate interest, the employer should document:

Purpose: What legitimate and specific business objective will the system achieve?
Necessity: Why is biometric processing reasonably necessary for that objective?
Balancing: Do the expected benefits outweigh the risks and effects on employees’ privacy and other rights?

The NPC applies this purpose–necessity–balancing framework when assessing workplace monitoring. Legitimate interests may include attendance verification, payroll accuracy, workplace security, or prevention of “buddy punching,” but merely naming an interest is insufficient. The employer must show a direct relationship between the processing and the stated objective.

Consent

Consent is not automatically required for every employment-related processing activity. Conversely, a signed consent form does not automatically make an excessive system lawful.

The NPC has observed that consent may be an unsuitable basis in employment because employees are seldom in a position to freely refuse or withdraw it without concern about adverse consequences. If an employer nevertheless relies on consent, it must meet the requirements of being freely given, specific, informed, and evidenced. The employer should also explain what will happen if an employee refuses or later withdraws consent.

The NPC Guidelines on Consent should be considered when consent is asserted as the legal basis.

Transparency is required before collection

Employees should receive a clear privacy notice before enrollment or, at the latest, when the information is collected. It should be understandable without requiring technical or legal expertise.

The notice should disclose:

the employer’s identity and contact details;
the contact details of its data protection officer or privacy contact;
the particular biometric characteristic being collected;
whether the device stores a raw image, a biometric template, or both;
the specific purposes of collection and use;
the lawful basis relied upon;
whether enrollment and daily matching occur locally, on a company server, or in the cloud;
the vendor and other recipients or categories of recipients;
any overseas storage or access;
how attendance results affect payroll, discipline, or performance records;
the retention and deletion rules;
the security safeguards, described without exposing vulnerabilities;
the employee’s data-subject rights;
the process for disputing an incorrect scan or attendance record; and
how to contact the employer about privacy concerns.

A provision buried in an employee handbook or a notice stating only “for attendance purposes” may be inadequate if the system performs additional functions, shares data with a vendor, or retains biometric templates indefinitely.

The NPC’s workplace-monitoring guidance emphasizes that employees must know the nature, purpose, and extent of the processing. Employers should communicate the method of monitoring, security measures, and procedure for redress. See NPC Advisory Opinion No. 2024-003.

The system must be necessary and proportionate

The Data Privacy Act requires transparency, legitimate purpose, and proportionality. The information collected must be adequate, relevant, suitable, necessary, and not excessive in relation to the declared purpose.

For a biometric attendance system, relevant questions include:

Would a badge, PIN, signed log, or device-based check-in reasonably accomplish the purpose?
Is one biometric factor sufficient, or is the employer unnecessarily collecting several?
Does the system store a raw fingerprint or facial image when a protected template would suffice?
Does a facial-recognition terminal capture bystanders?
Is continuous surveillance being conducted when a brief clock-in verification would work?
Is the system being used for location tracking, security investigations, productivity scoring, or disciplinary profiling beyond attendance?
Are former employees’ templates deleted when there is no longer a lawful reason to retain them?
Is there a non-biometric fallback for injuries, disabilities, technical failures, religious concerns, or repeated false rejections?

The law does not establish a universal rule that every employer must offer an alternative attendance method. Nevertheless, the availability of a less intrusive, effective alternative is highly relevant to necessity and proportionality. A reasonable fallback also helps prevent inaccurate deductions and unfair disciplinary action.

A privacy impact assessment should come before deployment

A privacy impact assessment, or PIA, identifies how information flows through the system, who can access it, what could go wrong, and how risks will be controlled. The NPC recommends conducting a PIA before adopting employee-monitoring technology and whenever there is a significant change.

For biometric attendance, the assessment should examine:

enrollment and identity verification;
the type and format of biometric data;
device, server, and cloud storage;
vendor access and support arrangements;
integration with payroll and human-resources systems;
false acceptance and false rejection risks;
unauthorized copying or extraction;
data transmitted between branches or countries;
retention, backup, and secure deletion;
breach-response procedures; and
the effects on employees whose biometric characteristics cannot be reliably captured.

A PIA does not by itself legalize processing. It should result in actual safeguards and, where necessary, changes to the proposed system.

Security obligations of the employer and vendor

The employer normally acts as the personal information controller because it determines why and how employee biometric data is processed. A technology provider that processes the information on the employer’s instructions may be a personal information processor. Outsourcing does not relieve the employer of accountability.

Appropriate safeguards may include:

storing protected biometric templates instead of raw images when technically feasible;
strong encryption during transmission and storage;
strict role-based access;
multi-factor authentication for administrators;
audit logs showing access, exports, alterations, and deletion;
segregation of biometric templates from ordinary HR records;
controls against bulk export and unauthorized copying;
secure configuration and prompt security updates;
tested backup, recovery, and breach-response procedures;
periodic access reviews and vulnerability assessments;
confidentiality obligations and training for authorized personnel;
secure deletion from active systems and backups; and
a written processing agreement with the vendor.

The contract with a vendor should address confidentiality, security, authorized processing, subcontractors, breach reporting, assistance with data-subject requests, return or deletion of data, audits, and what happens when the service ends.

Retention cannot be indefinite by default

Biometric and attendance data should be kept only for as long as necessary to fulfill the declared purpose or establish, exercise, or defend legal claims, unless a law requires a particular retention period.

Different records may properly have different schedules. For example, attendance summaries needed for payroll, labor compliance, or a pending dispute may need to be retained longer than the reusable biometric template used only to authenticate clock-ins.

The employer should define and implement a defensible retention schedule. Statements such as “we may retain your data as long as necessary” should be supported by actual periods or objective deletion criteria. Templates belonging to applicants who were not hired and employees who have separated should not remain indefinitely merely because the vendor’s system does not delete them automatically.

Employee rights under the Data Privacy Act

Subject to lawful limitations and the circumstances of the processing, employees have the following rights:

Right to be informed

An employee may ask what biometric information is collected, why it is required, who receives it, how long it is retained, and how it is protected.

Right of access

An employee may request access to personal data being processed and relevant information about its sources, recipients, processing methods, purposes, and disclosures. Access does not necessarily require the employer to reveal security-sensitive source code or another person’s personal information.

Right to object

An employee may object to processing based on consent or legitimate interest. The effect of an objection depends on the lawful basis and whether the employer can demonstrate a valid ground to continue processing.

Right to correction

An employee may dispute inaccurate attendance logs, identity information, or records produced by a false rejection, duplicate match, device error, or unauthorized clock-in.

Right to erasure or blocking

Erasure or blocking may be requested when the information is incomplete, outdated, unlawfully obtained, used for an unauthorized purpose, no longer necessary, or otherwise processed unlawfully. The right is not absolute; legally required records or information needed for legitimate legal claims may be retained.

Right to data portability

Where the statutory conditions apply, an employee may obtain electronically processed data in a commonly used format that permits further use.

Right to damages and to complain

A person who suffers damage because of inaccurate, incomplete, unlawfully obtained, or unauthorized use of personal information may pursue remedies available under the Data Privacy Act. An affected employee may also complain to the NPC.

A practical explanation of these protections appears on the NPC’s official Data Subject Rights page.

Can biometric records be used for payroll or discipline?

Biometric attendance records may be used for the declared and lawful purposes for which they were collected. They can potentially support payroll calculations or an attendance-related disciplinary case, but a machine-generated entry is not automatically conclusive.

Before deducting pay or imposing discipline, the employer should consider:

device failures or network outages;
false rejections or incorrect matches;
approved fieldwork, leave, overtime, or schedule changes;
manual corrections;
whether another person or administrator altered the record;
the system’s audit trail; and
the employee’s explanation and supporting evidence.

If attendance data is used as a basis for dismissal or another serious disciplinary penalty, applicable substantive and procedural labor-law requirements still apply. A privacy notice or biometric scan does not replace due process.

What to do if you believe the system violates your privacy

1. Obtain the policy and privacy notice

Request copies of the biometric attendance policy, employee privacy notice, applicable handbook provisions, and procedure for correcting attendance records.

2. Send a focused written request

Write to HR, the data protection officer, or the designated privacy contact. Identify:

the data or incident involved;
the date and location;
the right being exercised;
the specific explanation, correction, access, deletion, or safeguard requested; and
any urgency, such as an impending payroll deduction.

Keep proof that the request was received.

3. Give the employer an opportunity to respond

Under the NPC’s procedural rules, a complainant ordinarily must first inform the personal information controller, processor, or concerned entity in writing and allow it to address the matter. A complaint may be dismissed without prejudice if the complainant did not provide that opportunity, unless the failure is justified.

The earlier exhaustion provision used a 15-calendar-day response period, while the 2024 amendments now frame failure to provide an opportunity to address the complaint as a possible ground for dismissal. Employees should therefore document their written notice and the employer’s response or failure to act. The NPC may excuse prior resort in sufficiently serious or urgent circumstances. See the 2021 NPC Rules of Procedure and NPC Circular No. 2024-01.

4. Escalate internally if necessary

If the initial response is inadequate, use the company grievance procedure, compliance channel, or data-protection escalation process. A union member may also consult the union where the biometric policy affects collectively negotiated working conditions.

5. File a complaint with the NPC

An affected data subject may file a complaint personally or through a properly authorized representative. The current procedure generally requires a notarized complaint-assisted form or verified complaint, supporting evidence, witness affidavits when applicable, prior correspondence, and the other documents required by the NPC rules.

Check the NPC’s official File a Complaint page before filing because forms, fees, addresses, and authorized submission methods may change.

A privacy complaint is distinct from a labor complaint. If the dispute also involves wage deductions, suspension, dismissal, discrimination, or another labor issue, an employee may need advice on the appropriate labor remedy as well.

Evidence to preserve

Keep lawful copies of:

privacy notices and biometric enrollment forms;
employment-contract and handbook provisions;
announcements, memoranda, and training materials;
screenshots of device errors or rejected scans;
time records, schedules, payslips, and disputed deductions;
emails or messages to HR and the data protection officer;
responses from the employer or vendor;
notices describing a breach or system malfunction;
names of witnesses to enrollment or attendance incidents;
records showing when a policy was introduced or changed; and
evidence that biometric information was disclosed or used for another purpose.

Preserve original files and metadata where possible. Do not obtain evidence by hacking the system, using another employee’s credentials, secretly exporting a database, or taking confidential records to which you have no lawful access.

If biometric information is leaked or misused

Report the incident promptly to the employer’s data protection officer or privacy contact. Ask the employer to:

preserve logs and other evidence;
prevent further access or disclosure;
explain what data was affected;
identify the period and likely consequences;
state what containment measures were taken; and
provide steps employees can take to reduce harm.

Not every security incident triggers mandatory notification to affected individuals or the NPC. Notification depends on the nature of the information, the circumstances of the breach, and the applicable risk criteria under NPC rules. The employer—not the employee—must initially assess its breach-notification obligations, but an affected employee may separately report or complain to the NPC.

Because biometric identifiers are difficult or impossible to replace, suspected extraction of reusable templates, raw fingerprints, facial images, or authentication credentials requires urgent technical and legal attention.

Common mistakes

Assuming management prerogative is enough

Employers may manage attendance, but the method chosen must still satisfy data-protection law.

Treating a signature as blanket consent

A signed form does not cure vague purposes, unnecessary collection, inadequate security, or an inability to refuse freely.

Collecting raw images when a template would suffice

Keeping more identifying data than necessary increases both intrusiveness and breach risk.

Using attendance biometrics for a new purpose without notice

Using the same database for surveillance, criminal screening, productivity scoring, location tracking, or commercial analytics may require a separate legal assessment and updated notice.

Allowing unrestricted administrator or vendor access

Convenient access for IT personnel, guards, payroll staff, or service technicians is not automatically authorized access.

Keeping former employees’ templates forever

Retention must be connected to a continuing lawful purpose, not merely system convenience.

Treating the machine as infallible

Payroll and disciplinary decisions should permit human review and correction of inaccurate or incomplete records.

Filing immediately without first writing to the employer

Unless an exception is justified, failure to give the employer an opportunity to address the issue may result in dismissal of an NPC complaint without prejudice.

When legal or technical help is urgent

Seek prompt assistance if:

biometric templates or raw images appear online or have been sent to unauthorized persons;
a former employee’s biometric data is still being actively used;
the system produces repeated false matches or attendance deductions;
employees are threatened for asking basic privacy questions;
biometric information is being used for undisclosed surveillance or profiling;
the employer refuses to identify the data controller, vendor, or storage location;
the company cannot contain an apparent breach;
the system captures customers, household members, or other bystanders;
biometric data is transferred abroad without clear safeguards; or
dismissal, suspension, wage loss, or identity-related harm is imminent.

Frequently asked questions

Can my employer require fingerprint attendance?

Possibly. There is no general rule making fingerprint attendance automatically unlawful. The employer must establish a lawful basis, demonstrate a legitimate and proportionate purpose, provide proper notice, protect the information, and respect employee rights.

Can I refuse to enroll?

You may object and request the employer’s lawful basis and necessity assessment. Whether the employer can still require enrollment depends on the employment arrangements, the purpose, available alternatives, and whether the processing satisfies the Data Privacy Act. Refusal is not automatically protected in every case, and discipline is not automatically valid either.

Must the employer offer a manual attendance option?

Philippine privacy law does not impose a universal manual-option rule for every workplace. An alternative becomes especially important where biometric capture is unreliable or impossible, or where a less intrusive method could reasonably fulfill the purpose.

Is a fingerprint template safer than storing the actual fingerprint image?

Generally, a properly designed non-reversible template can reduce risk, but it remains protected personal data. Its safety depends on how it is generated, encrypted, stored, matched, accessed, and deleted.

May the employer share the data with the attendance-system vendor?

Yes, if the disclosure and processing are lawful, necessary, transparent, adequately secured, and governed by appropriate contractual controls. The employer remains accountable for outsourced processing.

May biometric attendance records be used in court or an employment case?

Potentially, subject to relevance, authenticity, reliability, applicable evidence rules, and the lawfulness of the processing. The fact that a record came from a biometric device does not make it automatically accurate or conclusive.

Can I demand immediate deletion after resigning?

You may request erasure, but immediate deletion is not guaranteed. The employer may retain information still required by law or reasonably necessary for legitimate legal claims. It should, however, distinguish ordinary employment records from reusable biometric templates and delete data once no lawful purpose remains.

Where should I complain first?

Ordinarily, write first to the employer’s data protection officer, HR department, or privacy contact and keep proof of delivery. If the response is absent or inadequate, consider the NPC complaint process and any separate labor remedy applicable to the employment dispute.

Official legal sources

This article provides general legal information, not legal advice for a particular workplace, system, or dispute. The proper result depends on the data collected, technology used, contracts, policies, notices, security measures, and actual consequences to employees. Official sources were checked as of August 25, 2026.