Quick answer

Philippine employers may use fingerprint, facial-recognition, or similar biometric attendance systems, but they must have a lawful basis, collect only what is necessary, explain the processing, and protect employees’ data. A company policy or signed consent form does not, by itself, establish compliance.

Employees retain privacy rights, including rights to information, access, correction, and—in appropriate circumstances—objection, withdrawal of consent, and erasure. However, there is no automatic right to reject every biometric attendance system. Whether an employer may require participation depends on the data collected, the legal basis, the system’s necessity and safeguards, and the applicable employment rules. The principal law is Republic Act No. 10173, the Data Privacy Act of 2012. privacy.gov.ph

What biometric attendance data does the law protect?

Protection extends beyond the fingerprint or photograph initially collected. An identifiable employee’s biometric template, employee-number linkage, and attendance transactions can also be personal information.

A template does not become anonymous merely because it consists of mathematical values instead of a readable image. If the system uses it to identify an employee, it remains information relating to an identifiable person.

Biometric information should not automatically be classified as sensitive personal information solely because it is biometric. Philippine law distinguishes ordinary personal information from the specific sensitive categories in Section 3(l). In NPC Advisory Opinion No. 2023-025, the National Privacy Commission treated a facial photograph as personal information, while recognizing that a dataset containing a birth date also involved sensitive personal information.

The employer must examine the actual information and processing. Health information, government-issued identifiers, or other sensitive categories collected alongside attendance data require an applicable basis under Section 13. An advisory opinion is guidance based on its stated facts, not blanket approval of another employer’s system. privacy.gov.ph

When is biometric attendance lawful?

The employer must identify an applicable legal basis

For ordinary personal information, Section 12 recognizes several possible bases, including consent, contractual necessity, compliance with a legal obligation, and legitimate interests. The employer must identify which basis actually supports the particular processing.

An obligation to maintain attendance records does not automatically establish a need to collect facial or fingerprint templates. Likewise, inserting a biometric requirement into an employment contract does not settle whether the collection is necessary and proportionate.

Where sensitive personal information is involved, the employer needs an applicable Section 13 exception. Legitimate interest alone cannot authorize processing sensitive personal information. privacy.gov.ph

Legitimate interest requires an assessment

Under NPC Circular No. 2023-07, an employer relying on legitimate interest must assess and document:

Purpose: What specific, lawful interest will the system serve?
Necessity: Is the chosen processing necessary, suitable, and proportionate?
Balance: Does the employer’s interest withstand consideration of employees’ fundamental rights and freedoms?

Accurate timekeeping or preventing one employee from clocking in for another may support a legitimate purpose. The assessment must still consider alternatives, consequences for employees, safeguards, and reasonable expectations. Saying “management requires it” is insufficient. privacy.gov.ph

Collection must be proportionate to the purpose

The employer should assess whether a less intrusive method can reasonably achieve the same objective—for example, an access card, supervised timekeeping, or another verification process.

The NPC’s workplace-monitoring guidance emphasizes that both the information collected and the monitoring method must be proportionate. Applied to attendance, collecting a clock-in verification does not automatically justify continuous facial tracking, monitoring outside work, or unrelated behavioral analysis. Each additional activity needs its own justification. privacy.gov.ph

Does the employer need your consent?

Not always. Consent is one possible basis, not a universal requirement.

When the employer does rely on consent, NPC Circular No. 2023-04 requires a freely given, specific, informed indication of agreement, evidenced through written, electronic, or recorded means.

A signature does not cure pressure or an absence of meaningful choice. If an employee is told that refusal will bring adverse consequences, that raises a serious issue about whether consent is freely given.

Consent can generally be withdrawn without cost, subject to applicable legal, regulatory, or contractual limitations. If no other lawful basis supports continued processing, the employer must stop without undue delay and address deletion. Withdrawal does not retrospectively invalidate processing that was lawful before withdrawal.

A privacy notice and consent also serve different functions: receiving information about a system is not necessarily agreeing to it. privacy.gov.ph

What should employees be told?

Before enrollment—or at the next practical opportunity permitted by the rules—the employer should provide understandable information about:

The data collected, including whether the system stores images, templates, attendance logs, or additional information.
The purposes and applicable legal basis.
How processing works and who receives the data.
The retention period.
The employer’s identity and contact details.
How employees can exercise their rights and complain.
Any relevant automated decision-making, including its significance and consequences.

These transparency requirements appear in Section 34 of the Data Privacy Act’s Implementing Rules and Regulations. privacy.gov.ph

Practical questions include: Does the device send information to a cloud service? Can vendor personnel access it? Is processing performed overseas? Does a failed scan automatically affect payroll? Who can correct an error?

What rights can employees exercise?

The NPC’s data-subject-rights guidance supports the following requests, subject to applicable limitations:

RightPractical applicationAccessRequest your attendance records and information about how your personal data is processed and disclosed.CorrectionDispute an inaccurate attendance entry or a biometric record linked to the wrong employee.ObjectionChallenge processing based on consent or legitimate interest, explaining the grounds.Erasure or blockingRequest appropriate action where information is unlawfully processed, used without authority, or no longer necessary.

An objection is not something the employer may simply ignore. NPC Advisory No. 2021-01 states that processing must cease upon a valid objection unless another allowable basis applies; the employer bears the burden of establishing and explaining grounds for continuation.

Erasure is not unconditional. Necessary retention for a lawful purpose or legal claim may justify keeping particular records. privacy.gov.ph

If a scanner wrongly records you as absent, identify the exact date and shift, submit supporting evidence, and request both a record correction and review of any resulting payroll adjustment. Ask for a written explanation if the request is denied.

Can you refuse enrollment or demand an alternative?

You can raise an objection and request an alternative. Whether the employer must grant it depends on the processing basis, your circumstances, and whether the existing method is lawful and proportionate.

Explain specific concerns: repeated recognition failures, a physical condition affecting scanning, inadequate notice, excessive collection, or an identified security problem. Propose a workable way to record your attendance while the concern is assessed.

Avoid assuming either that refusal guarantees dismissal or that privacy law guarantees immunity from discipline. The Supreme Court’s general standard for dismissal based on willful disobedience requires, among other things, a reasonable and lawful work-related order made known to the employee, together with the required willful conduct. That standard does not automatically decide a biometric dispute. Supreme Court E-Library

Continue documenting your attendance and availability for work. If you receive a notice to explain, suspension, dismissal threat, or pay reduction, obtain prompt advice based on the actual policy, notices, and employment documents.

What safeguards should the employer implement?

NPC Circular No. 2023-06 requires privacy and security measures in both government and private-sector processing. This includes a privacy impact assessment covering the system and its risks—even when the employer purchases an existing product.

For biometric attendance, the assessment should address enrollment, matching, storage, access, transfers, errors, retention, and disposal. Appropriate controls should reflect the risks and may include restricted access, secure authentication, encryption, access logs, staff training, and incident-response arrangements.

Unnecessary functions without a lawful basis should be disabled. The employer should also maintain a documented retention policy and review its safeguards when the system or processing changes. Circular_16-01Repeal_30Nov2023_CLEAN[6083]

Using a vendor does not remove responsibility

An employer generally remains responsible as the personal information controller when it decides why and how employee data is processed.

Where a vendor processes data on the employer’s behalf, the outsourcing arrangement must address processing instructions, confidentiality, security, assistance with employee rights, and return or deletion of data. It must also identify the geographic location of processing. Overseas hosting does not remove these obligations. privacy.gov.ph

How long may biometric and attendance records be kept?

Separate the biometric enrollment data used to recognize employees from the attendance records used to document work.

For employers covered by the relevant Labor Code implementing rules, Book III, Rule X, Section 12 requires prescribed employment records to be preserved for at least three years from the last entry. That requirement does not, by itself, establish that every underlying biometric image or template must be retained for the same period. Supreme Court E-Library

The employer should justify retention for each category. Resignation does not necessarily require immediate deletion of all attendance records, particularly where legal retention duties or claims remain. Conversely, retaining attendance evidence does not automatically justify indefinite storage of a former employee’s biometric template.

Ask what will be deleted after separation, what will remain, why, and for how long. Include vendor-held copies and backups in the inquiry. Retention must remain connected to a lawful, necessary purpose. privacy.gov.ph

What happens if biometric data is exposed?

Not every system fault triggers mandatory breach notification. Under NPC Circular No. 16-03, notification is required when the relevant conditions are present:

Sensitive personal information or information capable of enabling identity fraud is involved; biometric data is expressly included in the latter category.
There is reason to believe an unauthorized person acquired it.
The acquisition is likely to create a real risk of serious harm.

For a notifiable breach, the general deadline to notify the NPC and affected individuals is 72 hours from knowledge or reasonable belief of the breach, subject to the rules’ limited exceptions and permitted postponements.

This is the controller’s notification obligation, not an employee’s deadline to complain. Employees should promptly report suspected exposure and request information about the affected data, protective measures, and assistance available. privacy.gov.ph

Practical steps if you have concerns

1. Write to HR and the data protection officer

Describe the system, the relevant dates, and your concern. Request a concrete response, such as:

The applicable privacy notice and processing basis.
Correction of specified attendance entries.
Assessment of an alternative attendance method.
An explanation of retention or vendor access.
Investigation of suspected exposure.
Preservation of records relevant to your complaint.

Keep proof that the employer received your request.

2. Preserve relevant evidence

Save documents you lawfully possess or can access, including:

Enrollment instructions, consent forms, and policy versions.
Emails or messages about mandatory participation or consequences.
Your daily time records, payslips, schedules, and correction requests.
Dated evidence of scanning failures and attempts to report for work.
The employer’s responses and any breach notice.
Evidence of resulting loss or other harm.

Do not access restricted systems or collect coworkers’ biometric records to prove your own complaint.

3. Escalate a privacy complaint to the NPC when appropriate

Under the 2021 NPC Rules of Procedure, as amended, complainants generally must first notify the respondent in writing and allow an opportunity to act. The rule addresses failure to take timely or appropriate action, or no response within 15 calendar days from receipt.

The NPC may waive this requirement for good cause or serious violations, including circumstances involving grave and irreparable harm. The 15-day provision is not a universal deadline for completing every data-access request.

A formal complaint must meet the prescribed requirements and include supporting evidence. Use the NPC’s official complaint guide and form, which provides notarization instructions, filing options, and a link to applicable fees. The guide lists personal filing, courier submission, and scanned submission through its designated email channel. Follow those instructions rather than sending only an informal narrative. privacy.gov.ph

4. Address employment consequences through the appropriate labor process

A privacy complaint does not replace action over unpaid wages, suspension, or dismissal. For private-sector employment concerns, DOLE provides assistance through its Single Entry Approach, including the official DOLE ARMS service linked from its e-services page. Government employees should obtain advice on the applicable agency and civil-service procedures. Department of Labor and Employment

Common mistakes to avoid

Treating a signature as complete compliance. Consent does not resolve excessive collection or inadequate safeguards.
Assuming every biometric record has the same legal classification. Examine the actual data and purpose.
Confusing recordkeeping with unrestricted collection. Attendance requirements do not automatically justify every technology feature.
Treating a failed scan as conclusive proof of absence. Request review using other evidence.
Demanding deletion of all records during a dispute. Preserve necessary evidence while challenging unnecessary retention.
Ignoring disciplinary notices while pursuing privacy concerns. Respond within the applicable process and seek advice promptly.

When is help urgent?

Seek prompt assistance if biometric information appears publicly accessible, a suspected breach remains unaddressed, relevant evidence may be deleted, or the dispute is affecting wages or employment.

Where continuing processing threatens serious harm, ask a lawyer about urgent NPC relief. The amended procedural rules allow an application for a temporary processing ban, subject to specific requirements; filing a complaint does not automatically suspend the system. privacy.gov.ph

Frequently asked questions

Is storing a template instead of a fingerprint image enough to comply?

No. A template that identifies an employee remains personal information. Template storage may reduce particular risks, but lawful processing, transparency, proportionality, and security still matter. privacy.gov.ph

Are small employers exempt from privacy obligations?

No. NPC registration thresholds are not exemptions from the Data Privacy Act.

Under Circular No. 2022-04, mandatory registration includes entities employing 250 or more persons, processing sensitive personal information of 1,000 or more individuals, or undertaking processing likely to pose risks to individuals’ rights and freedoms. Systems involving automated decision-making or profiling must also be registered under the circular. Being below a headcount threshold does not settle the question. privacy.gov.ph

Does NPC registration prove that the attendance system is lawful?

No. Registration does not replace a valid processing basis, proportionate collection, security controls, or respect for employee rights. The employer’s actual practices remain subject to compliance requirements. privacy.gov.ph

Can the employer reuse attendance biometrics for another purpose?

It must assess the new purpose and its legal basis. Attendance enrollment should not be treated as blanket permission for unrelated surveillance, profiling, or vendor use. Further processing must comply with applicable purpose, transparency, and consent requirements. privacy.gov.ph

This article provides general Philippine legal information, not advice on a particular employment dispute. The outcome depends on the documents, processing arrangements, and facts. Official sources checked as of 23 October 2026.

Double-click to edit...