Modalities at a glance (and when to pick them)
Fingerprint – Mature, compact readers, quick verification. Best for controlled environments (offices, labs). Can struggle with wet/dirty gloves or certain occupations; consider liveness/PAD capabilities to resist spoofing.
Facial recognition – Fast and hygienic; good for touch-free lobbies and turnstiles. Lighting and presentation attack resistance (anti-spoofing) are critical selection criteria. Independent testing (e.g., NIST FRVT) provides a useful reality check on algorithm accuracy trends and vendor claims.
Iris – Very high accuracy, tolerant of PPE (masks) and variable lighting, but costlier and with a narrower capture range. Often used in higher-risk areas.
Vein (finger/hand) – Scans sub-dermal patterns, offering strong spoof resistance and good performance in dirty or industrial settings.
Whichever you select, specify presentation attack detection in line with the ISO/IEC 30107 family so the sensor can tell a real, live sample from a photo, mask or prosthetic.
Legal & compliance (UK): start here, not later
Under UK GDPR, biometric data used for the purpose of uniquely identifying a person is special category personal data. You must have both a lawful basis under Article 6 and meet a condition in Article 9 (and, for some conditions, additional DPA 2018 Schedule 1 requirements). In short: the bar is higher than for standard access logs. Plan a DPIA, be clear on necessity and proportionality versus alternatives (cards/fobs), provide signage and fair processing information, and offer reasonable alternatives where appropriate—especially in workplace contexts.
The ICO’s dedicated biometric guidance explains what biometric recognition is, when it becomes special category, and what good governance looks like (lawful basis, minimisation, retention, template security, transparency). Build these obligations into the project—not as a bolt-on at the end.
Recent UK enforcement shows regulators will act where employers cannot justify necessity or provide alternatives. In 2024 the ICO ordered an operator to stop using facial recognition/fingerprint clock-in for staff attendance and delete unnecessary data, citing lack of justification over less intrusive options. Treat that as a warning to document your case and offer proportionate alternatives.
Not legal advice: involve your DPO early, and align procurement, IT and HR on lawful basis, Article 9 condition, and user communications before you buy hardware.
Architecture and standards: making it robust
A biometric reader is just one piece of a system. The electronic access control system (EACS) should meet recognised functional/performance baselines (e.g., EN/IEC 60839-11-1), with decisions enforced locally at the door so operation remains deterministic during network hiccups. That standards framing keeps tenders comparable and commissioning disciplined.
Design for:
- Edge determinism. Controllers cache permissions and templates; doors continue to work during WAN/server outages and reconcile events later.
- Network segmentation & hardening. Treat controllers/gateways like critical OT: dedicated VLANs, locked-down admin paths, changed defaults. For the broader converged fabric, our overview of IP Security System Installation explains how to build a reliable, segmented underlay.
- Life-safety behaviour. Biometrics do not alter your duty to release on fire alarm and relevant faults. Engineer and witness-test those behaviours with the fire contractor as part of commissioning.
From pilot to roll-out: what “good” looks like
- Define outcomes and zones. Use a short operational requirement: who should go where, when, under what assurance. NPSA’s AACS framing keeps the focus on outcomes, not brands.
- Pick the right factor mix by risk.
- Busy lobby? Facial verification with strong PAD and privacy-safe reader mounting (no unnecessary video storage).
- Industrial workshop? Vein or rugged fingerprint with gloves policy and cleaning regime.
- High-risk room (e.g., comms/labs)? Two-factor (card + biometric) with tighter audit.
- Prove performance. Run a pilot in real lighting/traffic. Measure false reject/accept rates, throughput at peak, and user satisfaction. Use independent evals (e.g., NIST FRVT for face) to sanity-check vendor claims.
- Engineer anti-spoofing. Specify readers with certified liveness/PAD (ISO/IEC 30107 vocabulary and test methods are the common language); test against realistic presentation attacks
- Do the governance work. Complete a DPIA; pick Article 6/9 routes; set retention, deletion and alternative paths; publish signage and staff FAQs; train reception/security.
- Commission with discipline. Templates enrolment quality checks; time schedules and alarm conditions; fire release and fault behaviour; integration witness tests (see below). Document everything; export configs at handover.
Privacy by design (and by default)
- Template security. Use templates, not raw images, and encrypt them at rest/in transit. Limit who can enrol/delete; log admin actions. The ICO’s biometric guidance stresses security, minimisation and transparency—follow it.
- Alternatives and exceptions. Offer a non-biometric route (card + PIN) for those unable or unwilling to enrol; avoid coercion. Record the rationale for using biometrics at each zone.
- Data minimisation & retention. Retain templates and events only as long as needed for security/HR purposes; set automated deletion. If you upgrade or change vendors, plan a secure migration and purge.
Integration: making biometrics part of a smart estate
Biometric doors are most valuable when they work with the rest of your security stack:
- CCTV correlation. Map door events to camera bookmarks so operators can instantly review a forced-door or out-of-hours entry. (See: CCTV–Access Control–Alarm Integration)
- Intruder alarms. Use first-in/last-out logic so arming/disarming follows real, authenticated movement rather than manual rituals.
Visitor & reception. Where visitors need biometric enrolment (rare), keep it voluntary, time-bound and clearly explained; otherwise pair video intercom verification with temporary credentials to preserve audit and dignity at the desk.
