Face recognition for staff clock-in: impact assessment and staff notice ​

Clocking in by looking at a tablet is quick and stops one person clocking in for another. But a face template that identifies someone is biometric data, a special category under UK data protection law, and the regulator has already told one employer to stop. This guide sets out what the ICO expects, the impact assessment to do before you switch it on, and a notice you can adapt for your staff.

What the ICO expects ​

• A data protection impact assessment first. The ICO’s biometric guidance says you must complete one before you use a biometric recognition system.
• Necessary and proportionate. You need a clear reason, and you must be able to show that a less intrusive way would not do. In February 2024 the ICO ordered Serco Leisure to stop using face and fingerprint scanning for staff attendance at 38 leisure centres: it found that cards, fobs or sign-in sheets could have done the job, and that Serco had no evidence those were being abused.
• A lawful basis and a special category condition. Without explicit consent or another valid condition the processing is unlawful, and you must not use the system.
• Consent is difficult between employer and staff. It has to be freely given. Where there is an imbalance of power, staff may feel they cannot say no, so you must show a genuine choice with no disadvantage for refusing.
• Always offer an alternative, such as a PIN or a card, whether or not you rely on consent, and make it just as easy to use.
• Tell staff clearly what you collect, why, how long you keep it and how to withdraw.

The ICO notes that its biometric guidance is under review after the Data (Use and Access) Act 2025, so check it before you start.

Impact assessment: what to write down ​

Keep it with your other data protection records and review it when anything changes (a new supplier, new sites, a change in what is kept).

1. What and why. Staff clock in and out by face on a tablet at the entrance. The problem it solves (for example, staff clocking in for each other) and how often it has happened.
2. Is it necessary? The less intrusive options you considered (PIN, card, a manager signing people in) and why they are not enough on their own. Evidence, not opinion.
3. Lawful basis and condition. Your lawful basis and the special category condition you rely on; if it is explicit consent, how you make refusing free of any disadvantage.
4. The alternative. Staff can use a PIN instead at any time, from the first day, without asking. Who to tell, and that nothing changes for them.
5. What is kept. A face template for matching; whether a reference photo and clock-in photos are kept, and for how long. Who can see them.
6. Who else handles it. The software provider and any service that does the matching, where the data is held, and your contract with them (processor terms).
7. Risks and safeguards. Wrong matches (someone recognised as someone else, or not recognised), bias, a breach, using it for anything other than clocking in. What reduces each one: PIN fallback, a manager correcting records, limited access, deletion when someone leaves or withdraws.
8. Staff views. How you asked, and what they said.
9. Sign-off. Who approved it and the date of the next review.

Notice for staff (template) ​

Clocking in with your face

You can clock in and out at [restaurant] by looking at the tablet. This is your choice. You can use your PIN instead at any time, now or later, and it makes no difference to your work, shifts or pay.

What we keep: a face template that lets the tablet recognise you[, and one reference photo / a photo when you clock in, kept for [number] days]. We use it only to record your clock-in and clock-out times.

Who sees it: [named manager role] and our clock-in software provider, who keeps it for us under contract. It is not shared with anyone else.

How long: until you ask us to delete it or you leave, whichever is first. Clock-in times themselves are kept as part of our pay and working time records.

Changing your mind: tell [name/role] and we will delete your face template and photos. You will then use your PIN.

Your rights: you can ask for a copy of what we hold about you, ask us to correct or delete it, and complain to us at [contact] or to the ICO.

Keeping a record of consent ​

If you rely on consent, keep for each person the date they agreed, the exact wording they saw (its version) and, if they withdraw, the date their data was deleted. If you change the wording, give it a new version.

In Yumee ​

Yumee Clock’s clock-in tablet works with a PIN as standard; face clock-in is switched on restaurant by restaurant.

• Asks each person on the tablet with the wording above, and “Not now” carries on with their PIN.
• Keeps the wording version each person agreed to with their record.
• PIN always available next to the camera.
• A manager can delete someone’s face, for example when they withdraw.
• Clock-in photos are optional and, when switched on, kept only for a set number of days.

Sources ​

• ICO, Biometric data guidance: Biometric recognition: under review after the Data (Use and Access) Act 2025; How do we process biometric data lawfully?: consent and the imbalance of power, offering a suitable alternative, no condition means the system must not be used; How do we demonstrate our compliance?: a DPIA before using a biometric recognition system and what it should consider.
• ICO, Data protection and monitoring workers: telling workers, impact assessments.
• ICO enforcement against Serco Leisure, February 2024, as reported by Mishcon de Reya and Slaughter and May: 38 facilities, less intrusive alternatives, three months to stop.

This guide is general information, not legal advice. For your own business, see the ICO’s guidance or ask a data protection adviser.