United KingdomUK GDPR Article 9, Special Categories of Personal Data Including Biometric Data
UK GDPR, Art. 9; Data Protection Act 2018, Sch. 1
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Consent, Biometric
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Obtain explicit consent, or establish another UK General Data Protection Regulation (GDPR) Article 9(2) or Data Protection Act 2018 Schedule 1 basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
- Treat biometric data as covered from the moment you collect it once you have determined a purpose of unique identification, not only from the point you actually perform identification or verification, per the ICO's Biometric recognition guidance.
These lines are LexLint's reading of the law's text. Also read by: Information Commission (formerly the Information Commissioner’s Office), the UK data protection authority (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
UK GDPR Art. 83(5)(a) puts an infringement of Article 9 (special categories, including biometric data for unique identification) under the higher maximum amount: the higher of £17,500,000 or 4% of worldwide annual turnover (DPA 2018 s.157(5)).
- Rule
- Higher of
- As of
- Currency
- GBP
- Fixed cap
- 17,500,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Information Commission, the UK's single supervisory authority for data protection and PECR, exercising the Article 57 tasks and Article 58 powers conferred on it by Data Protection Act 2018 s.115.
Enforcement record
Hand count from the ICO's own enforcement action register (Type facet Monetary penalties plus Enforcement notices), read across the register's first two pages (50 of 222 total listed actions of every type), which cover back to , past the twelve-month cutoff. In the twelve months ending (the register's most recent entry), the ICO published 18 monetary penalty notices and 14 enforcement notices, for a combined 32 actions. Reprimands and prosecutions are excluded. Where the register lists a monetary penalty notice and an enforcement notice against the same underlying matter as two separate rows (for example Elderly Aids Limited, ), each row counts once as its own published enforcement instrument. Several monetary penalty rows in the register's list view state no penalty figure in the summary text shown there (only the full decision notice states it), so a sum from the visible list would understate the true total. This is the ICO's enforcement record for the data protection and PECR regime generally, not a record specific to this instrument's own provisions.
- As of
- Source link
- https://ico.org.uk/action-weve-taken/enforcement/
- Actions per year
- 32
Settledness
- As of
- Guidance link
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/biometric-data-guidance-biometric-recognition/biometric-recognition/
- Guidance body
- Information Commission (formerly the Information Commissioner’s Office), the UK data protection authority
- Open questions
- Does "biometric data for the purpose of uniquely identifying a natural person" in Article 9(1) cover a template that a controller creates for a purpose other than identification and only later uses to identify someone?
What it makes you log
Who may demand the log
Regulator
Log retention
The appropriate policy document must be kept from when the controller starts relying on the condition until six months after it stops carrying out that processing (Schedule 1, paragraph 40(2)).
- Unit
- Months
- As of
- Basis
- Fixed
- Minimum value
- 6
Logging duty
UK GDPR Article 9(1) only prohibits processing special category data and asks for no record. Part 4 of Schedule 1 does: where a controller relies on a Schedule 1 condition that requires an appropriate policy document, it must keep that document, review it and make it available to the Commission on request, and the Article 30 record of that processing must state which condition is relied on, how the processing satisfies Article 6, and whether the data is retained and erased as the policy says. None of those items is a log field.
- Kind
- Explicit
- As of
- Provision
- Data Protection Act 2018, Schedule 1, paragraphs 40 and 41
- Trigger
- personal_data_processing
What this law does
Biometric data used for identification, fingerprints, facial templates, voiceprints, is special category data under UK GDPR Article 9, the same definition as EU GDPR.
The DPA 2018's Schedule 1 supplies the UK's own list of Article 9(2)(g) substantial public interest conditions, 23 conditions in Part 2 of Schedule 1, in addition to explicit consent, employment and social-security processing authorised by law, vital interests, not-for-profit bodies, data manifestly made public, legal claims, health and social care, public health, and archiving and research.
The ICO's own "Biometric recognition" guidance, published in final form , states that biometric data becomes special category personal data from the moment of collection once a purpose of unique identification has been determined for it.
The Data (Use and Access) Act 2025 inserted a new Article 11A UK GDPR giving the Secretary of State a ministerial power to expand, by regulation, what description of processing is subject to Article 9's prohibition or its exceptions; no such regulation had been made as of the date shown. The ICO fined Clearview AI Inc GBP 7,552,800 for, among other findings, failing to meet the higher data protection standard biometric data requires.
In October 2025, the Upper Tribunal held that the First-tier Tribunal had wrongly found Clearview's processing outside UK GDPR's material scope, restoring the ICO's jurisdiction to have issued the fine and enforcement notice and remitting the substantive appeal against them to the First-tier Tribunal for determination. The Information Commission took over the Information Commissioner's functions on .
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .