NetherlandsUAVG Article 29, Biometric-Data Exception for Authentication or Security
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Rely on UAVG Article 29 only where processing biometric data of a person in the Netherlands for unique identification is necessary for authentication or for security purposes and only so far as a weighty general interest in lawful access to certain places, buildings, services, products, information systems or work-process systems makes it necessary; otherwise you need another General Data Protection Regulation (GDPR) Article 9(2) basis.
These lines are LexLint's reading of the law's text. Also read by: Autoriteit Persoonsgegevens (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.autoriteitpersoonsgegevens.nl/en/themes/identification/biometrics/rules-for-the-use-of-biometrics
- Guidance body
- Autoriteit Persoonsgegevens
- Open questions
- Does face or voice authentication for access to an information system or service meet the 'zwaarwegend algemeen belang van rechtmatige toegang' (weighty general interest in lawful access) limit in Article 29 of the UAVG, which the AP says arises only rarely, for example for the security of a nuclear power plant?
What it makes you log
Logging duty
Article 29 lifts the GDPR Article 9(1) prohibition on processing biometric data for unique identification where the processing is necessary for authentication or security and a weighty general interest in lawful access requires it. It states no safeguard, and no log, record or documentation duty.
- Kind
- None
- As of
What this law does
UAVG Article 29 is a Dutch national addition beyond the General Data Protection Regulation (GDPR) Article 9 baseline: it exercises the GDPR Article 9(2)(g) substantial public-interest derogation to lift the prohibition on processing biometric data for unique identification where the processing is necessary for authentication or for security purposes, and only so far as that is necessary because of a weighty general interest in lawful access to certain places, buildings, services, products, information systems or work-process systems.
The Verzamelwet gegevensbescherming (Staatsblad 2026, 154) added that limit. The Verzamelwet took effect on , apart from its Article I, point I. The provision does not itself set out safeguards or a retention limit. The exception applies equally to a voiceprint and a faceprint; UAVG Article 29's own text does not distinguish by modality.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .