UK Biometric AI Tools: ICO Guidance

Biometric recognition tools, facial recognition, voice ID, fingerprint or iris scanning, are treated as a distinct, higher-risk category under UK data protection law, not just another software purchase. The Information Commissioner's Office (ICO) has been explicit that convenience or a general improvement to security isn't, on its own, enough to justify using one.

Why biometric data is treated differently

A face, voiceprint, or fingerprint can't be changed the way a password or access card can be reissued. Because of that, and because biometric data used for identification purposes counts as special category data under UK GDPR, the ICO's biometric recognition guidance sets a higher bar than for ordinary personal data processing. The guidance is clear that a business needs to be able to point to a specific, demonstrable problem the biometric system solves, not a general sense that it would be a nice-to-have upgrade.

What counts as a justification, and what doesn't

The operations manager of a 3-site UK gym chain, considering a facial-recognition check-in system to replace membership cards, had assumed this was a straightforward software upgrade she could roll out like any other. After checking the ICO's guidance, she found the bar was higher than expected: "members lose their cards and it's annoying to reissue them" is a convenience argument, not the kind of specific, demonstrable justification the ICO's guidance is looking for. A genuine security problem the current system can't otherwise solve, documented and evidenced, is a different, stronger starting point.

In practice, this means working through, and being able to document, why a less invasive alternative (a PIN, a card, a staffed check-in) wouldn't achieve the same outcome, what the specific risk or problem is that biometric recognition solves, and what happens to the biometric data once it's collected, including how long it's kept and who can access it.

The ICO's wider AI and biometrics strategy

This guidance sits inside the ICO's broader AI and biometrics strategy, first published in 2025 and updated again in March 2026. The strategy names biometric technologies, alongside AI more broadly, as an area where the ICO expects to see proactive engagement from organisations before deployment, not remediation after a complaint or an incident. Facial recognition specifically is called out as an area of active public concern the ICO is watching closely.

A privacy impact assessment is the practical starting point

Because biometric recognition is inherently high-risk processing, a data protection impact assessment (DPIA) is expected practice before deployment, working through the necessity and proportionality questions above in a structured, documented way rather than an informal internal discussion. This is the same broader discipline covered in our guide to when an AI system needs a DPIA, applied specifically to the biometric case, where the ICO's expectations are already more explicit than for general AI processing.

What this means for a typical SMB

Most UK small and medium businesses considering biometric tools are looking at staff attendance systems, building access control, or customer verification, not large-scale public-space surveillance. The ICO's expectations still apply at this smaller scale. The practical difference for an SMB without a dedicated compliance function is mainly about documentation discipline: writing down the justification, the alternatives considered, and the data handling terms before signing a vendor contract, rather than treating the DPIA as paperwork to backfill later if it's ever asked for.

Questions to ask a biometric AI vendor

Before signing with a biometric AI vendor, it's worth getting clear, written answers on a handful of points: where the biometric templates are stored and for how long; whether raw images or voice recordings are retained alongside the derived biometric template, since that's a separate and often larger risk; what happens to a person's data if they leave the business or opt out; and whether the system has a documented accuracy or bias testing record across different demographic groups, since facial recognition accuracy has historically varied by skin tone and gender in ways that create discrimination risk on top of the privacy risk.

It's also worth checking whether a non-biometric fallback is available for anyone who doesn't want to enrol, whether that's for a disability-related reason, a data protection objection, or simply personal preference. A system with no fallback option is harder to justify as proportionate, since it effectively makes biometric enrolment a condition of access rather than one option among several.

Related reading: our AI governance by region.