Biometric attendance and the Data Protection Act: a checklist for employers

Fingerprints and faces are sensitive personal data in Kenya. Here is what to put in place before you switch on a biometric terminal.

Under the Kenya Data Protection Act, 2019, biometric data is sensitive personal data. Using fingerprint, face or palm terminals for attendance or access is lawful, but it comes with duties. This checklist is general guidance, not legal advice.

Before you switch the terminals on

• Tell staff in writing what is collected, why, who can see it and how long it is kept.
• Record your lawful basis, and offer a card or PIN alternative where that is practical.
• Assess the risk: a data protection impact assessment is expected for high-risk processing such as biometrics.
• Limit access to attendance software to named administrators, with strong passwords or two-factor sign-in.
• Set a retention period and delete templates when an employee leaves.

How the hardware helps

Modern ZKTeco devices match against biometric templates and support encrypted credential storage, and platforms such as ZKBio CVSecurity use 256-bit AES encryption. Choosing the right configuration — and documenting it — is part of every installation we carry out.

Registration with the Office of the Data Protection Commissioner may also apply to your organisation. Check the current thresholds with the ODPC or your advocate.