Biometric information notice
A notice for parents where the school uses fingerprint or face recognition, for example for lunch payments. It must explain the intention to process, the right to object, the non-biometric alternative and how written consent is sought.
Check this on my websiteWho it applies to
- Published on
- The school's own website
- School type
- Academies and maintained schools
- School stage
- All stages, from early years to sixth form
- Only applies to
- Schools using biometric recognition systems
- Does not apply to
- No school types are excluded
When is it due?
- Renewal
- No fixed date
The official sources set no renewal date. Keep it accurate whenever it changes.
What's needed
Publish a biometric information notice stating the intention to process, the parent's right to object, and the non-biometric alternative, on the data protection page.
What it must contain
6 parts- Notifies each parent of the intention to process their child's dataMust
- Explains the right to withdraw consent and to make a complaintMust
- Says a non-biometric alternative is availableMust
- Notifies parents and seeks written consent before first using biometric dataMust
- Gives its retention periods for the data and who it shares it withMust
- Names who to contact with questions about the processingShould
What the official sources say
Set out in 2 official sources:
Biometric data guidance: biometric recognition (transparency)
People have a right to know how and why you’re processing their information. If you are using any biometric system that processes personal information, you must explain how in a way which is clear, concise, and easy to access.
Must§ In detail (intro)
You must provide the following information: – your retention periods for that personal information, and who you will share it with; – all relevant contact information (eg the name and contact details of your organisation) (and your representative, if applicable) and the DPO’s contact details; – the purposes of the processing and the lawful bases (and, if applicable, the legitimate interests for the processing); – details of all personal information that you share with other organisations and, if applicable, details of transfers to any third countries or international organisations; – retention periods for the personal information, or if that is not possible, the criteria used to determine the period; – details about people’s rights including, if applicable, the right to withdraw consent and the right to make a complaint; and – whether people are under a statutory or contractual obligation to provide the personal information (if applicable, and if you collect the personal information from the person it relates to).
Must§ What information do we have to share to comply with the transparency principle?
Show 2 more from this source
You should also consider who someone should ask if they have questions about the processing.
Should§ How should we provide transparency information?
– making information available online and through social media, and otherwise using digital spaces that visitors are likely to use in advance of visiting the premises.
Good practice§ How should we provide transparency information?
Protection of Freedoms Act 2012, Part 1 Chapter 2 (biometric information in schools)
Before the first processing of a child's biometric information on or after the coming into force of subsection (3), the relevant authority must notify each parent of the child—
Must§ Part 1 Chapter 2, section 26(2)
The relevant authority must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child's biometric information been processed.
Must§ s26(7)
Questions schools ask
Does every school have to publish the biometric information notice?
The official sources we check set no requirement for academies. The official sources we check set no requirement for maintained schools. It only applies to schools using biometric recognition systems.
When does the biometric information notice need to be published?
Renewal: No fixed date. The official sources set no renewal date. Keep it accurate whenever it changes.
What must the biometric information notice include?
Notifies each parent of the intention to process their child's data; Explains the right to withdraw consent and to make a complaint; Says a non-biometric alternative is available; Notifies parents and seeks written consent before first using biometric data; Gives its retention periods for the data and who it shares it with; Names who to contact with questions about the processing.
Where does the requirement for the biometric information notice come from?
It is set out in Biometric data guidance: biometric recognition (transparency) and Protection of Freedoms Act 2012, Part 1 Chapter 2 (biometric information in schools).
Changes to the official sources
The sources for this item do not publish dated change notes. Their current versions are listed above.
We last checked these sources on 21 September 2026.
Is this on your school's website?
We check your site the way an inspector or a parent would find it: page by page, against the official wording of each requirement. If it's there, you get the page and the words we found. If it isn't, you get every place we looked.
Check this one requirement free, or scan your whole site against every requirement.
Official wording that does not apply to schools (6)
– There is not a fixed way in which you must share this information.
Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
Do we need to do a DPIA? – What risks to rights and freedoms should we consider?
For the purposes of section 26(2) and (3), the relevant authority is not required to notify a parent, or obtain the consent of a parent, if the relevant authority is satisfied that— a the parent cannot be found, b the parent lacks capacity (within the meaning of the Mental Capacity Act 2005) to object or (as the case may be) consent to the processing of the child's biometric information, c the welfare of the child requires that the parent is not contacted, or d it is otherwise not reasonably practicable to notify the parent or (as the case may be) obtain the consent of the parent.
A cruise ship company decides to offer biometric facial recognition as an option for guests.
How do we ensure our processing of biometric data is transparent? – - What information do we have to share to comply with the transparency people? – How should we provide transparency information?
Official sources last checked 21 September 2026 · register version 1.0.4