Biometric information notice: what to publish on your school website
If your school uses fingerprint or face recognition, for example for lunch payments, your website needs a notice telling parents about their right to object and the alternative on offer.
Check this on my websiteWho it applies to
- Published on
- The school's own website
- School type
- Academies and maintained schools
- School stage
- All stages, from early years to sixth form
- Only applies to
- Schools using biometric recognition systems
- Does not apply to
- No school types are excluded
When it's due
Keep it up to date
There's no fixed date. Update it whenever something changes.
What's needed
Publish a biometric information notice on the data protection page on your website, explaining how you'll use the data, the right to object, the non-biometric alternative and how you ask for written consent.
What it must contain
6 parts- Notifies each parent of the intention to process their child's dataMust: Required by law, statutory guidance or the academy's funding agreement.
- Explains the right to withdraw consent and to make a complaintMust: Required by law, statutory guidance or the academy's funding agreement.
- Says a non-biometric alternative is availableMust: Required by law, statutory guidance or the academy's funding agreement.
- Notifies parents and seeks written consent before first using biometric dataMust: Required by law, statutory guidance or the academy's funding agreement.
- Gives its retention periods for the data and who it shares it withMust: Required by law, statutory guidance or the academy's funding agreement.
- Names who to contact with questions about the processingShould: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.
What the official sources say
Set out in 2 official sources:
Biometric data guidance: biometric recognition (transparency)
People have a right to know how and why you’re processing their information. If you are using any biometric system that processes personal information, you must explain how in a way which is clear, concise, and easy to access.
Must: Required by law, statutory guidance or the academy's funding agreement.§ In detail (intro)
You must provide the following information: – your retention periods for that personal information, and who you will share it with; – all relevant contact information (eg the name and contact details of your organisation) (and your representative, if applicable) and the DPO’s contact details; – the purposes of the processing and the lawful bases (and, if applicable, the legitimate interests for the processing); – details of all personal information that you share with other organisations and, if applicable, details of transfers to any third countries or international organisations; – retention periods for the personal information, or if that is not possible, the criteria used to determine the period; – details about people’s rights including, if applicable, the right to withdraw consent and the right to make a complaint; and – whether people are under a statutory or contractual obligation to provide the personal information (if applicable, and if you collect the personal information from the person it relates to).
Must: Required by law, statutory guidance or the academy's funding agreement.§ What information do we have to share to comply with the transparency principle?
Show 2 more from this source
You should also consider who someone should ask if they have questions about the processing.
Should: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.§ How should we provide transparency information?
– making information available online and through social media, and otherwise using digital spaces that visitors are likely to use in advance of visiting the premises.
Good practice: Recommended as good practice. Not required.§ How should we provide transparency information?
Protection of Freedoms Act 2012, Part 1 Chapter 2 (biometric information in schools)
Before the first processing of a child's biometric information on or after the coming into force of subsection (3), the relevant authority must notify each parent of the child—
Must: Required by law, statutory guidance or the academy's funding agreement.§ Part 1 Chapter 2, section 26(2)
The relevant authority must ensure that reasonable alternative means are available by which the child may do, or be subject to, anything which the child would have been able to do, or be subject to, had the child's biometric information been processed.
Must: Required by law, statutory guidance or the academy's funding agreement.§ s26(7)
Questions schools ask
Do schools need a biometric information notice?
Academies and maintained schools must. It only applies to schools using biometric recognition systems.
What does a biometric notice for parents need to include?
Notifies each parent of the intention to process their child's data; Explains the right to withdraw consent and to make a complaint; Says a non-biometric alternative is available; Notifies parents and seeks written consent before first using biometric data; its retention periods for the data and who it shares it with; Names who to contact with questions about the processing.
When do we need to update our biometric notice?
Keep it up to date. There's no fixed date. Update it whenever something changes.
Where does the requirement for the biometric information notice come from?
It is set out in Biometric data guidance: biometric recognition (transparency) and Protection of Freedoms Act 2012, Part 1 Chapter 2 (biometric information in schools).
Recent changes to the official guidance
The official sources for this requirement don't publish dated change notes. We check them for changes ourselves.
We last checked these sources on 21 September 2026.
Is this on your school's website?
Enter your school email address and we'll check your website for this requirement.
It's free, and the result arrives by email.
Official wording that does not apply to schools (6)
– There is not a fixed way in which you must share this information.
Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
Do we need to do a DPIA? – What risks to rights and freedoms should we consider?
For the purposes of section 26(2) and (3), the relevant authority is not required to notify a parent, or obtain the consent of a parent, if the relevant authority is satisfied that— a the parent cannot be found, b the parent lacks capacity (within the meaning of the Mental Capacity Act 2005) to object or (as the case may be) consent to the processing of the child's biometric information, c the welfare of the child requires that the parent is not contacted, or d it is otherwise not reasonably practicable to notify the parent or (as the case may be) obtain the consent of the parent.
A cruise ship company decides to offer biometric facial recognition as an option for guests.
How do we ensure our processing of biometric data is transparent? – - What information do we have to share to comply with the transparency people? – How should we provide transparency information?
Official sources last checked 21 September 2026 · register version 1.0.4