Ten questions about who enters your premises, what system you use or plan to use and what you already have in place. You get a reasoned verdict, the list of obligations with what exists and what is missing, the outline of an implementation the authorities accept and the first three steps. All in your browser, nothing sent.
Enable JavaScript to use the questionnaire. Or write to us and we will do the analysis together.
Fingerprints and faces are biometric data, a special category under Article 9 GDPR: processing them is prohibited, with limited exceptions. Unlike a password or a card, a compromised biometric template cannot be changed. That is why the authorities check three things about an attendance or access system: whether a less intrusive means would not have been enough, whether people had a real alternative and whether the impact assessment was carried out before going live.
The technology (card, app, fingerprint, facial recognition at a terminal or from cameras), the mode of operation (1:1 verification or 1:N identification), where the templates are stored, the purposes, the reason and the scale. Then what you already have: the information, the consultation of the representatives, the alternative without biometrics, the impact assessment, the contract with the supplier, the retention rules, the record, the DPO. Separately, the situation of the workers of other companies who enter the same premises and the classification of the system under the AI Act.
A four-level verdict (no biometrics, justifiable with measures, possible with conditions, high risk), the reasons, the table of obligations with the legal basis and the status of each (in place, missing, to check), the outline of a correct implementation, the classification under the AI Act and the first three steps, in order of urgency. The document can be printed, copied or downloaded as Word.
In the Italian cases, the authority recalled that the employee's consent is not a valid legal basis, because of the imbalance in the employment relationship. The same European rules also apply in Romania.
The legislation was checked on 22 October 2026.
If the verdict calls for an impact assessment, the DPIA questionnaire gives you the skeleton on the EDPB template. Check the system's privacy notice with the privacy notice checker. If you do not know which other frameworks apply to you, start from the compliance obligations map.
It is possible, but hard to justify as the only option. Attendance can be recorded with a card, a code or an app, so the authority will ask why these were not enough. The version that stands up to an inspection: 1:1 verification, with the template on the person's card, an alternative without biometrics for those who do not want it, an impact assessment carried out before going live, information and consultation of the employee representatives. Without an alternative, the system relies on consent that, in the employment relationship, is rarely freely given.
As a rule, no. There is an imbalance between employer and employee, and European guidelines consider consent freely given only if refusing has no consequence. That is why the equivalent alternative (card, code, app) is the condition that makes consent credible. The same goes for the workers of other companies, who depend on their employer and on the beneficiary of the work. In Romania, no law expressly provides for the use of biometrics for time and attendance, so the legal basis, whether an Article 9 exception or the legitimate interest test in Law 190/2018 for monitoring, is built carefully and documented in the impact assessment.
With verification, the person says who they are, with a card, a code or a phone, and the system compares the fingerprint or the face only with their own template. With identification, the system searches for the person in the whole database. Verification needs less data, can work without a central database and is excluded from high-risk AI systems. Identification requires a database with everyone's templates and exposes everyone at every passage.
For the data collected by your system, you are the controller, even if the people are the subcontractor's employees. The contract with the subcontractor states who informs the workers, who offers the alternative, who has access to the data and who deletes it at the end of the work. If the beneficiary of the work imposes the system and decides how it works, you may be joint controllers (Article 26 GDPR), with a written agreement between you.
Article 12 GDPR requires information that is concise and intelligible, in clear and plain language. If some workers do not understand Romanian well, the privacy notice and the notice at the access point are also given in a language they understand. It can also be explained verbally, during training, with a signed acknowledgement. A notice the person cannot read does not inform them.
The biometric template is kept only as long as the person has access and is deleted when the employment relationship or the work ends. Access logs are kept for at most 30 days, with the exceptions provided by law or duly justified (Law 190/2018, Article 5). The working hours from the attendance record, not the biometrics, are kept as long as labour and accounting legislation require.
No. It is guidance generated automatically from the answers, under the legislation in force in October 2026, which you can print, copy or download as Word. The exact classification depends on details a questionnaire cannot verify, for example what the supplier actually does with the templates. The result tells you what is missing and where to start.
We carry out the impact assessment, the privacy notice all workers can understand, the contracts with the supplier and the subcontractors, and we check the configuration of the system.