Biometric Time Clocks in Portugal8 minutos de leitura

Biometric time clocks — fingerprint scanners, facial recognition terminals — are increasingly common in Portuguese workplaces. They offer fast, friction-free clock-in and strong anti-fraud protection. But biometric data is sensitive personal data under Article 9 of the GDPR, triggering strict obligations and liability. Mishandling creates exposure to CNPD fines up to 4% of global annual turnover.

This guide is for international business owners and HR managers evaluating biometric time-clocking systems in Portugal. It covers the GDPR framework, the specific CNPD guidance for employment contexts, implementation steps and the common pitfalls.

The legal framework

• GDPR Article 9 — biometric data processed for the purpose of uniquely identifying a natural person is a special category of personal data; processing is prohibited unless specific exceptions apply
• Portuguese Law 58/2019 — national implementation of GDPR, with specific provisions on employment data
• CNPD guidance — the Comissão Nacional de Protecção de Dados has issued specific guidance for biometric time-clocking in employment
• Portuguese Labour Code — Article 20 restricts worker surveillance; Article 199-A regulates right to disconnect; Article 202 requires time registration (but does not mandate biometric method)

Can we use biometric time-clocking in Portugal?

Yes, but under strict conditions:

Legal basis (GDPR Article 9(2))

Biometric processing requires one of the specific Article 9 exceptions. For employment context, the relevant bases are:

• Substantial public interest or necessary for employment obligations (Article 9(2)(b) + national law) — requires specific legal basis in Portuguese law; the CNPD has traditionally been restrictive on using this for ordinary time clocking
• Explicit consent (Article 9(2)(a)) — generally not accepted in employment context because consent is not freely given (power imbalance)

The practical conclusion: biometric time clocking is defensible only when (1) justified necessity exists (specific operational need not met by alternatives) and (2) all GDPR technical and organisational conditions are met.

Necessity test

Can the time registration goal be met with less-intrusive means (RFID card, PIN, mobile app)? If yes, biometric is likely disproportionate. For most office environments, biometric is NOT necessary and is NOT defensible. For specific scenarios (high-security facilities, high-fraud risk environments, specific industrial contexts), it may be defensible.

Technical requirements

• Template storage only — the original biometric image (fingerprint photo, face image) must never be stored. Only the mathematical template derived from it
• Local processing where possible — reduces data flow and exposure
• Encryption at rest and in transit
• No central template database accessible by multiple terminals (CNPD guidance)
• Automatic template deletion on worker exit
• Alternative non-biometric method available for workers who cannot or will not use biometric (CNPD requirement)

Organisational requirements

• Written information to the worker before processing: what data, why, how long stored, where processed, rights
• DPIA (Data Protection Impact Assessment) if system processes data of significant number of workers
• Consultation with employee representatives (Article 20 Labour Code and GDPR)
• Documented necessity justification (why biometric and not alternative)
• Appointed Data Protection Officer if your organisation meets DPO threshold criteria
• Register of processing activities (RoPA) entry for biometric time clocking

Specific CNPD position

The CNPD has historically been restrictive on biometric time clocking in employment. Key points from its guidance and decisions:

1. Biometric is NOT the default; justify why alternative methods (RFID, PIN, password) are insufficient
2. If used, template-only storage, local terminal processing preferred, no central database
3. Workers must have genuine alternative — not merely “theoretical”
4. Children (minors) extra protection; particular caution for seasonal/trainee staff who may be minors
5. Biometric data cannot be used for secondary purposes (performance review, surveillance beyond time clocking)
6. Transfer outside EU/EEA restricted; many biometric vendors store on US cloud — check your Data Processing Agreement

Fingerprint vs facial recognition — practical differences

Alternatives to biometric

For most Portuguese employers, non-biometric methods are sufficient AND more defensible under GDPR:

• RFID card / contactless badge — fast, cheap (€200-500 terminal + €1-3 per card), easily revoked, low GDPR risk
• Mobile app with server timestamp — zero hardware cost, worker-centric, can combine with optional GPS for field workers
• Mobile app with QR code at location — hybrid, confirms presence without GPS
• Browser clock-in with authentication — for office/remote workers
• PIN code at terminal — simple, works where no mobile allowed

For 90% of Portuguese workplaces, the combination of mobile app + optional RFID terminal covers all needs without the GDPR complexity of biometric.

If you decide biometric is right for your operation

1. Document the necessity justification (why alternatives fail)
2. Choose a vendor with EU-based processing (or explicit SCC/adequacy for non-EU)
3. Prepare DPIA
4. Consult employee representatives / works council
5. Prepare written information for each worker (what data, why, how long, rights)
6. Prepare alternative method (RFID card or PIN) for workers who opt out
7. Register processing activity (RoPA)
8. Configure template-only storage, encryption, deletion-on-exit
9. Train workers (short session, clear language, demonstration of alternatives)
10. Audit annually — vendor compliance, template integrity, worker opt-outs honoured

Common pitfalls

1. Deploying biometric “because it’s the standard” — standard is not necessity; CNPD will not accept
2. No written information before processing — immediate GDPR violation
3. No genuine alternative — “sign a paper form” is not a real alternative
4. Central database of templates — contrary to CNPD guidance
5. Vendor stores original images — not just templates — automatic non-compliance
6. Transfer of biometric data to US cloud without adequacy — significant risk
7. No DPIA — mandatory for most biometric deployments in employment
8. No consultation with workers or their representatives — Article 20 violation
9. Using biometric data for other purposes (surveillance, discipline) — purpose limitation breach
10. Not deleting templates on worker exit — retention beyond purpose

Fines and enforcement

CNPD can fine up to:

• €20 million or 4% of annual worldwide turnover for serious GDPR violations
• €10 million or 2% for other violations
• Issue orders to stop processing, delete data, implement corrective measures
• Order payment to affected workers for damages

Multiple Portuguese cases have reached seven-figure fines; defensive compliance posture is essential.

Official sources

• GDPR (Regulation 2016/679) — EUR-Lex
• Portuguese Law 58/2019 — Diário da República
• CNPD — cnpd.pt
• Portuguese Labour Code (Lei 7/2009), Articles 20, 199-A, 202 — Diário da República

Conclusion

Biometric time clocking in Portugal is legally defensible only under strict GDPR conditions: documented necessity, template-only storage, local processing, genuine alternative, written information, DPIA, worker consultation. For 90% of Portuguese employers, non-biometric methods (RFID, mobile app, PIN) deliver the operational benefits without the GDPR complexity. Default to non-biometric unless specific operational necessity is demonstrable.

Evaluating biometric vs non-biometric time clocking for your Portuguese operation? PicaPonto supports RFID, mobile app with server timestamp, QR code and biometric terminals — but ships with GDPR-ready defaults preferring non-biometric methods where operationally sufficient. Start a 15-day free trial.

This article does not constitute legal advice. For specific cases, consult a Portuguese employment or data protection lawyer.

Related reading

• Article 202 of the Portuguese Labour Code
• Compensatory Rest for Overtime (Article 229)
• Workforce Attendance Management in Portugal
• ACT Labour Inspections in Portugal