Fingerprint Time Clocking in Portugal11 minutos de leitura

Clocking in with a fingerprint remains the most widely sold biometric technology in Portugal for attendance control, but it is also the one that most frequently raises questions before the CNPD, among workers, and even inside the employer’s own legal team. This guide explains, without evasion, what the GDPR, the Portuguese Labour Code and CNPD doctrine actually require for a fingerprint biometric terminal to be used lawfully on Portuguese soil — and when a non-biometric alternative is the better choice.

This article is written for foreign business owners, operations directors and HR managers running companies in Portugal who need to decide whether to install fingerprint readers for attendance tracking, or to adopt an RFID card, PIN or mobile app instead. The focus is legal-operational and evergreen: the rules described here rest on long-standing instruments.

What “clocking in by fingerprint” actually means

It means registering entries and exits through a reader that captures the worker’s fingerprint, converts it into a mathematical template (a sequence of characteristic points — minutiae) and compares it to a previously enrolled template. On a match, the terminal records the event (date, time, identification).

What is stored on the system is not the fingerprint image. It is a mathematical representation that is not reversible to the original image. Even so, the GDPR classifies this template as biometric data processed for the purpose of uniquely identifying a natural person, placing it under the reinforced regime of Article 9.

Sensors: optical, capacitive and ultrasonic

Not every fingerprint reader is the same. Understanding the sensor helps decide whether it suits your workplace:

• Optical: uses light and a camera to capture the finger pad image. Cheap, rugged, but sensitive to dirty, wet or worn fingers. Common on factory-entrance terminals.
• Capacitive: measures electrical capacitance between skin ridges and valleys. More accurate and smaller, harder to spoof with a photograph. Standard on smartphones and mid-to-high-end terminals.
• Ultrasonic: sends ultrasonic waves that penetrate the outer skin layer and read the 3D structure of the print. Works on slightly dirty or damp fingers. More expensive and less common on attendance terminals, but the most robust anti-spoofing technology.

Sensor choice has direct operational consequences: in environments with ceramic dust, cement or oil (construction, metalworking), optical fails often; capacitive degrades; ultrasonic holds up better but costs more than twice as much.

GDPR: biometrics is a special category

Article 9(1) of the GDPR (Regulation EU 2016/679) prohibits, as a rule, the processing of biometric data for the purpose of uniquely identifying a natural person. The general prohibition yields only when one of the exceptions in paragraph 2 applies — in the employment context, the ones most commonly invoked are:

• Explicit consent from the worker (point (a)) — but the CNPD and the European Data Protection Board hold that consent in an employment context is rarely “freely given”, because of the power imbalance between employer and employee. As a rule it does not stand alone as a legal basis.
• Necessity in the field of employment law (point (b)) — but this requires a law or collective agreement that provides for it and offers adequate safeguards. In Portugal, no statute requires biometrics.
• Substantial public interest (point (g)) — not applicable to attendance control in ordinary private companies.

The practical consequence is this: fingerprint biometrics for attendance is only lawful when the employer can show objective necessity and proportionality — convenience, comfort or “it’s industry standard” are not enough.

CNPD historical position: Deliberação 7680/2014

The CNPD published, mid-last decade, Deliberação 7680/2014, which laid down the principles applicable to biometric data processing in the workplace. The essentials still stand as reference doctrine:

• Biometrics for attendance control is admissible only in cases of demonstrated necessity, never as a default option.
• The employer must prefer mathematical templates, never images or raw features.
• Storage should be local (on the worker’s card or on the terminal itself), avoiding unnecessary centralised databases.
• The worker must be informed in advance and offered a non-biometric alternative.
• Technical and organisational safeguards must protect the template.

With the GDPR and Law 58/2019 (the Portuguese implementing act), prior CNPD authorisation is no longer required. But the substantive doctrine of Deliberação 7680/2014 — necessity, proportionality, alternative, template-only — survived and was reinforced in later CNPD guidance.

Labour Code: no rule requires biometrics

Article 202 of the Portuguese Labour Code (Law 7/2009) obliges the employer to keep a record of workers’ working time, with start and end hours, breaks and interruptions. The rule is technology-neutral: it accepts paper sheets, software, punch cards, mobile apps or biometric terminals. There is no Portuguese legal provision that mandates fingerprint reading.

Practical consequence: when the employer chooses biometrics, they are choosing a technology more intrusive than strictly necessary to comply with the legal duty. That choice must be justified before the CNPD and before the worker — it is not a given.

DPIA: mandatory impact assessment

Article 35 of the GDPR obliges the controller to carry out a Data Protection Impact Assessment (DPIA) whenever processing is likely to result in a high risk to the rights and freedoms of natural persons. Systematic processing of workers’ biometric data is expressly on the CNPD’s published list of operations subject to a DPIA.

A well-done DPIA documents:

• Purpose (attendance control) and legal basis invoked.
• Necessity and proportionality of using biometrics against alternatives.
• Risks to the worker (misidentification, secondary use, data breach).
• Mitigation measures (template-only, encryption, limited retention, right to refuse).
• Consultation with workers or their representatives.

Without a documented DPIA, the use of biometrics is in itself a GDPR infringement — even if the processing is materially lawful. In any inspection or complaint, the CNPD starts from the DPIA.

The duty to offer a non-biometric alternative

This is the most frequently ignored point among employers and the one that most quickly triggers complaints to the CNPD: the obligation to offer a non-biometric alternative for workers who do not want to use the fingerprint.

Valid alternatives accepted by the CNPD:

• Personal RFID card, with the worker’s identification code.
• Personal PIN code, entered on the same terminal.
• Mobile application with authenticated login, a photo at punch time and geolocation.
• Supervised manual record, for exceptional cases or workers without a smartphone.

Refusing to use biometrics cannot support disciplinary action, exclusion from attendance bonuses or any differentiated treatment. It is a worker’s right. An employer who conditions benefits on fingerprint use is committing an unlawful practice.

How the data is stored: template-only, never image

Technically, a biometric terminal can store:

• The raw fingerprint image (BMP, raw) — forbidden in the employment context.
• The mathematical template (minutiae vector) — acceptable if the other conditions are met.
• A hash of the template — even safer.

When choosing a terminal, obtain written confirmation from the vendor that the device neither stores nor transmits the image, only the template. Ask for technical documentation. This is one of the central checks in any DPIA and any CNPD audit.

In addition, the template must be encrypted at rest and in transit, with the key controlled by the data controller, not the vendor.

Retention: how long the template is kept

The storage limitation principle (Article 5(1)(e) GDPR) requires biometric data to be erased as soon as it is no longer needed for the purpose. Good practice:

• Throughout the employment contract, the template is kept to enable clocking.
• On contract termination, the template must be deleted on a short timeline (within 30 days is a sound default), even though the attendance records themselves (hours, days) are retained for 5 years under Article 202.
• Attendance records (punch history) and biometric templates are distinct data with distinct retention periods. Do not conflate them.

Sectors where it does (and does not) make sense

From operational experience and CNPD guidance, fingerprint biometrics is more defensible in:

• Factories and warehouses with high-density shifts, personal mobile phones restricted for safety, and a documented history of buddy punching.
• Private security, where accurate identification is part of the service delivered to the end client.
• Pharmaceutical and laboratory areas where controlled access to specific zones is linked to attendance.

It is less defensible — and typically refused or badly received by the CNPD — in:

• Office environments with small teams and no demonstrated fraud risk.
• Construction, where dust, cement and hand injuries make optical/capacitive reading unreliable and generate de facto exclusion.
• Healthcare, where glove use and frequent disinfection limit reading, and where staff already handle sensitive patient data — adding their own biometrics is disproportionate.
• Retail and hospitality with high turnover, where the administrative cost of enrolling and deleting templates outweighs the benefit.

Workplace cultural considerations

In Portugal, social acceptance of fingerprint readers in the workplace is mixed. Younger workers tend to accept it without resistance (they are used to unlocking phones that way); older workers or those with active union involvement often refuse, citing legitimate concerns about dignity and autonomy.

The works council and the unions have the right to be consulted before biometric attendance systems are implemented (Article 20 of the Labour Code and Article 88 of the Works Councils Act). Rolling out without consultation is a procedural error that the CNPD views unfavourably.

Non-biometric alternatives in detail

Before installing biometrics, ask whether one of these solves the problem:

• RFID card: low cost (2-5 EUR per card), individual identification, easy to manage. Risk: card lending. Mitigation: internal policy + sample verification.
• Personal PIN: zero additional cost, accepted by the CNPD, can be combined with a card (two-factor). Risk: PIN sharing. Mitigation: periodic rotation.
• Mobile app with photo + GPS: replaces biometrics with less sensitive data (an occasional photo is not “biometric data” within the meaning of Article 9 as long as it is not run through a system that uniquely identifies the worker). Eliminates buddy punching with zero hardware cost.
• On-site dynamic QR code: the worker photographs a QR renewed every minute and authenticates via the app. Guarantees physical presence without biometrics.

For the typical Portuguese SME (5-50 workers), the combination of mobile app + on-site QR code or RFID card + PIN satisfies Article 202 with far lower GDPR risk than biometrics.

Common employer mistakes

1. Installing the biometric terminal without a DPIA. This is an infringement, with or without a complaint.
2. Not offering a real alternative. “Saying” an RFID card exists but in practice only the biometric works is non-compliance.
3. Storing the fingerprint image “to re-enroll without reconfiguring”. Forbidden.
4. Delegating to the vendor without a processor contract under Article 28 GDPR.
5. Failing to delete templates when a worker leaves.
6. Conditioning attendance bonuses on biometric use.
7. Proceeding without consulting the works council or representative unions.

Official sources

• Portuguese Labour Code (Law 7/2009), Article 202 — dre.pt
• General Data Protection Regulation (Regulation EU 2016/679), Articles 5, 9, 28 and 35
• Comissão Nacional de Protecção de Dados — cnpd.pt (Deliberação 7680/2014 and later guidance on workplace biometrics)
• Autoridade para as Condições do Trabalho — act.gov.pt

Conclusion

Clocking in by fingerprint in Portugal is technically simple, legally complex and culturally sensitive. The GDPR classifies the biometric template as a special category of data; the CNPD demands necessity, proportionality and an alternative; the Labour Code imposes biometrics nowhere. For most Portuguese SMEs, a combination of RFID card, PIN and a mobile app with photo satisfies Article 202 at a fraction of the GDPR risk. When biometrics really is needed — high-density factories, private security, laboratories — proceed only with a DPIA, template-only storage, a real alternative and prior consultation with worker representatives. The compliance investment protects the employer and respects the worker.

This article does not constitute legal advice. For specific cases, consult a Portuguese employment lawyer and a data protection officer.

Related reading

• Article 202 of the Portuguese Labour Code
• Best App for Time Clocking
• PicaPonto vs Factorial vs Sesame
• ACT Labour Inspections