Control de Acceso Valencia

Biometric access control in Spain: when it makes sense and how to do it properly

Fingerprint and facial recognition are convenient and cannot be lent or lost, but in Spain their use is tightly constrained by data protection. Here is a frank view of when it can be justified, what it requires, and which alternatives give a similar result with less risk.

Request a quote +34 605 660 658

A person identifies themselves at a facial recognition terminal next to a turnstile

First: what the Spanish regulator says

In November 2023 the Spanish data protection authority (AEPD) published its guide on biometric presence control. It treats identifying or authenticating a person by fingerprint or face as processing of special category data and high risk, for both clocking and access control. According to the authority's own press release, consent is not a valid basis in the employment context and, in general, not for access control that could be done by other means either; it also requires a prior data protection impact assessment (DPIA) showing the measure is suitable, necessary and proportionate.

In practice: if a card, a phone or a PIN solves the problem, biometrics fails the necessity test. This is stricter than many people moving from the UK or elsewhere expect.

When it may be considered

  • Access to areas where an identity error has serious consequences and there is a law that supports it or a solid, documented security justification.
  • Always with a prior DPIA, clear information, a non-biometric alternative, and technical measures: encrypted template, no possible reuse for other purposes, and deletion when no longer needed.

More in biometrics in access control and, for clocking, can staff clock in by fingerprint?.

What we do

  1. Assess your case and tell you whether we see room for biometrics before selling any equipment.
  2. Propose the alternative when there is none: encrypted card, mobile credential or two-factor (comparison).
  3. Install and configure the chosen system with the technical measures set by your DPIA.
  4. Convert existing biometric terminals to card or PIN where possible.

We are not a law firm: the DPIA and the decision on the legal basis belong to your company and its data protection officer or adviser. We provide the technical side.

What drives the price

The type of terminal, the number of points, the software and the security measures required. Legal work (the DPIA) is not included.

How we work

  1. You tell us about your case by phone, email or the form.
  2. We survey the site: doors, entrances, electrical boards and network.
  3. We deliver a written, itemised proposal.
  4. We install, configure and train whoever manages it.
  5. We hand over documentation and administrator credentials.

Frequently asked questions

Is fingerprint clocking banned in Spain?

There is no outright ban, but the AEPD treats it as high-risk processing that cannot rely on consent in employment and must pass a strict necessity test. Since a less intrusive alternative almost always exists, it is very hard to justify in practice.

What if employees or members consent?

According to the AEPD, consent is not valid in employment because of the imbalance between the parties, and outside employment it is not enough if the control can be done by other means.

I already have fingerprint terminals. What should I do?

Review the processing with your data protection adviser. On many devices biometrics can be switched off and a card or PIN used without replacing the terminal.