Can a company require my fingerprint or face scan (biometric data)?
Last updated: 2026-07-12 · Educational content; not legal advice.
Short answer
Only on a lawful basis, and it usually needs your consent. Biometric data — fingerprints, face scans, iris — is personal information the NPC treats as sensitive, so its collection is tightly regulated. Under RA 10173 §12 (and §13 for sensitive personal information), a company needs a valid lawful basis, most commonly your freely given, informed consent, and under §11 the collection must be for a legitimate purpose and proportionate. That means a company generally cannot force biometrics on you if a less-intrusive alternative (like an ID card or PIN) would achieve the same purpose; you can ask for that alternative and refuse blanket biometric capture.
Primary sources
Frequently asked
Is my consent to biometrics always required?
Consent is the most common lawful basis, but RA 10173 §12–13 allow processing on other narrow grounds (e.g., a legal obligation or a contract you entered). Even then, the collection must still be proportionate under §11 and you must be clearly informed of the purpose and retention.
Can my employer or a store force fingerprint or face capture?
They must justify it as necessary and proportionate for a legitimate purpose and disclose it in advance. If a less-intrusive method works just as well, forcing biometrics can be disproportionate and challengeable. Covert facial recognition without notice is especially risky under the DPA.
What can I do if I'm forced to give biometrics?
Ask for the purpose, the lawful basis, the retention period, and a non-biometric alternative in writing from the Data Protection Officer. If they refuse a reasonable alternative or can't justify the collection, file a complaint with the NPC.
Take action
Related companies
Got a similar problem?
File a complaint and we'll pre-fill BSP, SEC, DTI, and small-claims letters for you.
Contact-list scraping, unauthorized data use, and how to file with the NPC.