What is biometric data?
Definition
Biometric data is information about a person's body or behavior, such as a fingerprint, face or voice, that can be used to recognize or identify them automatically.
- Category
- Data
- Also called
- biometrics, biometric information
- Last updated
Biometric data comes from measuring something about you that is hard to change: the ridges of a fingerprint, the shape of your face, your iris, your voice or the way you walk. NIST describes a biometric as a biological attribute of a person from which consistent, distinctive values can be extracted for automated recognition.
The everyday example is unlocking your phone with your face or thumb. The phone turns a scan into a numeric template and compares it with the stored one. Airports, workplaces, gyms and banks use the same idea for entry or identity checks.
Under the GDPR (Article 4(14)), biometric data is personal data that comes from specific technical processing of a person's physical, physiological or behavioral traits, and that allows or confirms a unique identification. The UK ICO applies that same definition. When biometric data is used to identify someone, it is treated as special category data, which gets extra protection. See special category data.
Why it matters: you can change a leaked password, but you can't change your face or fingerprint. If a company stores biometric templates badly and they leak, the damage lasts. Biometric data can also be used for identity theft or to build deepfakes that imitate your face or voice.
Not everything measurable counts. The ICO notes that some uses people call biometrics may fall outside the legal definition, and the wording differs between laws and countries.
Biometric data vs. a password
A password is something you know and can replace. A biometric is something you are, and it stays the same. That is useful for convenience and a problem if the data is exposed.
How to protect yourself
- 1
Check why a service wants your face or fingerprint
Ask what it's used for, how long it's kept and whether you can say no. Where there is a non-biometric option, such as a PIN, you can use that.
- 2
Prefer on-device unlocking
Phone face and fingerprint unlock usually stays on the device. A service that uploads your scan to its own servers is a bigger exposure.
- 3
Keep a strong fallback
Use a long passcode and two-factor authentication so a copied biometric alone doesn't open your accounts.
- 4
Limit public photos and voice clips
Clear photos and recordings help people clone faces and voices. Review what's public on your social profiles.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a photo of my face biometric data?
Not by itself under the GDPR. A photo becomes biometric data when it's processed in a specific technical way that allows or confirms a unique identification, such as facial recognition.
Can biometric data be changed if it leaks?
No. That is the main reason it needs more care than a password.
Is biometric data special category data?
Under the GDPR and UK GDPR, yes when it's processed to uniquely identify a person.
Sources
Something wrong or out of date? Tell us and we'll re-check it.