Is biometric attendance mandatory in India?

The confusion usually traces to specific government contexts — attendance systems mandated for particular public establishments, or client contracts in regulated sectors that specify biometric access control. None of that generalises into a legal requirement for private employers, who are required to keep accurate registers and left to decide how.

Biometric capture also carries a cost that swipe cards do not. Fingerprints and face templates are personal data whose processing must satisfy the Digital Personal Data Protection Act, 2023: a valid basis, a clear notice, data minimisation, and deletion when the purpose ends. Consent obtained as a condition of employment is a weak foundation, because the imbalance of power makes it hard to characterise as freely given — a criticism made repeatedly of employment-context consent under comparable regimes such as the GDPR.

Indian courts and regulators have not settled every question here, but the direction of travel is clear from the Supreme Court's privacy jurisprudence and the Act's minimisation principle: collect the least identifying data that achieves the purpose. If the purpose is proving who worked when, a personal login plus a manager's approval achieves it without creating an irrevocable biometric database — a fingerprint, unlike a password, cannot be reissued after a breach.

Employers who do deploy biometrics should be able to answer three questions in writing: what lawful basis supports it, what less intrusive alternative was considered and why it was rejected, and when the templates get deleted.