Biometric data refers to measurable physical or behavioural characteristics that can uniquely identify an individual, such as fingerprints, iris patterns, facial geometry, voice prints or gait analysis. Unlike passwords or tokens, biometric identifiers are inherently tied to the person and cannot be easily changed if compromised.
Under the GDPR, biometric data processed for identification purposes is classified as a special category of personal data, requiring explicit consent or another Article 9 legal basis. The EU AI Act imposes additional restrictions on real-time biometric identification systems in public spaces. Organisations using biometric authentication must implement stringent security measures for storage and processing, including encryption and access controls.