Biometric Data Security & Privacy Compliance for Bangladesh Enterprises

Executive Summary

Bangladesh's Personal Data Protection Ordinance 2025 (PDPO 2025) places biometric data in the highest tier of protected personal information — sensitive personal data requiring explicit consent, strict storage controls, limited retention, and mandatory breach notification. For the thousands of Bangladesh enterprises deploying fingerprint readers, facial recognition cameras, and iris scanners in their access control systems, PDPO 2025 fundamentally changes the compliance landscape.

This white paper explains what PDPO 2025 requires for biometric data processing, what technical and organisational controls your access control system must implement to comply, and how to evaluate whether your existing or planned biometric system meets the required standards. We draw on the ordinance's provisions as publicly available and cross-reference with ISO 19794 biometric template standards and international data protection best practices where PDPO 2025 is silent on technical implementation detail.

Non-compliance with PDPO 2025 carries penalties including administrative fines and potential criminal liability for responsible officers. More importantly, a biometric data breach affecting employee biometric templates is an irreversible harm — unlike a password or card credential, a compromised fingerprint template cannot be changed. The stakes for getting this right are high, and this guide provides a clear pathway to compliance.

Chapter 1: What Makes Biometric Data Special

1.1 The Irreversible Nature of Biometric Data

Every other form of credential — password, PIN, smart card, key — is revocable. If a password is compromised, you change it. If a card is cloned, you deactivate and reissue it. If a PIN is stolen, you set a new one. Biometric characteristics are fundamentally different: you cannot change your fingerprint, iris pattern, or facial geometry. A compromised biometric template is permanently compromised. The individual affected is permanently at risk of fraudulent authentication in any system that uses that biometric, for the rest of their life.

This irreversibility is why PDPO 2025 and data protection laws globally treat biometric data with exceptional caution. The harm from a biometric data breach is qualitatively different from the harm of a password breach. An organisation that suffers a biometric data breach has not just exposed credentials — it has exposed an unchangeable part of its employees' identity.

1.2 What Constitutes Biometric Data under PDPO 2025

PDPO 2025 defines biometric data as data resulting from specific technical processing relating to the physical, physiological, or behavioural characteristics of a natural person that allows or confirms the unique identification of that person. This definition explicitly includes:

• Fingerprint images and fingerprint templates
• Facial photographs processed for recognition purposes (but not unprocessed photographs)
• Iris scan images and iris templates
• Hand geometry measurements
• Vein pattern maps (palm vein, finger vein)
• Voice patterns used for voice recognition authentication
• Gait analysis data used for identification

Standard CCTV footage of a person walking through a lobby is not automatically biometric data under PDPO 2025. However, if that footage is processed through facial recognition software to generate a face template and compared against a database, the processing of that footage becomes biometric data processing subject to PDPO 2025's heightened requirements.

1.3 PDPO 2025 Classification: Sensitive Personal Data

PDPO 2025 creates two tiers of personal data: standard personal data (name, address, job title, contact information) and sensitive personal data (biometric data, health data, financial data, political opinions, religious beliefs, racial or ethnic origin). Sensitive personal data is subject to significantly higher compliance obligations:

• Explicit, informed consent is required (implied consent is insufficient)
• No legitimate interest override is available — unlike for standard personal data
• Data Protection Impact Assessment (DPIA) is mandatory before deploying a new biometric system
• Breach notification is mandatory within 72 hours, regardless of severity
• Cross-border transfer is restricted to countries with adequate data protection frameworks

Chapter 2: PDPO 2025 Compliance Requirements for Biometric Systems

2.1 Lawful Basis for Processing

Under PDPO 2025, every processing activity requires a lawful basis. For sensitive personal data including biometrics, the available lawful bases are more restricted than for standard personal data. The primary lawful bases applicable to employment-context biometric access control are:

Explicit Consent: The data subject provides freely given, specific, informed, and unambiguous consent. For employee biometric data, consent must be genuinely free — employees must not face adverse consequences for declining. In practice, this means providing an equivalent non-biometric access method (card + PIN) for employees who decline biometric enrolment, and clearly stating that their employment and treatment at work will not be affected by this choice.

Legal Obligation: Processing is necessary to comply with a legal obligation. This basis applies narrowly — for example, if a specific law required biometric verification in a regulated environment (such as a hypothetical Bangladesh Bank requirement for biometric vault access). It cannot be used as a general justification for deploying biometrics.

Vital Interests: Processing is necessary to protect someone's life. This basis is available only in emergency situations and is not applicable to routine access control.

Legitimate Interests: This basis, commonly used for standard personal data, is explicitly not available for sensitive personal data including biometrics under PDPO 2025. Organisations cannot justify biometric access control on the basis of legitimate interests alone.

2.2 Consent Requirements

Consent for biometric processing must meet specific standards under PDPO 2025:

Specificity: Consent must be obtained for each specific processing purpose. A blanket consent form covering "data collection" does not satisfy the requirement. The form must specify: what biometric data is collected, how it is stored, the retention period, who has access, and the specific purpose (access control, attendance recording).

Informed: Employees must understand what they are consenting to, in plain language. Legal jargon in a consent form that most employees cannot comprehend does not satisfy the informed requirement. Provide consent documentation in both English and Bangla.

Freely given: Employees must have a genuine choice. Document that an equivalent non-biometric alternative is available, and implement it. Record that no employee has been coerced or disadvantaged for declining biometric enrolment.

Withdrawable: Employees must be able to withdraw consent at any time, with the same ease as giving it. Implement a simple written withdrawal process, and configure your access control system to enrol the non-biometric alternative credential immediately upon receipt of withdrawal.

2.3 Data Minimisation

PDPO 2025's data minimisation principle requires that you collect only the biometric data necessary for the stated purpose, in the least privacy-invasive form possible. Applied to access control biometric systems:

• Do not store fingerprint images; store fingerprint templates only
• Do not store face photographs; store face vector templates only
• Do not store multiple biometric types (fingerprint + face + iris) unless each is required for different purposes with separate lawful bases
• Do not store biometric data for employees who do not access biometrically controlled areas

Configure your access control system to confirm template-only storage, verify this with the vendor's technical documentation, and include this confirmation in your DPIA.

2.4 Retention Limits and Deletion

PDPO 2025 prohibits retention of personal data beyond the period necessary for the stated purpose. For employment-context biometric data, the data is necessary only while the individual is employed and requires physical access to biometrically controlled areas. Upon termination of employment:

• The biometric template must be deleted from the access control system within a defined maximum period (SSAL recommends 24 hours as best practice; PDPO 2025 does not specify a maximum but "promptly" is implied)
• Any backup copies of the database containing the template must be overwritten or the template record deleted from all backup copies within the backup retention period
• A deletion record must be maintained confirming that the deletion occurred

Automate deletion by integrating the access control system with the HR system's termination workflow. When an HR administrator marks an employee as terminated, the access control system automatically deactivates and then deletes the biometric template on a configured schedule.

2.5 Subject Rights

PDPO 2025 grants data subjects (employees, in this context) rights over their personal data, including the right to access, the right to correction, and the right to erasure (deletion). Implement procedures for handling subject rights requests:

Right of Access: An employee can request a copy of their personal data held by the organisation. For access control, this includes their access rights, their biometric template record (though not the template itself, which cannot be meaningfully provided in a useful form), and their access event log.

Right to Erasure: An employee can request deletion of their biometric data. Upon receipt of a valid erasure request, initiate the same deletion process as described for termination above, within a reasonable timeframe.

Document all subject rights requests and responses for regulatory audit purposes.

Chapter 3: Technical Safeguards

3.1 Template Storage, Not Image Storage

The most fundamental technical safeguard is storing mathematical templates derived from biometric characteristics, never the original biometric image. A fingerprint template is a numeric vector (typically 512–2,048 bytes) representing the mathematical description of the fingerprint minutiae pattern. This template is not a fingerprint image and cannot be reverse-processed to recreate a fingerprint image that could be used to spoof a reader.

Verify with your access control vendor that their system stores templates, not images. Request technical documentation confirming:

• The format of stored biometric data (template specification)
• Whether raw biometric images are stored at any point in the enrolment or verification process
• How templates are encrypted at rest (see 3.2)
• Whether templates are stored in the device, the server, or both

Some budget fingerprint readers store the original fingerprint scan image alongside the template. This is a material compliance risk — insist on template-only storage and reject devices that cannot confirm template-only operation.

3.2 Encrypted Template Storage

Biometric templates must be encrypted at rest using a strong symmetric cipher. AES-256 (Advanced Encryption Standard with 256-bit key) is the current standard for at-rest encryption of sensitive data. Verify that:

• The access control server's database encrypts the biometric template table at the field level (column-level encryption), not only at the disk level
• Encryption keys are stored separately from the encrypted data (use a hardware security module — HSM — or a dedicated key management service)
• Disk-level encryption (BitLocker, LUKS) is also enabled on the server and any backup storage

Request a data flow diagram from your access control vendor showing where biometric data is stored (device, server, cloud), in what format, and with what encryption at each storage location.

3.3 ISO 19794 Template Standards

ISO 19794 is the international standard family for biometric data interchange formats. ISO 19794-2 defines fingerprint minutiae data. ISO 19794-5 defines face image data. ISO 19794-6 defines iris image data.

Compliance with ISO 19794 template formats provides two benefits: interoperability (templates stored in ISO format can be read by any compliant system, enabling migration between vendors without re-enrolment of all employees) and standardisation (ISO-format templates have well-understood security properties and are included in international regulatory frameworks).

When evaluating access control vendors, ask whether their biometric templates comply with ISO 19794. Proprietary non-standard template formats create vendor lock-in and may not have the same security properties as standardised formats.

3.4 On-Device vs. Server Matching

On-device matching (match-on-card or match-on-device) performs the biometric comparison entirely within the reader hardware. The enrolled template is stored in the secure element of the card or the reader's tamper-resistant memory, and the verification is performed locally without transmitting biometric data over the network. This architecture is the most privacy-preserving: biometric templates never traverse the network, eliminating network interception risk.

Server matching (1:N) sends a probe biometric sample to a central server, which compares it against the full enrolled database and returns the matching identity. Server matching is required for facial recognition at high-throughput entry points where 1:N (who is this person?) matching is needed, rather than 1:1 (is this person who they claim to be?) matching. Server matching introduces network transmission risk — mitigated by TLS 1.3 encryption for all communications — and centralises all biometric data on the server, creating a higher-value target for attack.

For highest-privacy configurations, prefer on-device matching (1:1) where the use case permits. Reserve server-based 1:N matching for use cases where it is genuinely required (e.g., facial recognition without card presentation).

Chapter 4: Organisational Controls

4.1 Data Protection Impact Assessment (DPIA)

PDPO 2025 requires a DPIA before deploying any new biometric system. A DPIA is a structured process for identifying, assessing, and mitigating privacy risks associated with a data processing activity. For a biometric access control deployment, the DPIA must:

1. Describe the biometric processing in detail (what data, what purpose, who has access)
2. Assess necessity and proportionality (is biometric authentication genuinely necessary, or would card + PIN suffice?)
3. Identify privacy risks (data breach, function creep, discrimination based on biometric data)
4. Identify mitigation measures for each risk (encryption, access controls, retention limits, consent process)
5. Document residual risks after mitigation and the decision to proceed or modify the implementation
6. Obtain sign-off from the organisation's Data Protection Officer (DPO) or equivalent responsible officer

SSAL can assist clients in completing the technical sections of a DPIA for biometric access control systems, as part of our access control design service. The organisational and legal sections require input from the client's legal and HR teams.

4.2 Staff Training

Every employee with access to the biometric access control system — enrolment operators, security managers, IT administrators — must receive training on PDPO 2025 obligations, the organisation's biometric data handling policy, and the procedures for responding to subject rights requests and data breaches.

Training should cover: what biometric data the organisation holds, why it holds it, who has access, how long it is retained, and what to do if they suspect a breach or receive a subject rights request. Training records must be maintained and training refreshed annually.

4.3 Data Breach Response

Under PDPO 2025, biometric data breaches trigger mandatory notification obligations. Prepare a biometric data breach response plan that includes:

• Detection: Monitor access control system audit logs for anomalous database queries, bulk data exports, or unauthorised access attempts
• Assessment (0–4 hours): Determine scope of breach, number of affected individuals, nature of data exposed
• Containment (0–4 hours): Isolate affected systems, revoke compromised database access credentials, preserve forensic evidence
• Notification (within 72 hours): Notify the Bangladesh ICT Division (the designated supervisory authority under PDPO 2025) and affected individuals
• Remediation: Implement corrective technical controls, conduct post-incident review, update DPIA

Chapter 5: Vendor Due Diligence

5.1 Questions to Ask Biometric Access Control Vendors

Before selecting any biometric access control system, obtain written answers to the following questions:

1. Does your system store biometric images or templates only? Provide technical documentation.
2. In what format are templates stored? Are they ISO 19794 compliant?
3. How are templates encrypted at rest? What encryption standard and key management approach is used?
4. Where is biometric data stored? On-device, on-premise server, or cloud? If cloud, in which country are the servers located?
5. Can your system support template-only 1:1 matching (match-on-device) to avoid central template storage?
6. Does your system provide complete audit logs of all biometric enrolment, matching, and deletion events?
7. What is your data retention capability — can the system be configured to automatically delete templates on a defined schedule or trigger (e.g., employee termination)?
8. Have you conducted a third-party security audit of your biometric data handling? Can you share the report?
9. What is your breach notification procedure and your timeline for notifying integrators/customers?
10. What certifications does your biometric hardware hold for security testing (e.g., FIDO2 Certification, Common Criteria EAL4+)?

Vendors who cannot answer these questions clearly and in writing should not be considered for biometric deployments subject to PDPO 2025.

Chapter 6: Audit Trail Requirements

6.1 Log Management for Compliance

PDPO 2025 compliance for biometric systems requires comprehensive audit logging of all biometric processing activities. The audit log must capture:

Enrolment events: Date/time, operator identity, employee ID, biometric type enrolled, template ID assigned, consent reference number.

Verification events: Date/time, reader/device location, employee ID, verification result (match/no match), confidence score (if applicable), door event outcome (granted/denied).

Administrative events: Any configuration change to biometric system settings, any export of biometric data, any bulk access to the biometric database, any failed authentication attempt.

Deletion events: Date/time, employee ID, biometric type deleted, operator who performed deletion, reason for deletion (termination/withdrawal/routine), confirmation that all backup copies are scheduled for deletion.

Retain audit logs for a minimum of 3 years to support regulatory investigations, subject rights requests (to demonstrate what data was held and when it was deleted), and internal compliance reviews.

6.2 Log Integrity

Audit logs are only useful for compliance purposes if they are tamper-evident. Implement:

• Write-once storage for audit logs (logs can be appended but not modified or deleted)
• Digital signatures on log entries to detect tampering
• Regular export of audit logs to an independent log management system (SIEM) outside the control of the access control system administrators

Conclusion

Biometric access control technology delivers genuine security and operational efficiency benefits, but it demands a compliance architecture that matches the sensitivity of the data it processes. PDPO 2025 is clear: biometric data is sensitive personal data, explicit consent is required, templates must be securely stored and promptly deleted when no longer necessary, and breach notification is mandatory.

The organisations that will successfully deploy biometric access control in Bangladesh are those that design compliance in from the start — not those that deploy first and retrofit compliance obligations later. A biometric system designed around PDPO 2025 requirements is more secure, more trustworthy to employees, and more defensible in the event of regulatory scrutiny or a security incident.

SSAL provides biometric access control system design that incorporates PDPO 2025 compliance controls as standard. We guide clients through DPIA preparation, vendor technical due diligence, consent process design, and audit trail configuration, ensuring that your investment in biometric security is protected by a robust compliance framework.

About SSAL

Smart Safety & Automations Ltd. (SSAL) is Bangladesh's leading enterprise security solutions provider, with certified expertise in biometric access control systems from ZKTeco, Honeywell, Gallagher, and HID. We design biometric systems that comply with PDPO 2025 and Bangladesh Bank ICT Security Guideline v4.0, providing clients with security, operational efficiency, and regulatory confidence.

Ensure your biometric system is fully compliant.

• Website: www.smartsafety.com.bd
• CTA: [Get Free Consultation] [Talk to Our Expert] [Request a Quote]