What is biometric data?

Data processed by technical means, connected to physical, physiological or behavioural characteristics, enabling a person's unique identification or identity confirmation. The special-category regime applies where the purpose is unique identification.

Can biometrics be used for convenience?

Convenience is not a lawful basis. Biometric processing for activity, security, property protection and secrecy is permitted only where achieving these purposes by other means is impossible or disproportionately costly — biometrics must be the last resort.

What document must exist before the system is switched on?

A written determination: the purpose and scope of processing, retention period, storage and destruction procedure and rights-protection mechanisms. It must exist before the processing begins.

When is an impact assessment needed?

Where new technologies create a high probability of risk to rights and, additionally, in cases of systematic large-scale monitoring of behaviour. The document is kept during processing and for at least 1 year after its cessation.

Biometric Compliance in Georgia

About this service

A facial image, a fingerprint, a voice characteristic, an iris pattern — biometric data is the strongest means of identifying a person and at the same time one of the most sensitive categories of data. A leak of biometrics cannot be fixed by changing a password: biometrics accompanies a person for life. That is precisely why the Georgian law on personal data protection places biometric data in the special-category regime and subjects its processing to special conditions. This service helps organisations that use — or plan to use — biometrics, from access control to customer verification.