Article 9 treats biometric data used for identification as special category data. Deployments fail compliance review for predictable reasons, and all of them are design decisions made early.
Store templates, never images
An irreversible template is not a photograph. Systems that retain enrolment images create a liability with no operational benefit.
Give people a real alternative
Consent that carries a penalty is not freely given. There must be a credential path — card, mobile, PIN — that costs the user nothing to choose.
Decide where the template lives
On-device, on-controller, in-credential and in-cloud are four different risk profiles. Choose deliberately, document why, and write the retention period into the system rather than the policy binder.
