Facial recognition is a popular way to clock staff in, because a face cannot be lent to a colleague. It also brings duties under the Protection of Personal Information Act (POPIA).
This guide compares facial recognition, fingerprint and NFC card clocking. It then sets out what POPIA says about biometric data at work. For the system itself, see our facial recognition clocking system for time and attendance.
What is facial recognition clocking?
Facial recognition clocking records when an employee starts and finishes work by matching their face against an image taken when they were enrolled. The match is done by a terminal, tablet or phone camera.
Because it checks the person, not a card or PIN, it is one of the strongest controls against buddy clocking. It is also contactless, which suits sites where many people clock in at shift change.
How does facial recognition compare with fingerprint and NFC card clocking?
Facial recognition and fingerprint clocking both check identity and both use biometric data. NFC card clocking avoids biometric data, but it only proves that a card was present.
| Feature | Facial recognition | Fingerprint | NFC card or tag |
|---|---|---|---|
| What it checks | The employee's face | The employee's fingerprint | That a card or tag was presented |
| Stops buddy clocking | Yes, if the match is reliable | Yes, if the match is reliable | Not on its own; cards can be shared |
| Touch needed | No, contactless | Yes, a finger on a sensor | A card held near a reader |
| POPIA category | Biometric information: special personal information (s 26) | Biometric information: special personal information (s 26) | Personal information, but not special personal information |
| Lawful basis | A ground in s 27, such as consent | A ground in s 27, such as consent | A ground in s 11 |
| If lost or stolen | A face cannot be reissued | A fingerprint cannot be reissued | Cancel the card and issue a new one |
| In Worxit Time & Attendance | Supported | Not listed for the module | Supported |
Many employers run two methods. Facial recognition is the default, and NFC is the fallback for staff who do not consent or when a camera is out of action.
Is facial recognition data special personal information under POPIA?
Yes. Section 26 of POPIA lists biometric information as special personal information, and the default rule is that it may not be processed.
Section 1 defines biometrics as identification based on physical, physiological or behavioural characteristics. Its examples include fingerprinting, retinal scanning and voice recognition. The Information Regulator's 2026 draft code on gated access also treats facial images as biometric data that needs heightened safeguards.
So the question is not whether POPIA applies. It is which exception you rely on, and whether you meet the other conditions for lawful processing.
What lawful basis do you need to clock staff in with facial recognition?
You need one of the grounds in section 27(1) of POPIA. For most employers, the realistic options are consent, or that processing is necessary for a right or obligation in law.
- Consent (s 27(1)(a)). POPIA defines consent as a voluntary, specific and informed expression of will. The employer must be able to prove it (s 11(2)(a)), and the employee may withdraw it at any time (s 11(2)(b)).
- Right or obligation in law (s 27(1)(b)). Processing that is necessary to establish, exercise or defend a right or obligation in law. Whether attendance records meet the "necessary" test for biometrics is a question for legal advice.
- Information about personnel (s 33). Section 33 allows some biometric processing by parties who obtained it lawfully. It adds that processing about personnel must follow rules set in line with labour legislation.
- Regulator authorisation (s 27(2)). The Regulator may authorise processing by notice in the Gazette. Its 2021 guidance note says it must be satisfied the processing is in the public interest and appropriately safeguarded.
Consent at work is delicate, because staff may feel they cannot say no. The Regulator's draft gated access code says consent is not voluntary if access depends on giving biometrics. It is a draft about gates, not payroll, but it shows how the Regulator reads "voluntary".
A practical answer is to offer a non-biometric option, such as an NFC card, to anyone who does not consent. This is a summary, not legal advice.
What must you tell staff before enrolling their faces?
Before you collect any face data, section 18 requires you to tell staff what you collect and why. Do it in writing, in a language they understand, and keep a copy of what was given.
- What is collected: the face image or template, and the clock-in records linked to it.
- Who you are, and who processes the data for you.
- Why you collect it, and whether giving it is voluntary.
- What happens if they refuse, such as using an NFC card instead.
- That they may object, ask for access or correction, and complain to the Information Regulator.
How should biometric clocking data be secured and kept?
Biometric clocking data should be secured, limited and deleted on time, like any personal information, but with more care. A face cannot be reissued if it leaks.
| Rule | POPIA | What it means for clocking |
|---|---|---|
| Lawful ground | ss 26, 27 | Biometric clocking needs a ground in section 27, such as consent. Record which ground you rely on and why. |
| Purpose | s 13 | Collect face data for a specific, defined and lawful purpose, such as recording attendance. Do not reuse it for something else. |
| Minimality | s 10 | Collect only what is adequate, relevant and not excessive for that purpose. Enrol only staff who clock in. |
| Notice | s 18 | Before enrolling, tell staff what you collect, who you are, why, whether it is voluntary, what happens if they refuse, and that they may complain to the Information Regulator. |
| Security | s 19 | Take reasonable technical and organisational steps against loss and unlawful access, for example personal logins, limited export rights and locked-down clocking devices. |
| Retention | s 14 | Do not keep biometric data longer than the purpose needs, unless a law, a contract or consent allows it. Then delete, destroy or de-identify it. |
| Operators | s 21 | If a software supplier processes the data for you, a written contract must require it to keep the same safeguards. |
| Breaches | s 22 | If biometric data may have been accessed by someone unauthorised, notify the Information Regulator and the staff concerned as soon as reasonably possible. |
Keep two things apart. The attendance record (who worked when) is an employment record. Section 31 of the Basic Conditions of Employment Act says you must keep it for three years. The face template only checks identity, and can usually be deleted when the employee leaves.
What is the checklist for POPIA-ready facial recognition clocking?
A POPIA-ready roll-out has a recorded legal ground, a notice, a fallback method, security controls and a deletion rule. Put them in place before the first face is enrolled.
- Decide and record the section 27 ground you rely on, with legal advice.
- Write the purpose down: recording attendance, and nothing else.
- Prepare the section 18 notice and the consent form, if you rely on consent.
- Offer a non-biometric method, such as NFC, to staff who do not consent.
- Sign an operator agreement with your software supplier (s 21).
- Limit who can view or export biometric and attendance data.
- Set a rule to delete templates when staff leave, and check that it runs.
- Add biometric data to your breach response plan (s 22).
If you also use biometrics at the gate, our visitor management and POPIA guide covers visitor data. This is a summary, not legal advice.
What if an employee refuses facial recognition clocking?
If you rely on consent and an employee refuses, give them another way to clock in. Do not treat the refusal as misconduct.
An NFC card is the usual alternative. Add controls that make up for the weaker identity check, such as supervisor confirmation at shift start or a rule on where scans count.
If an employee withdraws consent later, stop using their face data and delete the template. Section 11(2)(b) says withdrawal does not make earlier processing unlawful. Record the date and the method they now use.
If you rely on a ground other than consent, explain it in your notice and be ready to show why biometrics are necessary. Get legal advice on that choice. This is a summary, not legal advice.
How does Worxit handle facial recognition clocking?
Worxit Time & Attendance, supplied by Zamatrack, uses facial recognition and NFC. It does not offer fingerprint clocking.
- Staff clock in at access points, on-site locations or approved mobile zones.
- Staff are enrolled on a phone, uploaded in batches, or linked to visitor access devices.
- Attendance is recorded by location, with breaks, shift summaries and time worked.
- Zamatrack's store lists the HID Amico facial recognition terminal for use with the module.
Software supports your POPIA duties, but the legal ground, the notice and the retention rule remain the employer's decisions. The dashboard licence is R600 per month including one admin user. Extra dashboard users are R75 each per month, and each app device is R350 per month, all ex VAT.
Frequently asked questions
What is facial recognition clocking?
Facial recognition clocking records when an employee starts and finishes work by matching their face against an enrolled image. Because it checks the person rather than a card or PIN, it stops buddy clocking. Under POPIA, the face data is biometric information, which is special personal information.
Is facial recognition data special personal information under POPIA?
Yes. Section 26 of POPIA lists biometric information as special personal information, and section 1 defines biometrics as identification based on physical characteristics. Processing is prohibited unless a ground in section 27 applies, such as the employee's consent. This is a summary, not legal advice.
Can an employer force staff to use facial recognition clocking?
POPIA consent must be voluntary, specific and informed, and the Regulator's 2026 draft gate access code says consent is not voluntary when access depends on giving biometrics. Offering another method, such as NFC, is the safer course. Get legal advice for your workforce. This is a summary, not legal advice.
How long can we keep facial recognition clocking data?
POPIA sets no fixed period. Section 14 says records must not be kept longer than the purpose needs, unless a law, a contract or consent allows it. Delete biometric templates when an employee leaves, and keep the attendance record for the three years the BCEA requires.
Is fingerprint clocking safer under POPIA than facial recognition?
No. POPIA's definition of biometrics names fingerprinting, so fingerprint data is special personal information too. Both need a section 27 ground, a notice to staff and strong security. NFC card clocking avoids biometric data, but it does not prove who scanned the card.
Sources
Read on 22 October 2026. General information, not legal advice.
- Protection of Personal Information Act 4 of 2013. Government Gazette 37067, published on gov.za. Sections 1, 10, 11, 13, 14, 18, 19, 21, 22, 26, 27 and 33.
- Guidance Note on Processing of Special Personal Information. Information Regulator, June 2021. Authorisation under section 27(2).
- Draft Code of Conduct on Gated Accesses. Information Regulator, Government Gazette 54594, Notice 7415 (30 April 2026), published for comment. Biometric data and voluntary consent. A draft, not yet in force.
- Basic Conditions of Employment Act 75 of 1997. Government Gazette 18491, published on gov.za. Section 31 (records of time worked).