Consent at capture
Get clear, specific consent before collecting a face.
Under the Privacy Act, biometric information and templates are sensitive information — consent is generally required, and the OAIC takes facial recognition seriously.
Biometric information used for automated verification or identification, and biometric templates, are sensitive information that generally requires consent to collect.
The OAIC has issued guidance on facial recognition and taken action against retailers using it without adequate notice or consent.
The Privacy and Other Legislation Amendment Act 2024 adds a statutory tort for serious invasions of privacy and automated-decision transparency duties from December 2026.
Reporting entities can use biometric verification within their customer identification procedures.
Get clear, specific consent before collecting a face.
Assess necessity, proportionality and risks before deploying.
Explain what's collected, why, and who receives it (APP 5).
Protect templates and destroy them when no longer needed (APP 11).
Less sensitive data held, smaller breach impact.
Honour withdrawal and retention schedules in code.
A DPA with the transfer terms your market needs.
General information, not legal advice. Last reviewed 2026-09-30. Confirm requirements with qualified counsel.
Start free, or talk to us about DPAs, processing locations and volume pricing.
We use essential storage to run this site and, only with your consent, Google Analytics to understand how it's used. We never use advertising cookies. See our Cookie Policy.