Explicit consent + alternative
Provide a non-biometric route for users who decline.
Region · Western Europe
Face recognition in Western Europe.
GDPR treats biometric identification data as special category data, and the EU AI Act adds prohibitions and high-risk rules. Here's how to deploy responsibly.
GDPR Art. 9 · EU AI ActKey laws
What applies in Western Europe.
ART 9
GDPR special category
Biometric data for unique identification needs an Article 9(2) condition — usually explicit consent — plus an Article 6 lawful basis.
ART 35
DPIA
Large-scale or systematic biometric processing generally requires a Data Protection Impact Assessment.
AI ACT
Prohibited practices
Since February 2025: no untargeted scraping of facial images, no emotion recognition at work or in education (except medical or safety), and strict limits on real-time remote identification in public.
AI ACT
High-risk systems
Remote biometric identification is high-risk; pure 1:1 verification is excluded. High-risk obligations phase in from 2026 — check the current timetable, as adjustments have been proposed.
DPAs
National regulators
Authorities such as the CNIL (France), the Dutch AP and German state regulators have issued biometric guidance and fines.
Your checklist
What you need to do.
DPIA before launch
Document necessity, proportionality and safeguards.
Article 28 DPA
Sign our DPA; it includes SCCs for international transfers.
Avoid prohibited uses
No emotion recognition at work or school, no untargeted scraping.
How SIMSIM helps
Privacy-first by design.
Templates, not photos
Less sensitive data held, smaller breach impact.
Deletion by API
Honour withdrawal and retention schedules in code.
Processor terms
A DPA with the transfer terms your market needs.
FAQ
Questions from teams in Western Europe.
Is SIMSIM a controller or processor?
For your end users' data, SIMSIM acts as your processor under an Article 28 DPA. You remain the controller.
Is 1:1 KYC verification high-risk under the AI Act?
No — verification that only confirms a person is who they claim is excluded from the high-risk biometric category. GDPR still applies in full.
Can I process data in the EU?
Ask us about processing locations and transfer safeguards for your plan.
General information, not legal advice. Last reviewed 2026-09-30. Confirm requirements with qualified counsel.
Other regions
Operating in more than one market?
Building for Western Europe?
Start free, or talk to us about DPAs, processing locations and volume pricing.