IT Glossary
Biometric authentication verifies identity with a fingerprint or face. Learn how it works, what GDPR Article 9 requires, and where the data lives.
August 7, 2026
Biometric authentication is a method of verifying identity using a measurable physical or behavioral trait, such as a fingerprint, a face, an iris pattern, or a typing rhythm. In enterprise access management it is almost always used as a local unlock for a cryptographic credential, not as a credential sent to a server.
Biometric data processed to uniquely identify a person is a special category of personal data under Article 9 of the GDPR, and it needs an explicit legal basis. That is a strong argument for on-device matching: if the template never leaves the employee laptop or phone, the employer is not building a central biometric database, and the consequences of a breach change entirely.
A European company enables Touch ID and Windows Hello as the unlock for passkeys on every corporate device. The data protection officer reviews the design and confirms that no biometric template reaches company servers or the identity provider. Employees sign in with a fingerprint, the identity provider only ever sees a signed challenge, and the compliance file records that no Article 9 processing takes place on the employer side. Corma, hosted in the EU and certified ISO/IEC 27001:2022, sits on the access governance layer above that setup.
On its own, no. It is a single factor, something you are. It becomes multi-factor when combined with possession of the device holding the private key, which is exactly how passkeys work.
On modern devices, inside a hardware-isolated area such as a Secure Enclave or a TPM. It is not synced to the cloud and is not transmitted to the sites you log in to.
No, and that is the core objection to central biometric databases. A password can be rotated, a fingerprint cannot, which is why on-device templates have become the accepted design.
No, but it treats biometric identifiers as special category data under Article 9. Employers generally need an explicit legal basis, a data protection impact assessment, and a genuine alternative for employees who decline.
