Data Protection & Information Security Experts

Subject Access Requests From Employees: What UK Employers Need to Know

Yes, employees and former employees can make a subject access request (SAR) to their employer. You must usually respond within one month and give them a copy of their personal data, including relevant emails, HR records and notes. You can’t refuse because of a grievance or tribunal claim, but some information, such as confidential references, may be exempt.

Employment SARs are some of the hardest requests an organisation handles. They often arrive during a dispute, they can cover years of emails and they nearly always involve other members of staff. This guide explains what UK employers need to provide, by when and what you can lawfully hold back.

Can an employee make a subject access request?

Yes. The right of access applies to anyone whose personal data you hold, and that includes current staff, former staff, job applicants and contractors. A request doesn’t need to use the words “subject access request”. It only needs to be clear that the person is asking for their own personal information.

A request can be made verbally or in writing, including by email, text or social media. It can go to anyone in the organisation, not only HR. The ICO recommends having a designated person, team and email address for SARs, so that line managers know where to send them straight away.

How long do you have to respond?

You must respond without undue delay and at the latest within one month of receiving the request. You can extend this by up to two further months if the request is complex or the person has made several requests. If you extend, you must tell them within the first month and explain why.

If you genuinely need to clarify what the person is asking for, the clock pauses until they reply. Only ask if you hold a large amount of information about them and clarification is reasonably needed. They don’t have to narrow the request. If they won’t, carry out reasonable searches based on what they asked for.

Do you need to verify the employee’s identity?

You need to be satisfied that you know the identity of the person making the request and that the information relates to them. If you have reasonable doubts about their identity, you can ask for information needed to confirm who they are and the one-month deadline begins when the identity or authority in case of (solicitors) has been confirmed. However, employers should not routinely request additional identification where the person’s identity is already clear. Any information requested for identity verification should be reasonable and proportionate.

What does an employee SAR usually cover?

Most employee requests ask for everything. That can include:

• the personnel file, contracts and pay records
• appraisals, absence and sickness records
• disciplinary and grievance records, including meeting notes
• emails, chat messages and documents that mention the person
• CCTV footage, door entry logs and system access records.

You only have to provide the person’s own personal data, not every document they appear in. An email they were copied into isn’t automatically all their personal data. Their name and email address must be disclosed, but the rest depends on whether the content is about them.

How far do you have to search?

UK GDPR now says a person is entitled to what you can provide based on a reasonable and proportionate search. This was added by the Data (Use and Access) Act 2025, with effect back to 1 January 2024. It doesn’t let you skip obvious places. It does mean you can stop short of searches that are disproportionate to the value of the information.

In practice, agree a search plan before you start. Record which systems you searched, which search terms you used and why you decided a search was or wasn’t proportionate. Include business social media accounts if the person’s data is likely to be there. If you’re ever challenged, that record is your evidence.

What about information about other employees?

Employee SARs almost always include information about colleagues, managers and witnesses. You don’t have to disclose information that identifies someone else unless they consent or it’s reasonable to disclose without their consent.

To decide what’s reasonable, think about:

• what kind of information it is and how sensitive it is
• whether it was given in confidence
• whether you have asked the other person for consent, and whether they refused
• the other person’s role and seniority.

Redaction (blacking out the parts that identify someone else) is often the answer. But if the requester could still work out who wrote a witness statement from the context, redacting the name alone won’t be enough. Whistleblowing reports need particular care, because the whistleblower has legal protection too. Our article on SARs involving another person covers this in more detail.

Can you refuse an employee SAR during a dispute?

No, not on that basis alone. The ICO is clear that you can’t refuse a SAR because there is an ongoing grievance, disciplinary or employment tribunal claim. Disclosing documents to the person’s solicitor during proceedings doesn’t replace your SAR response either, because it may not include all their personal data.

A settlement agreement or non-disclosure agreement doesn’t remove the right of access. The ICO says clauses that try to limit it are likely to be unenforceable.

You can refuse a request that is manifestly unfounded or manifestly excessive. The bar is high. A large volume of information isn’t enough on its own, and nor is an aggressive tone. Our guide to when you can refuse a subject access request explains the tests.

Which exemptions are relevant to employers?

Exemptions must be applied case by case, and you must record your reasons. The ones employers use most are:

Confidential references. References given in confidence for employment, training, education or similar purposes can be exempt. Make it clear in your privacy notice or staff handbook whether references are treated as confidential.

Legal professional privilege. Advice from your lawyers about the person’s case.

Management information. Information used for management planning, such as a proposed restructure, where disclosure would prejudice the business.

Negotiations. Records of your intentions in negotiations with the person, such as a settlement. This is only likely to apply while the negotiations are still going on.

These exemptions are not automatic. Whether an exemption applies will depend on the particular information and circumstances, and employers should document their reasoning where information is withheld.

What should your response include?

Your response must include a copy of the personal data and a set of supplementary information, such as the purposes of the processing, who you have shared the data with and how long you keep it. Our guide to how to respond to a subject access request sets out each item your response letter must include.

Never delete or change information after a request arrives to avoid disclosing it. The person is entitled to the data you held when you received the request, allowing for routine changes you would have made anyway.

Frequently asked questions

Can an ex-employee make a subject access request?

Yes. Former employees have the same right of access as current staff, and the same deadlines apply.

Do we need to verify identity of the requestor?

You need to be satisfied that you know the identity of the person making the request. If you have reasonable doubts about their identity, you can ask for information to confirm who they are.

Can I make a subject access request to my employer?

Yes. Ask in writing, ideally by email, and keep a copy. Say clearly that you want a copy of your personal data. Your employer must usually respond within one month.

Do we have to send every email that mentions the employee?

No. You must provide the person’s personal data found by a reasonable and proportionate search. Emails that only mention them in passing may contain little of their personal data, and other people’s information may need redacting.

Can we charge a fee?

Usually not. You can charge a reasonable fee for further copies, or for a request that is manifestly unfounded or excessive.

Can we ask an employee to narrow their SAR?

You can ask for clarification where you hold a large amount of information about the person and it is not clear what information they are requesting.

Get help with employee SARs

Employee SARs take time and judgement, especially when they arrive mid-dispute. Our SAR Support team can search, review and redact records for you, or advise your team on a difficult request. For the basics, start with what is a subject access request. Tell us about your request and a qualified consultant will respond within two working hours.

Speak to an Expert

Sources

• ICO: Subject access request Q and As for employers
• ICO: A guide to subject access
• UK GDPR: Article 15

FCA AML Supervision And Client Data In Law And Accountancy Firms

The FCA’s takeover of anti-money laundering (AML) supervision for law firms, accountants and trust and company service providers is primarily a story in financial regulation, but there are important data protection elements which are important to bear in mind.

AML supervision runs on personal data – client due diligence files, source of funds evidence, suspicion reports and risk assessments – much of it relating to alleged or suspected criminal conduct. Changing who supervises that work, and how, changes where that data goes, who sees it and what it is used for.

In this post we look at what is changing, the data protection questions it raises, and the practical steps firms can take ahead of the transition.

What is changing

The FCA will become the single AML supervisor for legal, accountancy and trust and company service providers. Today that work is split between HMRC and around 22 professional body supervisors, such as the SRA and ICAEW.

The Government estimates that around 60,000 businesses and sole practitioners will move across. The FCA expects a phased transition to start in autumn 2028 and finish around 2030. The reform depends on new legislation, which the Government refers to as the Financial Services Bill, together with secondary legislation including amendments to the Money Laundering Regulations, following its June 2026 consultation response.

The FCA has said that it intends to integrate legal and accountancy information and intelligence into its supervisory approach. It has also discussed the potential use of agentic technology in supervision. The eventual operating model, including the scale of information requests and the extent to which AI will inform supervisory activity, remains under development.

More data in one place

The biggest data protection shift is aggregation. Information that is currently distributed among 22 professional body supervisors and HMRC will increasingly flow into one regulator with extensive existing data and intelligence capabilities.

Much of what firms hand over may be criminal offence data under Article 10 UK GDPR, which can cover allegations and suspicions as well as convictions. A firm disclosing such data to the FCA will need an Article 6 lawful basis and, unless the processing is under the control of official authority, an applicable condition in Schedule 1 to the DPA 2018. The appropriate basis and condition will depend on the legal requirement, purpose and circumstances of the disclosure. Firms should document that analysis and maintain an appropriate policy document where the chosen condition requires one.

Transparency matters too. Firms whose privacy notices identify their current professional body, or describe recipients too narrowly, may need to update them to cover disclosure to the FCA for AML supervision. The notice should also explain the purposes of the sharing and, where required by the transparency rules, provide meaningful information about any relevant further use or combination with wider intelligence.

Firms should also keep an eye on the information-sharing provisions in the Economic Crime and Corporate Transparency Act 2023. They remove some civil liability barriers to sharing for economic crime purposes, but they do not displace data protection law. Any sharing still needs a lawful basis, a condition for criminal offence data and proportionate scope.

Agentic supervision and AI risk scoring

The FCA’s interest in agentic supervision deserves attention from a data protection angle. Risk-scoring a large company is one thing. Many of the 60,000 newly supervised entities are sole practitioners and small partnerships, where scoring “the firm” is in practice profiling identifiable people.

If risk scoring contributes to a decision about an identifiable sole practitioner or partner, the UK GDPR rules on profiling and automated decision-making may be relevant. The specific safeguards for significant automated decisions apply where a decision is based solely on automated processing and produces legal or similarly significant effects. Following the Data (Use and Access) Act 2025, a broader range of Article 6 lawful bases may support such decisions, but safeguards remain necessary. The position is more restrictive where special category data is involved.

Of course, we would expect the FCA to carry out data protection impact assessments for these tools and to be open about how they are used. Firms will reasonably want to know whether a supervisory visit, information request or enforcement referral was prompted by an algorithm, and what data went into it.

There is a mirror-image point for firms themselves. Many use automated screening and AI tools for client due diligence. A more data-literate supervisor is likely to ask how those tools work, so firms should make sure their own DPIAs and documentation are up to date.

Retention, minimisation and MLR regulation 41

The MLRs already contain their own data protection rules, and they are easy to overlook. Regulation 41 says personal data obtained for AML purposes may only be processed to prevent money laundering and terrorist financing, unless another law permits wider use or the client consents. Firms must also give new clients specific information about that processing.

Regulation 40 sets the retention rule: CDD records are generally kept for five years after the business relationship ends, then deleted unless an exception applies. In our experience, many firms keep AML records longer, often on a “just in case” basis or because they sit inside matter files with longer retention.

A more evidence-focused supervisor will add pressure in both directions. Firms will want to hold enough to show the FCA their controls work. They also need to resist reusing AML data for marketing, credit decisions or general client profiling, and to delete it on time. Now is a good moment to check that retention schedules and systems actually separate AML records from everything else.

Privilege, subject access and tipping off

The Government has confirmed that legal professional privilege will continue to be protected, so the FCA will not be able to compel privileged material. Some campaigners argue for a narrow exception, so this is worth watching as the Bill progresses.

For law firm DPOs, privilege already intersects with data protection through subject access. The LPP exemption in Schedule 2, Part 4, paragraph 19 DPA 2018 lets firms withhold privileged material in response to a subject access request.

The harder cases involve suspicion. A client under internal review, or the subject of a suspicious activity report, may make a subject access request. Disclosing that information could amount to tipping off under the Proceeds of Crime Act 2002. Firms can usually rely on the crime and taxation exemption in Schedule 2, paragraph 2, but only to the extent disclosure would be likely to prejudice the prevention or detection of crime.

That test needs applying case by case and documenting. Under FCA supervision, firms should expect their records of these decisions to be reviewed more closely. Joined-up procedures between the MLRO and whoever handles subject access requests are essential.

The handover

Moving 60,000 entities from more than 20 supervisors to one is, among other things, a very large data migration. Supervisory files, inspection findings, intelligence and enforcement histories will need to move between controllers.

That raises familiar questions: what is transferred and on what legal basis, whether inherited records are accurate and up to date, and how long the outgoing bodies keep their copies. Firms are entitled to understand what the FCA will receive about them. Sole practitioners and individual partners in particular may want to check, using their access rights, what their current supervisor holds.

The Government has proposed that the FCA should register in-scope firms and have appropriate gatekeeping powers. The final form and public accessibility of any register remain subject to legislation and implementation decisions. If information about sole practitioners is published, that information will be personal data and should be limited to what is necessary for the register’s purpose.

What firms should do now

None of this changes your obligations today, and the detail is still being settled. But the data protection groundwork is worth doing now, because it also strengthens your AML position.

Map your AML data. Know what you collect for CDD, where it sits and who can access it, and record it in your ROPA.

Review privacy notices. Make sure they cover the MLR regulation 41 information and are ready to name the FCA as a recipient.

Check your Schedule 1 conditions. Confirm which conditions you rely on for criminal offence data, and that your appropriate policy document is current.

Test retention. Check that AML records are deleted on time and kept separate from matter files with longer retention.

Join up subject access and the MLRO. Agree how requests touching on suspicion are handled, and document each use of the crime exemption.

Revisit DPIAs for screening tools. Cover any automated or AI-driven CDD and monitoring tools, including how decisions are reviewed by a person.

Prepare for information requests. Have a process for responding to FCA requests that discloses what is required, and no more.

Final thoughts

The move to FCA supervision is meant to make AML oversight more consistent and more intelligence-led. Done well, that is good for everyone. But more intelligence means more personal data, held centrally and analysed in new ways, and data protection needs to be part of the design rather than an afterthought.

Firms that get their AML data in order now will find both the transition and their data protection compliance easier.

If you would like help reviewing your AML data processing, privacy notices or DPIAs ahead of the transition, get in touch with our team at Data Protection People.

Sources

FCA: Anti-money laundering supervisory reform

Money Marketing: FCA to take AML supervision of 60,000 legal and accounting firms

TLT: FCA AML supervision reform: what law firms, accountants and TCSPs need to do now

Spotlight on Corruption: Government sets out its plan for making the FCA the super-regulator for money laundering

Patient Data in Dentistry

Are we treating our patients’ information with the same care we expect to give the patients themselves?

A patient books an appointment online and provides their contact details. They complete a medical history form when they attend the practice. During treatment, the dentist updates their clinical notes and may take an X-ray or photograph. Information might then need to be shared with a dental laboratory, specialist or another healthcare professional.

All of this involves the use of personal data.

Dental practices hold a wide range of information about their patients, from names, addresses and telephone numbers to medical histories, medication information, treatment notes, X-rays and clinical photographs. Information relating to a person’s health is classed as special category data under the UK GDPR and requires additional protection because of its sensitive nature.

Protecting patient information is therefore about much more than keeping the clinical record secure. Practices also need to think about how information is handled during everyday activities, who can access it, where it is stored and what happens when it needs to be shared outside the practice.

The reception desk is part of data protection too

Privacy risks can arise before a patient even enters the treatment room.

Reception areas are busy environments. Staff answer telephone calls, confirm patient details, discuss appointments and communicate with clinicians while other patients may be waiting nearby.

Something as ordinary as discussing a patient’s treatment loudly at reception, leaving a computer screen visible or placing paperwork where others can see it can create a confidentiality issue.

The solution does not have to make reception impractical. Instead, practices should consider privacy when deciding how everyday tasks are carried out.

Computer screens can be positioned away from public view, records should not be left unattended and conversations involving sensitive information should be handled discreetly. Staff should also understand when a discussion needs to take place somewhere more private.

These relatively simple measures can make a meaningful difference to patient confidentiality.

Who can see the patient record?

A dental practice may have dentists, dental nurses, hygienists, therapists, receptionists, practice managers and temporary staff all using the same systems.

That does not necessarily mean everybody should have the same level of access.

Access to personal data should be appropriate to a person’s role and limited to the information they need to carry out their work. Practices should therefore consider whether the permissions within their patient management and other systems properly reflect the responsibilities of different members of staff.

Individual user accounts should also be used where possible rather than shared logins. Apart from improving security, individual accounts can help establish who has accessed or changed information if an issue later needs to be investigated.

Access should also be reviewed when somebody changes role or leaves the practice. Accounts belonging to former members of staff should not remain active unnecessarily.

It is worth remembering that a confidentiality incident does not always involve patient information being sent outside the practice. If a member of staff accesses a patient’s record without a legitimate reason, this can itself raise data protection and confidentiality concerns.

Where do clinical photographs actually end up?

Photographs and digital images are now a routine part of dentistry. They may be used to record a patient’s condition, monitor the progress of treatment, support a referral or communicate with a dental laboratory.

The increased use of mobile phones and tablets makes taking and sharing images much easier, but it can also introduce risks that practices may not immediately consider.

If a device is used to take a clinical photograph, the practice should know where that image is being stored. For example, is it being saved to the device’s photo library? Is that library automatically synchronised with a personal cloud account? Does a copy remain on the device after the photograph has been transferred to the patient’s record?

Practices should have clear procedures covering which devices and applications can be used for clinical photography, how images are transferred and stored, and when copies should be deleted from the original device.

There is also a difference between using a photograph as part of a patient’s clinical care and using the same image for another purpose.

A practice may, for example, want to use before and after photographs on its website, social media pages or other promotional material. An image being available within the patient’s clinical record does not automatically mean it can be used for these purposes.

Where photographs are going to be used beyond the patient’s care, the practice should carefully consider the intended use, what the patient has been told and whether appropriate consent has been obtained and recorded.

Sharing information outside the practice

Dental practices do not work in isolation. Patient information may need to be shared with dental laboratories, specialists, referral centres, NHS bodies and other organisations involved in a patient’s care.

Practices may also use external companies to provide IT systems, cloud services, appointment platforms and other services that involve the processing of personal data.

Before information is shared, it is important to consider what the recipient actually needs.

For example, a dental laboratory may require information to produce an appliance or complete a particular piece of work, but this does not necessarily mean it needs access to the patient’s full clinical history. Sharing only the information that is required helps practices comply with the data minimisation principle and reduces the amount of information exposed if something goes wrong.

How the information is shared should also be considered. Sending information to the correct person does not remove the need to use an appropriate and secure method of communication.

Practices should therefore understand which external organisations have access to patient information, why they receive it and what arrangements are in place to protect that information.

Technology has changed the risk for dental practices

Dental practices increasingly depend on technology.

Appointment systems, digital radiography, cloud-based patient management platforms, online forms and electronic communications can improve efficiency, but they also increase the consequences of poor cyber security.

A compromised email account could expose patient correspondence. Stolen login credentials could provide access to clinical records. Ransomware could prevent staff from accessing information required to provide care.

Cyber security and data protection therefore overlap considerably in a dental environment.

Measures such as multi-factor authentication, secure backups, appropriate encryption, software updates and sensible access controls can reduce these risks. Staff awareness is equally important because phishing emails and other forms of social engineering frequently target people rather than technology.

Practices should also know what to do when something goes wrong.

A personal data breach might involve a cyberattack, but it could equally involve sending an X-ray to the wrong patient, losing paperwork or accidentally disclosing patient information in an email.

The first priority should be to contain and assess the incident. Where a breach is likely to result in a risk to people’s rights and freedoms, notification to the Information Commissioner’s Office is required without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Retaining and Disposing of information

Dental practices have legitimate reasons for retaining patient records, including clinical, professional and legal requirements. However, this does not mean that every piece of personal information should automatically be kept forever.

Practices should understand what information they hold and have a clear approach to how long different types of records need to be retained, taking account of relevant legal and professional requirements.

It is also important to think beyond the main patient management system. Copies of personal data may exist in emails, scanned documents, photographs, archived files, backups and systems operated by third-party providers.

A documented retention schedule can help a practice take a consistent approach and avoid information simply being retained because nobody has decided when it should be deleted.

When information is no longer required, it should be disposed of securely. This applies to paper records as well as electronic information and devices. The method used should make it appropriately difficult for personal data to be recovered by somebody who is not authorised to access it.

Would your team recognise a patient’s data rights request?

Patients have rights over their personal information, and one of the most familiar in a dental setting is the right of access.

The difficulty is that a request does not have to contain the words “subject access request” to be valid.

A patient may simply ask for the information the practice holds about them or request a copy of their records.

Front line staff therefore need to recognise when an ordinary looking enquiry may actually be an exercise of a data protection right and know who within the practice should deal with it.

Responding may also require more than exporting information from the clinical system. Relevant personal data could exist within emails, correspondence, photographs or other locations.

Requests involving children, representatives or information relating to other individuals can introduce further considerations.

Having an established process before a request arrives can prevent unnecessary delay and reduce the risk of inconsistent responses.

What should dental practices take away from this?

The challenge for dental practices is not simply that they hold sensitive information. It is that the information is continually being used.

It moves between reception and the treatment room, between different members of the dental team, between systems and devices and, where necessary, outside the practice.

That makes good data protection a practical issue rather than a paperwork exercise.

Practices should be able to answer some relatively straightforward questions:

• What personal information do we hold
• Where is it stored
• Who can access it
• Which external organisations receive it
• How is it protected
• How long do we keep it
• What would we do if it were lost, accessed inappropriately or sent to the wrong person

If those questions are difficult to answer, there may be gaps worth addressing.

How can Data Protection People support dental practices?

Data protection requirements can sometimes appear disconnected from the realities of running a busy dental practice. Our role is to make them practical.

Data Protection People can work with dental practices to understand how information is actually being handled and identify proportionate improvements.

This might involve reviewing patient data flows and access arrangements, assessing risks around clinical photography and third-party sharing, reviewing privacy information and supplier agreements, establishing retention schedules, improving breach response procedures or supporting the handling of data subject rights requests.

We can also provide training tailored to the situations dental teams encounter in practice, helping staff understand not only what the rules require but how those requirements apply to their everyday roles.

Facial Recognition Payments and DPIAs: Lessons From Revolut’s Pay With Smile Trial

You order a coffee, look at the payment terminal and the purchase is complete: it is easy to see the appeal. But before offering that convenience, an organisation needs to understand what happens to the face used to authorise the payment.

Revolut’s Pay with Smile trial brings that question to an everyday purchase: it is a useful example of why changing how customers pay can introduce a very different use of their personal information.

For organisations considering biometric payments, a Data Protection Impact Assessment (DPIA) should inform the design before launch.

Revolut’s Facial Recognition Payment Trial

On 24 September 2026, Revolut announced a Pay with Smile pilot at selected Kiss the Hippo cafés in London. The announced trial ran from 24 to 26 September.

According to Revolut, enrolled customers could authenticate payments through its Revolut Register using facial recognition. Its announcement described checking customers against the selfie ID checks completed when they joined Revolut. Customers opted into the feature through its app. Revolut’s announcement.

For a customer, the purpose is straightforward: paying for a purchase but for a data protection team, the underlying processing needs closer examination.

Introducing a different way to authenticate a transaction may change the information collected, the organisations involved and the potential consequences for individuals.

Photographs and Biometric Recognition Are Not the Same Thing

An ordinary photograph is not automatically special category biometric data.

The distinction depends on the technical processing and its purpose. Where facial information is technically processed to uniquely identify someone, it constitutes special category biometric data.

This includes verification, checking that someone is who they claim to be, as well as identification, establishing who they are. Describing a product as an “authentication tool” does not remove the need to understand its biometric functions. ICO guidance on biometric recognition.

For privacy professionals, this means looking beyond the procurement description. A payment terminal proposal may also involve cameras, biometric references, remote processing and additional records.

DPIAs Belong Before Deployment

Article 35 UK GDPR requires a DPIA before processing likely to result in high risk to people’s rights and freedoms. The ICO says organisations must complete one before using a biometric recognition system, explaining that this processing is highly likely to trigger the requirement. The same guidance emphasises privacy by design, including consideration of less intrusive alternatives. ICO guidance on biometric accountability.

The practical lesson is to involve privacy colleagues while the project can still change. Waiting until equipment has been purchased and a launch date announced limits the assessment’s usefulness.

A DPIA should explain the processing, assess necessity and proportionality, identify risks to individuals and set out measures to address them. A persuasive commercial case does not, by itself, establish that the processing is lawful.

Necessity and Proportionality Need Evidence

A useful assessment begins with the problem, not the preferred technology.

Shorter queues, improved accessibility and fraud prevention are different objectives. Each needs an explanation of how the proposed system helps and what alternatives are available.

For a biometric payment proposal, a project owner should explain the benefit compared with cards, phones or other authentication methods. The comparison should address privacy impacts as well as operational advantages.

This does not mean biometrics are automatically disproportionate. It means the organisation should be able to justify its choice.

For day-to-day work, request a short written business case before reviewing lengthy supplier documentation. It provides a clear reference point for assessing whether each proposed use of information is necessary.

Reusing Onboarding Data Needs Its Own Assessment

The reference to existing selfie ID checks raises an important question for any similar project: what permits information collected for account opening to be used for payments at a café? Already holding an image does not establish permission for a new use. Assess purpose limitation, the legal basis for the proposed processing and what customers have been told.

Also establish how the system finds the right account. Comparing a face with one specified reference is different from searching across a gallery of enrolled users. Both can involve special category biometric data, but the data flows, false-match risks and safeguards may differ. Do not infer the architecture from the word “authentication”.

Map Information Across Its Full Lifecycle

Avoid treating all facial information as one category with one retention period.

Revolut says temporary checkout facial embeddings are deleted after matching, while images and other records have separate retention arrangements.

Its notice distinguishes freezing the feature, which retains data, from withdrawing consent, which triggers deletion of the relevant biometric template.

Those statements do not establish that all related information disappears on withdrawal. They are published descriptions, not independently verified findings. Pay with Smile privacy notice.

For a proposed deployment, request a record of:

• Enrolment images and reference templates.
• Transaction photographs and temporary matching data.
• Payment, device and diagnostic records.
• Fraud investigation and dispute information.
• Supplier copies, backups and deletion arrangements.

For each category, establish its purpose, location, access permissions and retention period.

Where withdrawal ends consent-based processing, stop that processing. Retention for another purpose needs its own justification, a defined period or meaningful criteria, and an Article 9 condition if the retained use remains special category processing. Do not quietly switch legal basis to continue the same activity after consent is withdrawn.

A statement that information is deleted “immediately” is only useful when it identifies exactly which information it covers.

Lawful Basis and Special Category Conditions Need Separate Attention

Biometric recognition requires an Article 6 lawful basis and an Article 9 condition for special category processing.

A legitimate interests assessment does not replace an Article 9 condition. A contractual relationship also does not automatically justify every use of biometric information.

The ICO explains that explicit consent is often the most appropriate special category condition for biometric recognition. If another condition is proposed, check every requirement, including any applicable DPA 2018 Schedule 1 safeguards. ICO guidance on lawful biometric processing.

Our practical recommendation is to document the legal position purpose by purpose. Separate identity matching from fraud investigation, diagnostics and any proposed secondary use.

This helps expose assumptions that permission for one activity also covers another.

Customer Choice Must Work in Practice

Consent must be freely given, specific, informed and demonstrable. Explicit consent needs an express statement of agreement; merely looking at a camera does not establish it. Withdrawal must be as easy as giving consent. ICO guidance on lawful biometric processing.

Any discounts or loyalty rewards also deserve attention. An incentive does not automatically invalidate consent, but assess its value and context, whether refusal unfairly disadvantages people and whether a suitable non-biometric option remains available. Record that assessment rather than assuming that an opt-in button settles the question.

Test the actual customer journey rather than reviewing the consent wording alone.

Can someone decline at a busy checkout? Do staff understand the alternative? Can a customer distinguish pausing a feature from withdrawing consent?

Privacy information must also be clear and accessible at the appropriate time. The ICO recommends considering how people interact with the technology when deciding how to explain the processing. ICO guidance on biometric transparency.

A short explanation at the terminal, supported by fuller information elsewhere, may be more useful than relying on a lengthy notice alone.

The Camera Also Needs Boundaries

Check when image capture starts, what the camera can see and whether anyone else enters the frame. A person in the queue has not consented simply by standing near the terminal. Minimise incidental capture and separately assess any processing of bystanders or customers who have not enrolled. A sign explains processing; it does not supply consent.

Set limits on future uses too: payment authentication should not quietly become customer tracking, marketing profiling or model training. Each proposed additional use needs a fresh assessment of purpose, lawfulness and transparency, and fresh consent where required.

Accuracy and Fairness Require Real-World Testing

Biometric matching is probabilistic. A system may incorrectly accept someone or fail to recognise the correct person.

The consequences depend on the setting, the system’s configuration and the safeguards available. The ICO advises examining real-world performance, potential discrimination and the effects of matching errors. ICO guidance on fair biometric processing.

Ask for false acceptance and false rejection rates at the intended operating threshold, with evidence for the expected users and conditions. A claim of “99% accuracy” tells you little without its test conditions. Assess who might be wrongly charged, repeatedly rejected or embarrassed at the till, and how they obtain help.

Revolut describes alternative payment options after unsuccessful matches and a support route for contesting rejection and seeking human review. Pay with Smile privacy notice.

These published arrangements illustrate why fallback processes belong in the assessment alongside technical performance.

Security Requires More Than an Encryption Statement

Privacy and security teams should examine access controls, key management, template protection, retention and incident handling.

The ICO recommends considering protections that make templates harder to reverse engineer or link across different databases. It also stresses regular testing and appropriate organisational controls. ICO guidance on biometric security.

Test attacks using photographs, video or other impersonation methods, as well as the process for investigating and correcting an incorrect charge. Ask whether a compromised template can be revoked and replaced. Encryption alone does not answer these questions.

Our recommendation is to distinguish supplier assurances from supporting evidence. Record unanswered questions and assign an owner to resolve them.

Similarly, “not stored on the terminal” does not establish that information is absent from remote systems, support tools or backups.

Establish Responsibilities and Operational Readiness

Do not assume every supplier is a processor. Establish which organisation determines the purposes and means of each processing activity, and document the resulting responsibilities. ICO guidance on biometric accountability.

The contracts should reflect those roles, including Article 28 terms for processors or Article 26 arrangements where organisations are joint controllers. Identify hosting locations, subprocessors and overseas access, and address restricted international transfers where applicable.

Privacy professionals also need workable arrangements for access requests, complaints and withdrawal.

The ICO explains that biometric rights requests may involve samples, templates and technical formats. Organisations need processes to recognise requests and respond appropriately. ICO guidance on biometric rights requests.

Before launch, test who obtains supplier-held records, who handles complaints and how deletion instructions are verified.

Assess automated decisions separately under the current UK GDPR framework. The additional rules concern solely automated decisions with legal or similarly significant effects, with stricter conditions for decisions based on special category data. Consider the actual effect of payment approval or rejection and the available alternatives; not every failed match meets that threshold.

Pilots Still Need a Documented Launch Decision

A short trial involves real people and real information. Calling a project a pilot does not automatically exempt it from DPIA requirements.

Before launch, agree who can authorise the trial, what must be resolved first and what would make it stop. Examples include an incorrect charge, repeated failures affecting a group of users, or deletion not working as promised. Assign owners and set a review date.

Seek the DPO’s advice where one is appointed. The controller remains accountable for the processing. Where high risk remains that cannot be sufficiently reduced, prior consultation with the ICO is required before processing begins. ICO DPIA guidance.

Where appropriate, seek the views of affected people or their representatives as part of the DPIA. Feedback from people who decline biometric payments can be as useful as feedback from enthusiastic participants.

Keep the assessment under review. Expansion to new locations, changes to suppliers or additional purposes may alter its conclusions.

The Practical Lesson for Privacy Professionals

A good assessment should let the project team answer an ordinary customer’s questions: who gets my image, why do you need it, what happens if the system gets it wrong, and what remains when I stop using it?

If those answers depend on assumptions or unanswered supplier questions, there is more work to do before launch.

The most useful DPIA changes decisions while there is still time to change the system.

FAQs

Do Facial Recognition Payments Need a DPIA?

The legal requirement applies where processing is likely to result in high risk to people’s rights and freedoms. The ICO’s biometric guidance tells organisations to complete a DPIA before using biometric recognition and explains why these systems are highly likely to trigger the requirement.

Is Every Photograph Special Category Data?

No. An ordinary photograph is not automatically special category biometric data. The technical processing and its purpose matter. Using biometric information to uniquely identify someone, including verification, brings it within special category processing.

Does Explicit Consent Replace a DPIA?

No. Consent and a DPIA address different obligations. Consent does not remove a required assessment or make otherwise unlawful processing acceptable.

Can an Organisation Rely Entirely on a Supplier’s DPIA?

Not automatically. Supplier evidence can support an assessment, but the organisation must address its actual use, responsibilities and operating environment.

Does Deleting a Facial Template Mean All Related Information Is Gone?

No. Photographs, enrolment references, logs and transaction records may have separate retention arrangements. Establish exactly what is deleted and what remains.

Are Small or Temporary Trials Exempt?

There is no automatic exemption simply because processing takes place during a pilot. The proposed processing and likely risks determine the requirements.

Does Every DPIA Need ICO Approval?

No. Organisations do not routinely submit every assessment. Prior consultation is required where high risk remains that cannot be sufficiently reduced before processing.

Practical DPIA Support

Assessing new technology can involve incomplete supplier information, technical detail and competing delivery priorities.

Data Protection People offers DPIA support to help organisations assess proposed processing and identify practical next steps.

Contact our team to discuss your project.

Sources

• Revolut announcement
• Pay with Smile privacy notice
• ICO biometric recognition guidance
• ICO valid consent guidance
• DUAA automated decisions amendments

S2 Ep38: AI Systems and DPIAs

S2 Ep38: AI Systems and DPIAs

Can AI help you write a Data Protection Impact Assessment? And how do you assess the privacy risks of the AI system itself?

In S2 Ep38 of Data Protection Made Easy, Caine Glancy and Catarina Santos (Cate) explore both sides of the conversation: carrying out DPIAs for AI projects and using AI to help prepare an assessment.

What We Discuss

• Understanding how an AI system uses personal data, including its inputs, outputs and who can access them.
• Asking practical questions about suppliers, retention and where information goes.
• Using AI to organise information, suggest questions and identify gaps in a DPIA.
• Why project-specific information and human review remain important.
• Setting clear boundaries for how staff use AI tools.

Join Cate and Caine for a practical discussion about making informed decisions, checking assumptions and keeping people involved in the assessment process.

Watch or Listen to the Episode

Watch the Full Episode on YouTube

Listen to the Full Episode on Spotify

Join Our Community

Our free Friday sessions bring people together to discuss data protection topics, share practical advice and ask questions.

Explore Upcoming Sessions

Need Support With Your DPIA?

Our DPIA service helps you identify and assess privacy risks in new projects, systems or processes. We work with your team to document the assessment and recommend practical measures to reduce risks and support informed decisions.

Contact Data Protection People

S2 Ep37: Sector Spotlight Ep1: Caught Between the FCA and UK GDPR – What DPOs Need to Know

Sector Spotlight Ep1: Caught Between the FCA and UK GDPR – What DPOs Need to Know

Financial services businesses face overlapping responsibilities. How do they bring financial regulation and data protection together in practice?

In the first episode of Sector Spotlight, DPP’s Mark Farrell joins Phillip Garlick, CEO of Product Partnerships Limited (PPL), to discuss the relationship between FCA requirements and UK GDPR.

Created as part of the partnership between Data Protection People and PPL, this episode brings together perspectives on data protection, retail finance and the practical realities of running a regulated business.

Explore the Conversation

Our promotional clips explore financial promotions, whether good compliance can support business growth, the cost of compliance in the financial sector, and AI’s promise and peril in data protection.

Watch or listen to the full episode to hear the wider conversation with Mark and Phillip.

Meet Phillip Garlick

Phillip is the CEO of Product Partnerships Limited, which delivers retail financial solutions and compliance support to consumer-facing businesses. PPL helps these firms offer finance to their customers and manage the regulatory responsibilities that come with it.

He has over 30 years’ experience in regulated, consumer-facing sectors, with a strong focus on governance, risk management and sustainable growth.

Phillip is a practising Chartered Director and Fellow of the Institute of Directors. He holds an Advanced Certificate in Governance & Risk from the International Compliance Association and an MBA from Leeds University.

About Sector Spotlight

Sector Spotlight is a separate series within Data Protection Made Easy, exploring data protection through conversations focused on particular sectors. This is episode 1 of the series, rather than an episode in our regular Season 2 numbering.

Watch or Listen to the Episode

Watch the Full Episode on YouTube

Listen to the Full Episode on Spotify

Need Data Protection Support?

If your organisation needs help navigating its data protection responsibilities, speak to our team about the support available.

Contact Data Protection People

S2 Ep36: GDPR Radio – Data Protection News of the Week

S2 Ep36: GDPR Radio – Data Protection News of the Week

Cate and Caine are back together on GDPR Radio, and Cate marks the occasion with a little singing before the conversation gets underway.

In S2 Ep36 of Data Protection Made Easy, Caine Glancy and Catarina Santos catch up on data protection news and share practical perspectives on what it means for organisations.

Expect a friendly discussion, familiar faces and plenty of conversation about the world of data protection.

Watch or Listen to the Episode

Watch the Full Episode on YouTube

Listen to the Full Episode on Spotify

Join Our Community

Our free Friday sessions bring people together to discuss data protection topics, share practical advice and ask questions.

Explore Upcoming Sessions

Need Data Protection Support?

If your organisation needs help with a data protection question or challenge, speak to our team about the support available.

Contact Data Protection People

S2 Ep35: AI Redaction Tools: The Mistakes Most SAR Systems Miss

S2 Ep35: AI Redaction Tools: The Mistakes Most SAR Systems Miss

AI redaction tools promise to make handling subject access requests easier. But what might they miss?

In S2 Ep35 of Data Protection Made Easy, Amber Sivill and Katerina Douni discuss AI redaction tools and the challenges organisations face when using them to support SAR responses.

Join them for a practical conversation about technology, redaction and the importance of checking information before it is shared.

Watch or Listen to the Episode

Watch the Full Episode on YouTube

Listen to the Full Episode on Spotify

Join Our Community

Our free Friday sessions bring people together to discuss data protection topics, share practical advice and ask questions.

Explore Upcoming Sessions

Need Support With Subject Access Requests?

If your organisation needs help managing subject access requests or reviewing its redaction process, speak to our team about the support available.

Contact Data Protection People