The pitch is "nobody can punch for a friend". That is true, and it is the only problem face recognition solves. Here is what it costs in accuracy, consent and liability, and when the simpler method is the better one.
Face-recognition attendance replaces a card, fingerprint or tap with a camera match against a stored facial template, on a wall device or the employee's phone. It removes buddy punching and touchless entry suits shared premises — the two genuine advantages. Against them: match failure rates that rise with lighting, angle, masks, glasses and ageing; spoofing with photos unless liveness detection is good; a facial template that is biometric personal data, which under the DPDP framework demands tighter safeguards, specific notice and — because monitoring and biometrics sit outside plain "employment purposes" in most readings — consent; and a breach that cannot be remedied by issuing a new password. For most teams under 200, the attendance question is "was this person at the place they were meant to be, when they said?" and a geolocated self check-in on the employee's own phone answers it without storing anyone's face. Facts checked 14 October 2026.
Buddy punching — one employee marking another present — is the only attendance fraud a face match prevents that a phone-based check-in does not. It does not tell you the person worked, stayed, or was productive; it does not fix late-mark disputes; it does not make the attendance-to-payroll flow any cleaner. Before buying, measure the problem: how many proxy punches a month do you believe happen, and what do they cost in paid hours? For a 40-person office the honest answer is usually "a few" and "less than the device".
Where it earns its place: large shared-floor operations, shift-based sites with high churn, and premises where touchless entry is a hygiene or security requirement. Those are not most small businesses.
Whatever method you use, the regularisation process is what handles the failures — and it has to exist for face recognition more often, not less.
A facial template is personal data, and biometric data is treated as sensitive in practice and in most of the legal commentary on the DPDP Act. Processing employee data "for the purposes of employment" is a legitimate use that does not need consent — attendance in general qualifies. Biometric capture and continuous camera-based monitoring are widely read as going beyond that purpose, which puts them on a consent footing: a specific, informed, freely given, withdrawable consent, with a privacy notice stating what is collected, why, how long it is kept, and how to withdraw. Freely given means an alternative must exist for those who decline. From 13 May 2027 the substantive DPDP obligations — safeguards, breach notification within 72 hours, retention limits — apply in full; see what DPDP requires of employers.
Practical consequences: delete templates on exit (and prove it); keep them encrypted and access-logged; contract the vendor as a processor; never let the templates leave the attendance purpose. A breached password is reset; a breached face is not.
Attendance has to establish three facts: who, when, where. A check-in from the employee's own authenticated phone establishes who (their login), when (server time, not device time) and where (device location at the moment of the tap, reverse-geocoded to a place name, within a radius of the office or client site). It stores no biometric, requires no device at the door, works for hybrid and field teams alike, and the exception path is a regularisation request with an approver and an audit trail. Compared in detail in biometric vs GPS vs manual.
If proxy punching is a real, costed problem, add a random photo prompt at check-in that is kept for seven days and never used to build a template — that catches the behaviour without creating the biometric liability.
| Solves | Proxy (buddy) punching; touchless entry |
|---|---|
| Does not solve | Late-mark disputes, hours worked, attendance-to-payroll flow |
| Accuracy risks | Lighting, masks, glasses, ageing enrolments, twins, spoofing; uneven accuracy across groups |
| Legal basis | Biometric capture generally needs consent and a specific notice under DPDP; employment purposes alone are not enough in most readings |
| DPDP obligations in force | 13 May 2027: safeguards, 72-hour breach notification, retention limits |
| Must offer | An alternative method for employees who decline |
| Alternative | Geolocated, server-timed self check-in on the employee's own device plus regularisation |
It is not prohibited, but a facial template is biometric personal data. Under the DPDP Act and Rules, biometric capture is widely read as going beyond ordinary 'employment purposes', so it should rest on specific, informed consent with a privacy notice, an alternative for those who decline, strong safeguards, defined retention and deletion on exit. The substantive obligations apply in full from 13 May 2027.
In most legal readings, yes, because biometric monitoring is not covered by the employment-purposes legitimate use. Consent must be freely given, which means an employee who declines must have another way to mark attendance without penalty.
Vendor figures are usually measured in controlled conditions. At a real entrance, false rejects rise with backlighting, masks, glasses, head coverings and ageing enrolment photos, and spoofing is possible where liveness detection is weak. Ask for rates measured at a site like yours and for the process when a match fails.
A check-in from the employee's own authenticated phone, timestamped by the server and geolocated at the moment of the tap, verified against the office or site radius, with a regularisation process for exceptions. It establishes who, when and where without storing biometric data, and it works for office, hybrid and field teams.
Yes — that is the one attendance fraud it prevents that a phone check-in does not. Before buying, estimate how often proxy punching happens and what it costs; for most offices under 200 people it is smaller than the cost and the liability of the system.
It should be deleted promptly on exit, with the vendor able to confirm deletion, and the retention period stated in the privacy notice from the start. Retaining biometric templates of ex-employees has no employment purpose and is the kind of data that cannot be made safe again after a breach.
Merik's attendance is the alternative described above. Employees check in and out from their own login on their own phone; the time is set by the server, and the location at the moment of the tap is captured and reverse-geocoded to a readable place name. Late marks and half-days apply by your configured rules, corrections go through a regularisation request with an approver and an audit trail, and the day's record flows into payroll without re-typing. Location is not tracked between punches and no face, fingerprint or other biometric is collected or stored.
Merik does not do face recognition and does not integrate with biometric wall devices. If you need touchless entry for a controlled premises, run it as access control; use Merik for the attendance record payroll depends on. See the attendance module.
Free, set up for you, every module included — see what the free workspace includes
A practical comparison of the three ways to capture attendance.
How to make "present" verifiable without a biometric device per site.
Employment is a legitimate use; safeguards, retention, 72-hour breach notice and vendors are the work.
Request your free company workspace and bring employees, attendance, leave, payroll and tasks together.