Facial recognition for attendance in Portugal: what the law allows and what it does not.

Using an employee’s face to record what time they arrive is legal in Portugal. But it is legal the way driving is legal: within tight rules, and the responsibility for following them lies with whoever is driving. In this case, the employer.

This article walks through those rules one by one. By the end you will know exactly what the law requires of you before installing a biometric terminal in a store, and what we have already prepared for each requirement.

One note before we start: none of this is legal advice for your specific case. It is the general framework, with sources linked to the legislation. For decisions with consequences, talk to someone who can sign an opinion for you.

What Article 18 of the Labour Code says

The Portuguese Labour Code deals with biometric data in an article of its own, Article 18. It says two things that matter:

1. The employer may only process an employee’s biometric data if it is necessary, adequate and proportionate to the objectives pursued. Convenient is not enough. There has to be a concrete purpose that no other means serves equally well.
2. The data may only be kept for as long as necessary for that purpose, and the article uses the word destroyed, not archived. Employee leaves the company, data gets destroyed. And mind the detail that groups with several stores ignore: a transfer to another workplace also triggers destruction.

And the purpose is not left to each company’s judgement. Law 58/2019, which implements the GDPR in Portugal, closes the door in Article 28: processing employees’ biometric data is only considered legitimate for two purposes, attendance control and access control to the premises. Not one more.

The same Article 28 adds a technical condition that eliminates half the systems on the market: only representations of the biometric data may be used, and the collection process must not allow the reversibility of that data. In other words: the system may not store the photograph of your face. It may store a mathematical template from which the photograph cannot be reconstructed.

What the GDPR adds: Article 9, biometric data

The GDPR classifies biometric data used to identify a person as a special category (Article 9). The starting rule is that processing is prohibited. Processing is only admitted under one of the exceptions in paragraph 2, and in the employment context the relevant one is point (b): processing necessary for carrying out obligations in the field of employment law, in so far as national law provides for it. This is where Article 28 of Law 58/2019 comes in: it is that national provision.

Notice what this implies, and what almost everyone ignores: the employee’s consent is not the legal basis. And a good thing too. Consent at work is worth little, because the relationship is unbalanced: an employee who is afraid to say no to the boss is not consenting freely, and the CNPD, the Portuguese data protection authority, has said so often enough. The basis is the law, not the signature.

But beware: the basis being the law does not excuse you from offering an alternative. An employee who does not want biometric enrolment must be able to record attendance by other means, with the card, without any prejudice. Without that real alternative, the proportionality of Article 18 collapses, and the whole system collapses with it.

The GDPR also adds the general obligations that apply to any processing: clear information to the data subject (Articles 13 and 14), minimisation (collect only what is necessary), security (Article 32) and the record of processing activities (Article 30).

The role of the CNPD and the DPIA

The CNPD no longer licenses processing operations: since 2018 the model is accountability. You do not ask for authorisation: you prove you did your homework when they ask you. And the homework, for employee biometrics, has a name: the Data Protection Impact Assessment, the DPIA (Article 35 of the GDPR).

The DPIA is not optional here. CNPD Regulation no. 1/2018 lists the processing operations that require one, and the processing of employees’ biometric data is on it. The assessment has to describe the processing, justify necessity and proportionality, identify the risks to employees and the measures that reduce them. Written before the system goes live, not after.

There is one more party who appears rarely in sales conversations and often in inspections: the workers’ committee, where one exists. Its opinion is written into Article 18 of the Labour Code itself. From that article, prior notification to the CNPD fell away with the GDPR; the committee’s opinion stayed. Ignoring it is one of the cheapest ways to turn a legal installation into a lawsuit.

And there are two principles the CNPD has applied to workplace biometrics for more than twenty years and that survived the change of regime. First: the terminals exist to clock in and for nothing else, so they may not be positioned in a way that monitors people’s movement inside the premises. A reader at the door records attendance; a reader in every corridor records movements, and that is no longer attendance, it is surveillance. Second: the system has to provide an alternative for its own failures, starting with false rejections. A person the machine fails to recognise on a given day must still be able to record their entry, without being stuck at the door or depending on a favour.

None of this is theoretical. In August 2026, the Southern Zone Medical Union took to the CNPD the facial biometric attendance system of Madeira’s Regional Health Service. The arguments are exactly the ones on this page: proportionality against less intrusive alternatives, clarity of the information given to staff, and the demand that no discrepancy detected by the system turns into an absence or a sanction without human validation. The case will run its course; the lesson is already available. Whoever installs without having these answers in writing is letting the first complaint define them.

What this demands of an employer in practice

The list, no beating around the bush. Before the first employee clocks in with their face, you must have:

1. A DPIA written and approved, with the proportionality analysis done for your operation, not copied from a template.
2. Information given to every employee: what data is processed, what for, for how long, who sees it, what rights they have. In writing, in language a person in a hurry understands.
3. A card alternative for anyone who does not accept biometric enrolment, at no cost and with no stigma for whoever chooses it.
4. A system that stores irreversible representations, never images. If the supplier cannot explain what it stores and where, the problem is yours, because the data controller is your company.
5. Retention periods defined and enforced: biometric template deleted when the employee leaves, attendance records kept for what employment law requires and nothing more.
6. The processing registered in your record of processing activities (Article 30) and a processor agreement (Article 28 of the GDPR) with the system’s supplier.
7. Consultation of the employees’ representatives, where they exist, documented.

If this list looks heavy to you, that is because it is. It was designed to be: biometric data is among the most sensitive data a company can process, and a badly built system does not fail on the company, it fails on the people.

How Notchel implements each requirement

We built the product from this list, not the other way around. Point by point:

• Irreversibility. The terminal converts the face into a mathematical template (a feature vector) at the moment of capture. The image is never stored. No face can be reconstructed from the template: it is the Article 28 requirement met by design, not by internal policy.
• Local processing. The biometric template is kept encrypted on the hardware installed in the store and never leaves it. The only thing sent to the server, hosted in the European Union, is pseudonymised clock-in events: an identifier, a time, a terminal. Whoever breaks into the server finds no biometrics, because they are not there.
• Card alternative. Not an extra, the same terminal. Any employee can use the card from day one, and the choice is not visible to colleagues or managers at the moment of clocking in.
• Retention periods. The biometric template is deleted when the employee leaves. Attendance records follow the legal period and the retention policy documented in the dossier.
• Documentation. We hand customers a GDPR and AI Act compliance dossier with 10 documents: a DPIA template filled in for the operation, an employee information notice, a processor agreement, a retention policy, a data breach procedure, among others. Your DPO does not start from zero: they start from a dossier that has already been through an audit.

The AI Act has stopped being news at this table, and the dates deserve careful reading. The prohibitions have applied since 2 February 2025. The obligations for high-risk systems in Annex III were due on 2 August 2026, but the Digital Omnibus package postponed them to 2 December 2027. Postponed, not cancelled: whoever installs a system today will live under them for the whole contract. For attendance, the regulation draws two borders that matter. Emotion recognition in the workplace is prohibited as of now, except for medical or safety reasons. And the regime changes with the design of the system: biometric verification (confirming that the person in front of the terminal is who they say they are) is expressly excluded from the high-risk list; remote identification, without the person’s active participation, is on it, with duties of its own for whoever supplies the system and whoever installs it. Which side a concrete installation falls on is decided camera by camera, in the design, and it is one of the questions the dossier answers in writing. Not because tomorrow’s inspection will ask for it, but because the audit of an international group the day after will.

What we do not do (and why)

As important as the list of what we do:

• We do not store photographs. Not “temporarily”, not “just for debugging”. The temptation to keep the image to resolve doubtful cases is real and it is illegal: the reversibility prohibited by Article 28 starts right there.
• We do not use the biometrics for anything else. No emotion recognition, no camera-based break timing, no people counting. Two legitimate purposes exist, and we use one: attendance.
• We do not treat consent as the legal basis. We inform, we provide the alternative and we document. Calling something consent when the employee cannot freely refuse it is painting the façade of a building with no foundations.
• We do not sell an installation without the dossier. Some prefer to install first and document later. Later is too late: the DPIA is prior by definition, and a GDPR fine reaches €20 million or 4% of worldwide turnover, whichever is higher.

The practical conclusion fits in one sentence: Portuguese law allows clocking in by facial recognition, but it only rewards those who treat it as high-risk processing from day one. That is exactly how we treat it. If you want to see the dossier before any meeting, ask for the index: we send it the same day.

Guilherme Gameiro
Engineer and Co-Founder of Notchel.