Face-Recognition Attendance for Contract Labour: Cost, Accuracy, DPDP
Can a factory put contract workers on face-recognition attendance in India? Yes, but a face template is biometric data. Until the SPDI Rules, 2011 lapse on 14 May 2027, they require written consent before collection. On NIST's kiosk-photo test (updated 6 Oct 2026), the median developer's algorithm wrongly rejects 13% of genuine faces at a strict setting.
Last checked: 15 Oct 2026. Not legal advice.
Verified against
- Digital Personal Data Protection Act, 2023: ss.2(t), 5, 6, 7(i), 8(5) and 8(7), 10, 44(2) and the Schedule (MeitY copy of the Gazette text).
- G.S.R. 843(E), 13 Nov 2025, DPDP commencement (e-Gazette 267647).
- DPDP Rules, 2025: Rules 1, 3, 6 and 8 (e-Gazette 267650).
- IT (SPDI) Rules, 2011, G.S.R. 313(E), 11 Apr 2011 (official text on WIPO Lex).
- OSH Code, 2020: ss.2(1)(m), 2(1)(zz), 33, 45 and 55 (e-Gazette 222112). OSH&WC (Central) Rules, 2026: r.72 and Form XIV (e-Gazette 272379).
- Model Standing Orders, 2026, S.O. 2312(E), Schedule B para 9 (e-Gazette 272341).
- NIST FRTE 1:1 leaderboard, last updated 6 Oct 2026 (NIST FRTE 1:1). NIST IR 8331 on face masks, November 2020 (NIST IR 8331).
- Maker product pages: eSSL AiFace-Mars+HID and TimeWatch Bio-1SE.
- Checked 15 Oct 2026.
Four attendance options compared
| Option | Price published by the maker (₹, checked 15 Oct 2026) | Accuracy evidence | Stops buddy punching? | Personal-data risk (SPDI now, DPDP from 14 May 2027) |
|---|---|---|---|---|
| RFID / ID card | None found on the maker pages checked | None: a card identifies the card, not the person | No. Model Standing Orders 2026, Sch. B para 9(5), bans punching another's card; the card cannot enforce it | Personal data (DPDP s.2(t)), not biometric |
| Fingerprint terminal | None found (TimeWatch says it does not sell on e-commerce) | Maker claim only: the TimeWatch Bio-1SE (face, palm, fingerprint) page states "FAR: 0.00001%, FRR: 0.1%", no modality or test dataset named | Mostly | Biometric under SPDI Rule 3(vi): written consent now |
| Face terminal at the gate | None found (eSSL AiFace-Mars+HID page) | NIST FRTE kiosk images (next table); eSSL page publishes no FAR/FRR | Mostly; eSSL claims anti-spoofing vs photo, video, 3D mask | "Facial patterns" are biometrics under SPDI Rule 2(1)(b) |
| CCTV-based face match on the floor | Depends on the camera and software quote | NIST border results; ceiling-angle factory video is not a NIST category | Yes, if the face is visible | Biometric, and processes everyone in frame, not only enrolled workers |
"Not found" means the maker's own product page, checked 15 Oct 2026, carries no rupee price. Ask for written quotes listing the terminal, per-head software licence and annual maintenance contract (AMC) separately.
Accuracy: what NIST measured, not what the brochure says
| NIST FRTE 1:1 image type (leaderboard of 6 Oct 2026) | Best developer: FNMR | Median developer: FNMR | Setting |
|---|---|---|---|
| Mugshot (posed, front-on) | 0.20% | 0.44% | FMR 1 in 100,000 |
| Visa vs border photo | 0.14% | 0.78% | FMR 1 in 1,000,000 |
| Kiosk (self-service, closest to a gate terminal) | 3.34% | 13.17% | FMR 1 in 100,000 |
FNMR is the share of genuine workers who get rejected. On kiosk images only 47 of the 351 developers listed, about 13%, stay at or under 5% (NIST FRTE 1:1, 6 Oct 2026). Of the 27 India-headquartered developers with a kiosk score, the best is at 5.02%, and 7 are at or under 10%.
Masks make this worse. NIST IR 8331 (November 2020) found that the best algorithms' false rejection rose from 0.3–0.5% unmasked to 2.4–5% masked. Some algorithms "fail to authenticate between 10% to 40% of masked images".
Read these as a ceiling: a terminal is only as good as the algorithm inside it. Ask the vendor for its NIST FRTE submission name. If it has none, that is your answer.
The law: what face data is today and after May 2027
Today, the SPDI Rules apply. Rule 3 lists "Biometric information" as sensitive personal data. Rule 2(1)(b) defines biometrics to include "facial patterns". Rule 5(1) requires "consent in writing through letter or Fax or email" before collection. Rule 5(4) bars keeping the data longer than the purpose needs.
The SPDI Rules end on the same date the DPDP duties start. The DPDP Act's s.44(2) deletes s.43A of the IT Act, the section the SPDI Rules hang on. G.S.R. 843(E) brings s.44(2) into force eighteen months after 13 Nov 2025, together with ss.3–17. That gives 14 May 2027 on the day-count used in our DPDP and worker CCTV guide.
The DPDP Act has no "sensitive" category. Section 2(t) covers "any data about an individual who is identifiable". Biometrics are not singled out anywhere in the Act's text (checked 15 Oct 2026). Sensitivity appears only in s.10(1)(a), as one factor the Centre may weigh when notifying a Significant Data Fiduciary.
The contract-labour catch is s.7(i). Section 7(i) allows processing without consent "for the purposes of employment or those related to safeguarding the employer from loss or liability". A contract worker is hired "by or through a contractor" (OSH Code s.2(1)(m)). For a factory, the principal employer is its owner or occupier (s.2(1)(zz)). Whether the principal employer can rely on 7(i) for a worker it does not employ is a question for your counsel.
The route that does not depend on how 7(i) is read is consent. Consent has to be "free, specific, informed, unconditional and unambiguous" (s.6(1)) and can be withdrawn "at any time" (s.6(4)). It needs a notice listing the data and the purpose (s.5(1), Rule 3), available in English or any Eighth Schedule language (s.5(3)). In practice: offer a card or PIN fallback to anyone who declines.
Your duties as the data fiduciary from May 2027:
- Security. Rule 6(1) requires encryption or masking, access control and access logs kept for one year. The penalty ceiling for failing to take security safeguards is ₹250 crore (Schedule item 1).
- Erasure. Section 8(7) requires erasing a worker's data once the purpose "is no longer being served". Rule 8(3) separately requires keeping the personal data and processing logs for at least one year, for the State-use purposes in the Seventh Schedule, then erasing them.
- Vendor. If a terminal maker or cloud vendor processes the data on your behalf, you remain responsible for that processing (s.8(1)).
The OSH Code side: why the principal employer cares
Contract labour now sits in OSH Code Chapter XI (licensing from 50 workers). If the contractor fails to pay wages, s.55(3) makes the principal employer liable to pay them and recover the amount later.
Section 33 requires employers to keep registers that record attendance. Central Rule 72 sets out an attendance register-cum-muster roll in Form XIV, whose note says it "may also be maintained in electronically". For a private factory, the state's rules govern. The Central Rules show the pattern. The 2026 Model Standing Orders allow attendance "by means of identity card, biometrics or any other system". No rule makes face recognition mandatory (checked 15 Oct 2026).
Worked example (headcount, no ₹ assumption). Say a plant bills 300 contract shifts a day for 26 days. If 1% of those shifts are proxy-punched, that is 3 a day, or 78 paid shifts a month that nobody worked. Multiply 78 by your contractor's daily rate to get the monthly leak. At a 13% kiosk false-rejection rate, the same 300 shifts would give about 39 genuine workers a retry at the gate every day.
What breaks in a factory
- Heat. The eSSL AiFace-Mars+HID page lists an operating range of −10 to 45 °C. A terminal on a sun-facing gate wall in May can go past that.
- Helmets, masks, dust and grime. These cover the face the same way the NIST mask study did. Mount the terminal where workers take off PPE.
- Capacity. The Bio-1SE stores 1,000 faces and the AiFace-Mars 3,000. Size for peak contractor rotation, not today's headcount.
What to ask the vendor before signing
- Which algorithm is inside the terminal, and what is its NIST FRTE name and result on kiosk images?
- Where are the face templates stored: on the device, on your server, or in the vendor's cloud?
- How do you delete one worker's template on exit, and what log proves it was deleted?
Where Mama fits
Mama does a different job: it reads the factory's existing cameras and tells the owner how many people were at each line or zone, as aggregate counts. It builds no face templates and identifies no one. Owners use it to compare billed head-days with the people actually on the line (contract labour headcount). Workers still need a DPDP-ready CCTV notice. See askthemama.com, or leave an email or phone in the form below.
FAQ
Is facial data sensitive personal data under the DPDP Act? No. The DPDP Act has no sensitive category. Face data is still personal data under s.2(t). Until 14 May 2027, though, the SPDI Rules, 2011 treat it as sensitive biometric data, and written consent is required.
Is face-recognition attendance legal for workers in India? Yes. The 2026 Model Standing Orders allow attendance by biometrics. You need written consent now under the SPDI Rules, and a DPDP-compliant basis, notice, security and erasure from May 2027.
Does face recognition work with masks? It works less well. Per NIST IR 8331, even the best algorithms' false rejection rose to 2.4–5% with masks, and some rejected 10–40% of masked images.