Facial Recognition in UK: What the Law Actually Requires

In February 2024, the UK’s Information Commissioner’s Office ordered Serco Leisure and seven associated trusts to stop scanning the faces and fingerprints of more than 2,000 employees across 38 leisure facilities. The data had been collected to verify attendance and process pay. No meaningful alternative had been offered.

No lawful basis under UK GDPR had been established for processing special-category biometric data. The ICO gave the group three months to destroy every biometric record it held.

The enforcement action didn’t arrive because Serco was doing something unusual. It arrived because the company was doing something many UK organisations have quietly adopted using facial recognition for operational convenience without the legal groundwork that processing biometric data requires.

The UK does not yet have a single dedicated statute regulating facial recognition technology. Instead, its use is governed through a combination of the UK GDPR, the Data Protection Act 2018, human rights law and common law policing powers, a situation widely described as fragmented. In December 2025, the Home Office launched a consultation on a new legal framework for biometric and facial recognition use by law enforcement. The Home Office’s January 2026 Police Reform White Paper has since confirmed £115 million in funding for a new police force. AI centre and set out plans for a Police Reform Bill covering facial recognition, though the bill itself has not yet been introduced to Parliament. In April 2026, the High Court ruled that the Metropolitan Police’s use of live facial recognition was lawful, clearing the way for wider rollout. In the meantime, the Information Commissioner’s Office continues to enforce existing data protection and privacy law in relation to facial recognition deployments.

This article sets out what that law requires, what the enforcement record tells you, and what organisations deploying facial recognition technology (FRT) in the UK need to do right now.

Is facial recognition legal in the UK?

Yes, but the conditions for lawful deployment are more demanding than most organisations anticipate when they first evaluate the technology.

Under the UK General Data Protection Regulation (UK GDPR), facial recognition data is biometric data processed for the purpose of uniquely identifying a natural person. That makes it special category data under Article 9, which carries a higher protection threshold than ordinary personal data. Processing it requires both a lawful basis under Article 6 and an additional condition under Article 9(2). In most commercial and employment contexts, the only realistic Article 9(2) condition is explicit consent, and the ICO has been clear that consent in an employment relationship is almost never genuinely free, given the power imbalance between employer and worker.

For law enforcement, the framework sits in Part 3 of the Data Protection Act 2018, which implements the EU Law Enforcement Directive in UK law. Police forces processing biometric data must satisfy a specific necessity and proportionality test, document their lawful authority, and conduct a Data Protection Impact Assessment (DPIA) before deployment.

The result is that facial recognition is not prohibited in the UK, but the bar for lawful processing is high enough that organisations frequently fail to clear it.

What does the ICO say about facial recognition?

The ICO published updated guidance on facial recognition technology in August 2025, clarifying how data protection law applies to both live and retrospective FRT across public, private, and law enforcement contexts.

Three requirements sit at the centre of the ICO’s position. First, any deployment must be strictly necessary for a specific, documented purpose; vague operational efficiency does not qualify. Second, organisations must demonstrate that no less privacy-intrusive means could achieve the same outcome. Third, a DPIA is mandatory before any FRT system goes live, not optional, and not something to complete after deployment when problems arise.

The Serco enforcement illustrated every one of these failures in practice. The ICO found that ordinary ID cards or key fobs could have achieved the same attendance-monitoring outcome as biometric scanning, which destroyed the necessity argument. The data subjects had not been proactively offered alternatives, which destroyed the consent argument. And there was no evidence of a DPIA.

The ICO’s position on employer use of FRT is now clear: the combination of special category data status, power imbalance, and the availability of less intrusive alternatives means that most workplace facial recognition deployments will fail the lawful basis test. Retail and venue operators face the same calculus in commercial settings.

Is the UK getting a dedicated facial recognition law?

The Home Office launched a consultation on a new legal framework for law enforcement use of biometrics and facial recognition in December 2025, which ran until February 2026. The consultation proposes consolidating the current patchwork of laws into a single, coherent framework, creating a new oversight and regulatory body, and setting explicit boundaries on when and how FRT can be deployed by police.

The UK Home Office announced a £115 million investment over three years to establish police. AI, a national centre to help standardise and scale the use of AI tools, including facial recognition technology, across the 43 police forces in England and Wales.

The Home Office’s January 2026 Police Reform White Paper has since moved this forward: it confirmed the £115 million for police. AI investment, an increase in live facial recognition vans from 10 to 50, and plans for a police reform bill that will include a facial recognition legal framework. As of mid-2026, that bill has not yet been introduced to Parliament, so the framework described in this article remains the operative one. Independent testing by the National Physical Laboratory, published alongside the December 2025 consultation, found the facial recognition algorithm used on the Police National Database produced false positive rates of around 4.0% for Asian subjects and 5.5% for Black subjects, compared with 0.04% for white subjects, evidence that reinforces the bias concerns first raised in Bridges. In April 2026, the High Court ruled in a judicial review that the Metropolitan Police’s use of live facial recognition was lawful and compliant with human rights law, a decision the government has cited in support of nationwide rollout.

The contrast with the EU is instructive. The EU AI Act, which entered into force in August 2024, places real-time biometric identification in public spaces into the highest-risk category, with a near-blanket prohibition subject to narrow, court-authorised law enforcement exceptions. The UK has chosen a different path: technology-permissive, case-by-case, regulated through data protection law until specific legislation is in place.

For UK organisations, this means the ICO’s existing enforcement powers remain the primary accountability mechanism. 

What do UK organisations need to do right now?

Lawful facial recognition deployment in the UK today requires organisations to work through a defined set of steps before a single camera goes live.

The first is a Data Protection Impact Assessment. Under Article 35 of UK GDPR, a DPIA is mandatory where processing is likely to result in a high risk to individuals, and facial recognition, as a systematic biometric surveillance technology, falls squarely within that category. The DPIA must document the purpose, the necessity test, the proportionality assessment, the risks identified, and the mitigations applied.

The second is establishing a valid Article 9(2) condition for processing special category biometric data. For commercial operators, this almost always means explicit, freely given consent with a genuine opt-out. For employers, the ICO’s guidance means that consent will rarely be available, and an alternative verification method must be offered and actively communicated.

The third is data minimisation and retention limits. Facial recognition systems that retain biometric templates beyond the immediate verification event need a documented retention policy with a clear legal basis for each retention period.

The last one, to sum up all processes, is a bias and accuracy audit. The Bridges judgement specifically flagged the failure to test for indirect discrimination through racial or gender bias. Any FRT system deployed in the UK should have documented demographic accuracy data, and that data should be reviewed before deployment.

Organisations that have already deployed facial recognition without completing these steps are carrying active ICO enforcement risk.

How Shufti helps organisations handle biometric data compliantly

The compliance burden around biometric data is real, and it falls hardest on organisations that deployed facial recognition before the ICO clarified its expectations. The gap between what a system can technically do and what it can lawfully do in a UK context is where enforcement risk lives.

Shufti’s face verification was built for that gap. The liveness and biometric match layer operates on an explicit data-minimisation architecture; biometric data is processed for the purpose of a single verification event and is not retained as a template after the check completes. The system holds iBeta Level 3 conformance under ISO/IEC 30107-3, the highest independent standard for liveness attack detection, which provides the documented accuracy baseline that a UK DPIA requires. For organisations building a compliant biometric verification workflow from scratch, that architecture is faster to get through a DPIA than a system that retains templates by default.

See how Shufti’s face verification fits your UK compliance architecture on real data. Book a 20-minute demo.