Biometric Data Reference

Detects biometric data about an identified person - biometric templates, identifiers and records, fingerprint scans or templates, facial recognition, iris/retina scans, voiceprints and palm prints - when the biometric phrase sits with a populated person identifier and biometric enrolment/capture fields.

Type

regex

Confidence

medium

Confidence justification

Low by design: the attribute has no fixed format. Enforce tiers now require the attribute to be tied to an identified person record (a populated name/DOB/ID field), and 85 also requires a populated biometric record field plus independent record evidence, so policy text, surveys-in-design and news naming the category stay at 65 discovery.

Jurisdictions

global

Regulations

Privacy Act 1988 (Cth), NDB Scheme (Cth), Information Privacy Act 2009 (Qld), GDPR

Frameworks

ISO 27001, ISO 27701

Data categories

biometric, sensitive-data

Scope

narrow

Risk rating

5

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:biometric\s+(?:data|template|identifier|scan|record)|fingerprint\s+(?:scan|data|template)|facial\s+recognition|iris\s+scan|retina\s+scan|voiceprint|palm\s+print|liveness\s+detection)\b

Should match

• Biometric identifier record Employee ID: E40917 Name: Avery Teston Enrolment ID: FT-7730-2291 Finger position: right index Quality score: 87 Enrolled for time and attendance access control on 12/08/2026. — Person-linked biometric identifier record with enrolment fields and access-control evidence (85)
• Facial recognition match review Customer ID: C4471820 Name: Casey Rourke — Person record naming facial recognition with identifiers only (75)
• Voiceprint enrolment log - contact centre authentication Customer number: 60218845 Customer name: Morgan Ellisdale Modality: Voice Enrolment date: 07/09/2026 Match score: 0.94 Caller matched against the stored voiceprint for identity verification before account access. — Voiceprint enrolment log with customer identifiers, modality, match score and identity-verification evidence (85)

Should not match

• The biological sample was analysed — No biometric phrase matched by the Purview regex
• Face-to-face meeting scheduled — No biometric phrase present
• Policy guidance: this procedure explains how biometric data and fingerprint scan records are collected, stored and shared, who may access them and how long they are kept. Staff should read the privacy section before completing any form. It contains no details about any individual. — Policy/guidance text naming the topic without any populated record (65 discovery at most)
• Biometric enrolment form Name: ____________________ Employee ID: ____________________ Enrolment ID: ____________________ Finger position: ____________________ Signature: ____________ Date: __/__/____ — Blank form with unpopulated labelled fields (placeholder guard keeps it below 75)
• News: the retailer paused facial recognition in its stores after the privacy regulator questioned how biometric data was retained. — News/training prose about the topic without a populated record (65 discovery at most)

Known false positives

• Generic references to biological or facial in non-biometric contexts. Mitigation: Require specific biometric technology keywords to co-occur.

References

• GDPR Article 9 - processing of special categories of personal data (biometric data for unique identification)
• OAIC - What is sensitive information
• Privacy Act 1988 (Cth)