# Employee Biometric Data Assessment Template

## Organisation Details

| Field | Value |
|-------|-------|
| Organisation Name | [Atlas Manufacturing Group] |
| Assessment Reference | BIO-[YEAR]-[SEQ] |
| Assessment Date | [DD/MM/YYYY] |
| Assessor | [Name, Title] |
| Jurisdiction | [DE / FR / NL / IT / SE / UK] |

## Biometric System Description

| Element | Detail |
|---------|--------|
| Technology type | [ ] Fingerprint [ ] Facial Recognition [ ] Iris [ ] Voice [ ] Behavioural [ ] Other: _____ |
| Vendor / Product | _________ |
| Use case | [ ] Physical access control [ ] Timekeeping [ ] Device authentication [ ] Contactless ID [ ] Other: _____ |
| Employees in scope | [Number and categories] |
| Locations | [Specific areas where biometric system is deployed] |

## Necessity Assessment

### Purpose Definition
| Question | Answer |
|----------|--------|
| What is the specific purpose? | _________ |
| Is the purpose documented? | [ ] Yes [ ] No |

### Less Intrusive Alternatives
| Alternative | Considered? | Sufficient? | Reason if Insufficient |
|------------|------------|------------|----------------------|
| Smart card + PIN | [ ] Yes [ ] No | [ ] Yes [ ] No | _________ |
| Proximity badge | [ ] Yes [ ] No | [ ] Yes [ ] No | _________ |
| Password / passphrase | [ ] Yes [ ] No | [ ] Yes [ ] No | _________ |
| Supervisor verification | [ ] Yes [ ] No | [ ] Yes [ ] No | _________ |
| Other: _____ | [ ] Yes [ ] No | [ ] Yes [ ] No | _________ |

### Necessity Conclusion
| Outcome | Detail |
|---------|--------|
| Is biometric processing necessary? | [ ] Yes [ ] No |
| Documented justification | _________ |

## Art. 9(2) Exception

| Exception | Applicable? | National Law Reference |
|-----------|------------|----------------------|
| Art. 9(2)(a) Explicit consent | [ ] Yes [ ] No | _________ |
| Art. 9(2)(b) Employment law obligation | [ ] Yes [ ] No | _________ |
| Art. 9(2)(g) Substantial public interest | [ ] Yes [ ] No | _________ |
| Selected exception | _________ |

## Template Storage

| Question | Answer |
|----------|--------|
| Storage method | [ ] Individual device [ ] Centralised with employee key [ ] Centralised without control |
| If not individual device — justification | _________ |
| Encryption at rest | [ ] AES-256 [ ] Other: _____ |
| Encryption in transit | [ ] TLS 1.3 [ ] Other: _____ |
| Raw biometric data stored? | [ ] Yes (FAIL) [ ] No (templates only) |
| System-specific template format? | [ ] Yes [ ] No |
| Anti-spoofing / liveness detection? | [ ] Yes [ ] No |

## Alternative Access Method

| Question | Answer |
|----------|--------|
| Non-biometric alternative available? | [ ] Yes [ ] No (MUST be Yes) |
| Alternative method | _________ |
| Any disadvantage for using alternative? | [ ] Yes (FAIL) [ ] No |

## Employee Objection Procedure

| Element | In Place? |
|---------|----------|
| Objection mechanism communicated to employees | [ ] Yes [ ] No |
| Alternative activated within 5 working days | [ ] Yes [ ] No |
| No adverse consequence for objecting employees | [ ] Yes [ ] No |
| Biometric template deleted upon objection | [ ] Yes [ ] No |

## Sign-Off

| Role | Name | Signature | Date |
|------|------|-----------|------|
| Assessor | _________ | _________ | _________ |
| DPO | _________ | _________ | _________ |
| Works Council (if applicable) | _________ | _________ | _________ |
| Senior Management | _________ | _________ | _________ |