Data Protection

Biometric Data

Data from processing physical or behavioral characteristics.

How the laws define this

Every framework agrees that biometric data consists of personal information derived from an individual's physical or physiological characteristics used to uniquely identify or verify a natural person, universally classifying this information as a sensitive or specially protected category subject to elevated safeguards. The primary divergence centers on whether the definition includes behavioural traits and requires specific technical processing. Both the Personal Data Protection (Amendment) Act 2024 and the report deposited for the Proposition de loi relative à la reconnaissance biométrique dans l'espace public explicitly include behavioural characteristics and frame biometric data around technical processing. Conversely, the Draft Personal Data Protection Act / Draft Data Protection Act 2023, the Medellín Police Facial Recognition System, and the Bogotá TransMilenio AI Facial Recognition Pilot focus strictly on physical or biological traits such as facial images, fingerprints, and DNA without incorporating behavioural inputs or technical processing criteria.

Synthesised from the 5 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Malaysia	Personal Data Protection (Amendment) Act 2024	In Force	Specifies 'technical processing information' derived from characteristics and explicitly treats it as sensitive personal data with elevated protections.
Colombia	Medellín Police Facial Recognition System	In Force	Gives examples like facial images and fingerprints, and applies specifically to facial images captured by cameras and mobile devices as sensitive data.
Bangladesh	Draft Personal Data Protection Act / Draft Data Protection Act 2023	Draft	Limits to 'physical or biological characteristics' with examples like DNA, and designates it as a specially protected category with stricter handling.
France	Proposal / parliamentary bill on biometric recognition in public space	Under Review	Emphasizes 'specific technical processing' and covers modalities like face and gait used in identification or authentication processes.
Colombia	Bogotá TransMilenio AI Facial Recognition Pilot	Superseded	Highlights that it is 'unique and immutable,' with examples including facial features, fingerprints, and DNA, treated as sensitive data.

What it triggers

In Malaysia, biometric data is treated as a category of sensitive personal data subject to elevated protections and handling requirements.
In Colombia's Medellín Police Facial Recognition System, facial images captured as biometric data are treated as sensitive data under Law 1581 of 2012.source
In Bangladesh's Draft Personal Data Protection Act, biometric data would be treated as a specially protected category requiring stricter handling, security measures, and limits on processing.
In France's Proposal on biometric recognition, biometric data would be treated as a special category of personal data requiring enhanced safeguards.source
In Colombia's Bogotá TransMilenio AI Facial Recognition Pilot, biometric data was treated as sensitive data under Statutory Law 1581/2012 until the pilot was superseded.source

Definitions (5)

Personal data that relates to an individual's physical or biological characteristics used to identify them uniquely (the draft explicitly notes examples such as DNA and other biometric identifiers). The Draft Act treats biometric data as a specially protected category requiring stricter handling, security measures, and limits on processing.

Draft Personal Data Protection Act / Draft Data Protection Act 2023Definition 1 of 5

Personal data derived from physical or physiological characteristics (e.g., facial images, fingerprints) that allow or confirm the unique identification of a natural person. In this context, facial images captured by cameras and mobile devices are treated as sensitive data under Law 1581 of 2012 and require heightened protections.

Medellín Police Facial Recognition SystemDefinition 2 of 5

Personal information derived from physical or biological characteristics (e.g., facial features, fingerprints, DNA) that is unique and immutable and is treated as 'sensitive data' under Colombia's Statutory Law 1581/2012, requiring heightened protection and strict conditions for processing.

Bogotá TransMilenio AI Facial Recognition PilotDefinition 3 of 5

Technical processing information derived from an individual’s physical, physiological or behavioural characteristics used for identification or verification purposes. The Amendment treats biometric data as a category of sensitive personal data subject to elevated protections and handling requirements.

Personal Data Protection (Amendment) Act 2024Definition 4 of 5

Data resulting from specific technical processing relating to physical, physiological or behavioural characteristics of a natural person that enable unique identification of that person. The term covers modalities (e.g., face, gait) used as inputs to identification or authentication processes and is treated as a special category of personal data requiring enhanced safeguards.

Proposition de loi relative à la reconnaissance biométrique dans l'espace public (Proposal / parliamentary bill on biometric recognition in public space) - report deposited 31 May 2023Definition 5 of 5

Not to be confused with

Biometric Identifier

Biometric identifier refers to the raw physical characteristic itself used for identification, while biometric data is the information derived from processing those characteristics.

Biometric Information

Biometric information is information derived from biometric identifiers, whereas biometric data more broadly encompasses processed data from physical or behavioral characteristics for identification.

Genetic Data

Genetic data specifically arises from genetic analysis providing health information, while biometric data covers a wider range of physical, physiological, or behavioral characteristics.

Questions and answers

What protections apply to biometric data in Malaysia?

The Personal Data Protection (Amendment) Act 2024 treats biometric data as sensitive personal data subject to elevated protections and handling requirements. This includes technical processing information from physical, physiological, or behavioral characteristics.

Is biometric data considered sensitive in Colombia?

Yes, in both Medellín's Police Facial Recognition System and Bogotá's TransMilenio pilot, biometric data such as facial images is treated as sensitive data under Law 1581 of 2012.

What examples of biometric data are given in these definitions?

Examples include facial images, fingerprints, DNA, facial features, face, and gait across the definitions. These are used for unique identification or verification.