Facial Recognition Access Control and PDPL in Saudi Arabia

Face recognition terminals have become an easy upgrade for office entrances, staff gates and compounds: no cards to lose, no shared PINs and a clear record of who entered. Installation takes an afternoon, so the terminal is often running before anyone has asked what happens to the faces it stores.

That question matters under the Personal Data Protection Law (PDPL), which SDAIA enforces in full and which treats biometric data as sensitive. For the law as a whole, see our guide to Saudi Arabia's PDPL. This guide covers what the PDPL means for a face recognition door, how each obligation maps to a setting or a document, and the mistakes that cost most to fix.

Why does the PDPL treat face recognition differently?

Because a face template identifies a person by their body, and the PDPL classes biometric data as sensitive data with stricter rules. In practice, that brings five things that a card reader does not:

• Sensitive data: biometric data sits alongside health, genetic and credit data in the PDPL's sensitive category.
• Explicit consent: the Implementing Regulations require explicit consent where sensitive data is processed, unless another lawful basis applies.
• Impact assessment: a data protection impact assessment (DPIA) is required before processing sensitive data.
• Data protection officer: organisations whose main activities involve sensitive data must appoint one.
• Tougher penalties: misuse of sensitive data carries the PDPL's heaviest sanctions, which can include imprisonment as well as fines.

Is a face template personal data?

Yes. A terminal stores a mathematical template rather than a photo, but the template exists to identify one person, so it remains biometric personal data. Entry logs that link a name to a time and door are personal data too, even when no face is stored with them.

Do staff have to consent?

Plan on explicit consent, and offer an alternative. Consent from an employee is only meaningful if refusing has no penalty, so give anyone who declines a card, PIN or QR code that opens the same doors, and record each person's choice.

Is an impact assessment required?

Yes, before go-live. The Implementing Regulations require a DPIA where processing involves sensitive data, where it uses new technologies or where it involves continuous monitoring, and a face recognition entrance usually meets more than one of those triggers.

How does a face recognition terminal work?

It enrols a face once, stores a template, then compares each person at the door against the stored templates and releases the lock on a match. The Akuvox A05S is a typical example; its datasheet lists:

• Capacity: up to 20,000 faces and 20,000 cards, with a 50,000-event log.
• Anti-spoofing: dual cameras for liveness detection against photo and video attacks.
• Other credentials: 13.56 MHz RF cards, NFC and QR codes, so people who opt out still have a way in.
• Connections: Ethernet with 802.3af PoE or 12 V DC power, Wiegand, RS485 and a relay output for the lock.
• Build: a 5-inch screen, a 2 MP camera, IP65 rating, tamper detection and an operating range of −20 °C to 60 °C.

What does liveness detection protect against?

Someone holding up a photo or a video of an enrolled person. The A05S uses two cameras to check that a real face is present, which matters for PDPL too, since a terminal that can be fooled fails the duty to keep sensitive data and premises properly protected.

Where should face templates be stored?

On the terminal or on a server you control inside the Kingdom, wherever possible. Fewer copies mean fewer places to secure, delete and report on, so avoid exporting templates to spreadsheets, shared drives or third-party cloud services without a reviewed reason.

How do the PDPL obligations map to a face recognition door?

Each obligation becomes a document, a setting or a routine. The table pairs them up for a typical staff entrance.

PDPL obligation	What it means at the door	Practical step
Lawful basis	A documented reason to process face data	Explicit consent form, with card or PIN offered as the alternative
Impact assessment	Risks assessed before go-live	DPIA covering enrolment, storage, access and deletion
Transparency	People know what is collected and why	Privacy notice at enrolment and a sign at the door
Purpose limitation	Face data used for entry only	No reuse for attendance disputes or monitoring without a new basis
Security	Templates protected from misuse	Encrypted storage, restricted admin accounts, isolated network
Retention	Data kept no longer than needed	Delete templates when access ends; set a log retention period
Records of processing	Processing documented	Entry in the record of processing activities, kept five years after it ends
Breach response	Harmful breaches reported	Report to SDAIA within 72 hours and inform affected people without undue delay

How long can templates be kept?

Only while the person needs access. Delete a leaver's or contractor's template on their last day, set a defined retention period for entry logs, and record both in the DPIA so deletion is routine rather than remembered.

What do Saudi buildings need to consider?

Four local factors decide how face recognition should be set up: who passes the door, where data travels, how people dress and who supports the system. International guides rarely cover them.

Do compounds and visitors need different handling?

Yes. Residents of a compound can consent once at move-in, but visitors, drivers and contractors pass through briefly, so use QR codes or temporary cards for them rather than enrolling faces for a single visit.

Can face data leave the Kingdom?

Only under the PDPL's transfer rules, which limit transfers outside Saudi Arabia and require a risk assessment where large volumes of sensitive data are involved. A terminal that matches locally, with management on an in-Kingdom server, avoids the question entirely.

Does face recognition work with face coverings?

Not reliably for enrolment and matching, so plan for it. Offer a card, PIN or QR code as an equal alternative, and handle enrolment privately and respectfully, with female staff available to enrol women where needed.

Who supports the system after installation?

Ask who handles warranty, firmware updates and template deletion requests in the Kingdom. A terminal left on old firmware or an open network undermines the security the PDPL requires, so put updates and network isolation in the handover; our guide to VLAN segmentation explains how to keep door devices off the general office network.

Blue Edge Company, founded in 2016 and based in Dammam in the Eastern Province, is a value-added technology distributor supplying projects across Saudi Arabia, and it supplies and supports Akuvox smart intercoms, video door phones and access control terminals. It provides the Akuvox access control range with IT installation and configuration; PDPL compliance decisions remain with the organisation and its legal advisers.

What are the most common face recognition PDPL mistakes?

Most of them come from installing first and documenting later. They are listed worst first.

• Going live without a DPIA. Processing sensitive data without an impact assessment breaches the Implementing Regulations, and retrofitting one after an incident is far harder to defend.
• No alternative to face recognition. Making face entry the only option undermines consent and leaves visitors and people who decline with no way in, which usually means re-tendering for card readers.
• Never deleting templates. Leavers' and contractors' faces kept for years are a breach risk with no purpose, and cleaning up thousands of records later takes weeks.
• Terminals on the open office network. A door device on a flat network exposes its admin interface and stored templates, so isolate it before go-live.
• Exporting templates or logs casually. Copies on laptops, email or foreign cloud storage multiply breach and transfer risk.
• Reusing entry data for other purposes. Using face logs for performance or attendance disputes without a new lawful basis turns a security system into a compliance problem.

Complete the DPIA, then switch the terminal on

Start with the DPIA: what is collected, why, where templates are stored, who can access them and when they are deleted. Have the data protection officer, where one is required, review it before installation.

Then prepare the consent form, the privacy notice and the alternative credential. Set up the terminal to match: local matching, liveness detection on, encrypted storage, restricted admin accounts and an isolated network.

Finally, add the system to your record of processing activities, schedule template deletion for leavers, and test your breach response so the 72-hour deadline can be met. Our guide to smart access control and building management covers how the terminal fits the wider building.

Frequently Asked Questions

• What must you do if face data is breached?

  Notify SDAIA within 72 hours of becoming aware of a breach that may cause harm or affect people's rights, and inform the affected individuals without undue delay. Prepare in advance: know where templates are stored, who can access them and who reports, so the deadline can be met.

• Does face recognition require a data protection officer?

  It can. The PDPL rules require a DPO where an organisation's main activities involve processing sensitive data or regular, systematic monitoring of people. A single staff entrance may not reach that threshold on its own, but larger estates such as compounds or multi-site operators should check with their legal advisers.

• Can face recognition replace fingerprint readers?

  Yes, and it is contactless, but it changes nothing legally. Fingerprints are biometric data too, so the same consent, impact assessment, retention and security rules apply, and existing fingerprint templates should be deleted once they are no longer needed rather than kept alongside the new face data.

• Can the system track attendance as well as entry?

  Technically yes, but treat it as a separate purpose. Using face data for attendance or working-time records needs its own lawful basis and must appear in the DPIA and privacy notice; otherwise keep attendance on cards or another system and use face data for entry only.

• Do visitors need to enrol their faces?

  No, and they usually should not. Enrolling a face for a single visit collects sensitive data with little benefit, so issue visitors QR codes or temporary cards instead, which the A05S also reads, and keep face enrolment for staff and residents who use the door every day.

Sources & References

• Saudi Data and Artificial Intelligence Authority (SDAIA) — Regulations and Policies, including the Personal Data Protection Law and its Implementing Regulations regulator
• Akuvox — A05S face recognition access control terminal datasheet (distributor-hosted) vendor documentation

---

Published 11 October 2026 • Last updated 17 October 2026 • This article is reviewed when standards, regulations or product guidance change.