Face-Recognition Attendance for College Staff: What to Check Before You Buy

By Founder, Eduvy · Published 7 Sep 2026 · Updated 8 Sep 2026 · For Colleges · Editorial policy

Face-recognition attendance replaces a fingerprint reader or a card with a camera: a staff member is recognised against an enrolled photograph and the attendance record is created automatically. It is genuinely faster at a busy gate and it removes the shared-surface and worn-fingerprint problems. It also introduces accuracy, spoofing and personal-data questions that a card reader never raised. This article sets out what to test and what to ask before a college signs.

One correction first, because it comes up in almost every sales conversation. There is a real, verifiable mandate for medical colleges: the National Medical Commission's public notice states that "the NMC has decided to fully shift to face-based Aadhaar authentication for marking attendance on NMC AEBAS from 01st May 2025," that finger-authentication marking "will be discontinued", that attendance must be marked within a 100-metre radius of a GPS location supplied by the college, and that the purpose is to prevent ghost faculty. We could not verify any equivalent current AICTE or UGC mandate requiring biometric or face-recognition attendance for faculty at colleges generally. If a vendor tells you there is one, ask for the circular number.

Accuracy in real conditions, not in the demo

NIST runs the Face Recognition Vendor Test, an ongoing, free, vendor-neutral evaluation covering both one-to-one verification ("is this the person they claim to be?") and one-to-many identification ("who is this, out of an enrolled gallery?"). It reports two error rates you should learn: false match rate, where the system wrongly accepts the wrong person, and false non-match rate, where it wrongly rejects a genuine one. A vendor quoting a single "99% accuracy" figure is telling you neither.

Two published NIST findings should shape your testing.

• Demographic differentials are real. NIST's 2019 study of roughly 200 algorithms from about 100 developers, across more than 18 million images, found "empirical evidence for the existence of demographic differentials in the majority of the face recognition algorithms we studied." In one-to-one verification it found higher false-positive rates for Asian and African American faces relative to Caucasian ones, with differentials that "often ranged from a factor of 10 to 100 times, depending on the individual algorithm." Two encouraging caveats from the same study: some algorithms developed in Asian countries did not show the same gap, and NIST notes that algorithms "that are the most equitable also rank among the most accurate."
• Occlusion degrades performance sharply. In NIST's testing of 89 algorithms on masked faces, error rates ranged from 5% to 50%, and accuracy fell further the more of the nose a mask covered. Masks are not hypothetical on an Indian campus.

The practical instruction: run a two-week pilot at your actual gate, with your actual staff, in the month with the worst light. Count false rejections per person per week. A system that fails one senior professor twice a week will be abandoned regardless of its average.

Multi-face versus kiosk: they are different problems

These two architectures are often quoted as if they were the same product.

That last row matters. NIST's one-to-many testing uses galleries of at least 10 million identities; your college gallery is a few hundred. The error profile is not the same, so ask the vendor for figures at a gallery of your size, and ask what the system does when confidence is low - silently guess, or flag for review? Eduvy's HRMS takes the multi-face approach, described as "camera-based attendance logs several people at once; no fingerprint reader, no card, no queue at the gate." Whichever architecture you choose, insist on seeing the low-confidence behaviour, not just the happy path.

Spoofing: ask for the test report, not the claim

Every vendor says its system cannot be fooled by a photograph. There is an international standard for testing that claim - ISO/IEC 30107-3, which covers presentation attack detection - and independent labs that test against it. iBeta, accredited under NIST's NVLAP programme, publishes what its levels mean:

• Level 1: around 8 hours per test subject, no specialist tester expertise required, using cheap and readily available attack materials costing up to roughly $30 - printed photographs, screen replays. To pass, the penetration rate must be zero.
• Level 2: two to four days per subject, testers with prior presentation-attack experience, more sophisticated instruments costing up to roughly $300, such as 3D-printed masks. Up to a 1% penetration rate is permitted.
• Both levels also cap the genuine-user error rate at no more than 15%.

Two things to take away. Level 2 is a materially harder test than Level 1, so "iBeta certified" without a level means little. And iBeta itself cautions that conformance testing "does not translate to a certification of the vendor product" - so ask for the confirmation letter naming the exact product version and configuration tested, and check it matches what you are buying. The FIDO Alliance runs a separate face-verification certification programme covering accuracy over at least 10,000 verifications, presentation-attack resistance and demographic fairness across skin tones, ages and genders; a vendor holding either is ahead of one holding neither.

Privacy and consent: what the law requires, in general terms

This section describes the framework at a general level. It is not legal advice. Take your own counsel on how the law applies to your institution.

India's Digital Personal Data Protection Act was enacted on 11 August 2023, and the Digital Personal Data Protection Rules were notified on 14 November 2025, with government material describing an eighteen-month period for phased compliance. The Act rests on seven core principles: consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability. In its vocabulary, your college is a Data Fiduciary - the entity that decides why and how personal data is processed - and each member of staff is a Data Principal. A vendor processing on your behalf is a Data Processor; the accountability does not transfer to them.

What that framework implies for a face-attendance project, at a general level:

• A clear, specific notice. Every Data Fiduciary must issue a separate consent notice that is clear and easy to understand and explains the specific purpose for which the data is collected and used. "General HR purposes" is not a purpose.
• Collect the minimum, keep it no longer than needed. Data minimisation and storage limitation are core principles. Ask whether the system stores photographs or only a mathematical template, and what the deletion process is when a staff member leaves.
• Security safeguards, with real consequences. Failure to maintain reasonable security safeguards attracts the Act's highest penalty tier - up to Rs 250 crore. Failing to notify a breach can attract up to Rs 200 crore, and other violations up to Rs 50 crore.
• Breach notification. Affected individuals must be informed without delay, in plain language, covering what happened, the likely impact, the steps taken, and contact details for help.
• A named contact and a response clock. Data Fiduciaries must display contact information for data queries - a designated officer or Data Protection Officer - and must respond to rights requests such as access, correction or erasure within ninety days. A digital Data Protection Board of India hears complaints, with appeals to TDSAT.

Practically: a written notice to staff before enrolment, a retention and deletion policy, a named contact, a data processing agreement with the vendor, and clarity on where the biometric templates are stored. Whether consent is the applicable ground, or an employment-related basis is, is exactly the question to put to your legal adviser rather than to a vendor.

Payroll integration

Attendance only earns its keep when it drives payroll without re-keying. Test the whole chain: recognition event, daily attendance record, leave and holiday adjustment, monthly muster, payslip and statutory deductions. Ask to see one month processed on your own data, including the awkward cases - a half-day, a staff member on official duty off campus, a late-approved leave that changes a closed month.

Eduvy's HRMS states that payroll computes PF, ESI, PT and TDS in one click with payslips to the staff app, and that leave policies carry automated approval routing, on the same platform as the ERP. Whichever vendor you choose, ask how a retrospective correction is handled after payroll has run - that is the case that generates every grievance.

The practical failure modes

• Network outage. Ask whether the device records locally and syncs later, and how many events it buffers. A gate that stops working when the link drops gets propped open by day three.
• Power. Camera and device must survive a cut. That is a UPS question, not a software question.
• Enrolment quality. Poor enrolment photographs cause most early false rejections. Enrol in good light, and re-enrol anyone failing repeatedly rather than telling them to try again.
• Appearance change. Spectacles, beards, ageing. Ask about the re-enrolment policy.
• Who watches the exceptions. A named person must review the daily exception list, or the exceptions become the record.

A buyer's checklist

Frequently asked questions

Is face-recognition attendance mandatory for colleges in India?

Not generally. The National Medical Commission requires face-based Aadhaar authentication on NMC AEBAS for medical colleges from 1 May 2025. We could not verify any equivalent current AICTE or UGC mandate for colleges at large. Some state universities have imposed their own requirements, so check your affiliating university.

Is it more accurate than fingerprint?

It depends on the algorithm and the conditions, and NIST's evidence is that both accuracy and demographic fairness vary widely between vendors. Face avoids worn or damaged fingerprints and shared surfaces; it is more sensitive to light, occlusion and camera placement. Test rather than assume.

Does the DPDP Act allow us to collect staff facial data?

The Act sets out obligations - notice, purpose limitation, data minimisation, storage limitation, security safeguards and accountability - and provides for employment-related grounds of processing alongside consent. Which ground applies to your specific deployment is a legal question for your own adviser, not a settled matter to be taken from a vendor's brochure or from this article.

What is AEBAS?

The Aadhaar Enabled Biometric Attendance System, designed and hosted by the National Informatics Centre, is used by government organisations to record employee attendance through biometric devices, QR codes and a mobile app, with nodal officers managing each organisation's data. It is a government attendance platform, not a commercial college product.

Can a photograph fool it?

A system with no liveness detection, yes. That is exactly what ISO/IEC 30107-3 presentation-attack testing exists to measure, and why the level of the test matters: Level 1 uses materials costing up to about $30, Level 2 up to about $300, including 3D-printed masks.

Eduvy's HRMS runs on the same data layer as the College ERP, so staff records, attendance and payroll sit with academic and fee data rather than in a separate system. See the full range for colleges.

Sources

• https://www.nist.gov/programs-projects/face-recognition-vendor-test-frvt
• https://www.nist.gov/news-events/news/2019/12/nist-study-evaluates-effects-race-age-sex-face-recognition-software
• https://www.nist.gov/publications/face-recognition-vendor-test-part-3-demographic-effects
• https://www.nist.gov/news-events/news/2020/07/nist-launches-studies-masks-effect-face-recognition-software
• https://www.ibeta.com/iso-30107-3-presentation-attack-detection-confirmation-letters/
• https://www.biometricupdate.com/202405/fido-alliance-launches-comprehensive-selfie-biometric-idv-certification-program
• https://attendance.gov.in/
• https://www.deccanherald.com/india/ghost-faculty-nmc-mandates-face-based-authentication-attendance-3507349 (quoting the NMC public notice)
• https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf (PIB, "DPDP Rules, 2025 Notified", 17 November 2025)
• https://eduvy.in/services/hrms
• https://eduvy.in/services/erp