Personal data from physical or biological characteristics — fingerprints, facial images, iris scans — used to uniquely identify a person. A special category of sensitive data (Article 4(14); Article 9).
Technology that identifies or verifies a person from their facial features — treated as biometric, special category data processing under GDPR when used to uniquely identify someone (Article 9).
Decisions made about a person using only automated systems (like AI or algorithms), without meaningful human involvement (Article 22).
Pre-approved legal agreements for GDPR-compliant data transfers outside the EU (Articles 46(2)(c), 46(5)).
The right to request the deletion of personal data under specific conditions (Article 17).
Ensuring privacy settings are configured to the highest level by default (Article 25).