Selfie ID Verification for Candidates: What the GDPR and Dutch Biometrics Rules Allow Since September 2026

Remote identity checks promise faster starts: the candidate photographs their ID, takes a selfie, and software confirms the two faces match. The legal picture is less simple, and it changed on 1 September 2026. This article helps data protection officers, compliance leads and HR directors frame the biometric question for counsel.

What are the three questions behind selfie ID verification?

Three separate legal questions sit behind every selfie ID match. No tool design answers them, and a yes to one does not settle the others.

Arguments such as "it is only verification", "candidates consent" or "employers must check identity anyway" each answer one question and leave the other two open.

Is matching a selfie to an ID photo biometric data?

Usually yes, when software compares the two faces. The GDPR defines biometric data as personal data resulting from specific technical processing of a person's physical characteristics that allow or confirm their unique identification, and names facial images as an example (GDPR, Article 4(14)).

Recital 51 adds a limit: a photograph becomes biometric data only when processed through specific technical means that allow the unique identification or authentication of a person. A tool that converts both photos into facial measurements and compares them does exactly that.

Article 9(1) prohibits processing biometric data for the purpose of uniquely identifying a natural person. Some providers argue that a one to one check only confirms a claimed identity and so falls outside the prohibition. Two points weigh against relying on that:

In our view, an employer or agency should treat a selfie ID match as Article 9 processing unless its own counsel concludes otherwise in writing.

Two points often cause confusion. First, deleting the selfie quickly does not take the check outside the GDPR, because processing includes collection and use as well as erasure (GDPR, Article 4(2)). Second, the AI Act excludes systems whose sole purpose is to confirm that a person is who they claim to be from its high risk entry for remote biometric identification (AI Act, Article 3(36) and Annex III, point 1(a)). That exclusion concerns AI Act classification only. It does not lift the GDPR prohibition. Our article on the EU AI Act and recruitment covers the AI Act's wider rules for hiring tools.

What changed in the Dutch biometrics exception on 1 September 2026?

The Dutch exception now also requires a substantial public interest in lawful access. The GDPR lets member states create exceptions for reasons of substantial public interest, with suitable safeguards, and add conditions for biometric data (GDPR, Article 9(2)(g) and 9(4)). The Netherlands did this in Article 29 of the Uitvoeringswet AVG (UAVG).

The change was made by the Verzamelwet gegevensbescherming (Staatsblad 2026, 154, article I, part K) and took effect on 1 September 2026 under its commencement decree (Staatsblad 2026, 196). The consolidated text on wetten.overheid.nl shows the new wording in force from that date.

The explanatory memorandum to the bill sets out the intent (Kamerstukken II, 36264, nr. 3):

What does that mean for candidate checks? In our reading, faster onboarding and less identity fraud are real aims, but they are business interests, and a routine candidate check does not control lawful access to a protected place or system. It is hard to see how it meets the new test; counsel should confirm any case where an organisation thinks it does.

Even under the old, wider wording, the Amsterdam subdistrict court ruled in 2019 that a retailer could not require an employee to log in to its tills with a fingerprint. Preventing fraud did not make the processing necessary, and the employer had not shown why it chose fingerprints over passes or codes (Rechtbank Amsterdam, ECLI:NL:RBAMS:2019:6005). In our view, that reasoning weighs at least as heavily under the 2026 text.

Why is candidate consent rarely enough?

Rarely, because a job applicant seldom has a free choice. The GDPR allows special category data to be processed with explicit consent (Article 9(2)(a)), but consent must be freely given. Recital 43 says consent should not be a valid ground where there is a clear imbalance between the parties, Article 7(4) looks at whether something the person wants is made conditional on consent, and Article 7(3) requires withdrawal to be as easy as giving consent.

The memorandum to the 2026 change addresses working relationships directly. Because employees depend on their employer, it says consent to biometrics can be freely given where employees are offered alternatives, such as a password or a token, and feel no pressure to choose the biometric option (Kamerstukken II, 36264, nr. 3). A candidate who needs the job is, if anything, in a weaker position than an employee.

Consent can only carry weight where:

The common mistake is a consent tick box in front of a selfie step that every candidate must pass: a condition of applying, presented as a choice.

The GDPR's employment law exception, Article 9(2)(b), needs authorisation by law or a collective agreement with appropriate safeguards. The Dutch identity duties below ask for a document and do not mention biometric comparison. Whether any other exception could apply in a particular case is a question for counsel.

When in the hiring process may identity be checked?

The legal duties attach to work, placement or mediation, not to applying. Each asks for a document:

None of these rules asks for face matching, and none requires a check at the moment someone applies. The GDPR also limits personal data to what is necessary for the purpose (Article 5(1)(c)). A biometric check during the application, before any identity duty applies, is therefore the hardest version to justify. Our article on verifying frontline candidates before the offer sets out what may be checked at each step.

What must a DPIA and the provider's documentation cover?

Plan for a DPIA, and get the provider's answers in writing. The GDPR requires a data protection impact assessment for processing on a large scale of special category data (Article 35(3)(b)). The Dutch regulator's list of processing that always needs a DPIA includes processing on a large scale or systematic monitoring of biometric data aimed at identifying people (Staatscourant 2019, 64418, item 17). Volume hiring for frontline roles can reach that scale quickly.

Put these questions to any provider:

See how Radius describes its own safeguards and human review on our trust and compliance page.

What alternative route must candidates have?

A person checks the original document, at the moment the law requires it. That route uses no biometric processing and matches what the identity duties ask for. It can take three forms:

Offer this route to every candidate before any biometric step, not only to those who object, on the terms set out in the consent section above.

Illustrative example: an agency recruiting order pickers for a client's warehouse runs its interviews and requirement checks online. A recruiter checks the original identity document at a short intake before the first placement and takes the copy the law requires. Candidates who cannot attend do a video document check with a recruiter. No step depends on face matching, and no one is asked for a document copy during the application.

What does this mean for staffing agencies and frontline employers?

Three points matter most at volume:

What does this article not settle?

This article gives the framework, not an answer for any specific case. Whether a setup falls under Article 9, and whether an exception applies, depends on facts only the employer, its DPO and counsel can assess. Sector rules may create their own legal bases, which we have not reviewed. Guidance and case law on the new Article 29 text are still developing, so check the Dutch data protection authority's current guidance on biometrics before you decide.

How Radius helps

Radius Hire is the AI hiring platform for frontline roles. Where the employer uses Radius Passport, it checks a candidate's identity and right to work with a trusted verification partner, and records certificates with their expiry dates. It does not replace the employer's own legal duty to check identity.

Radius never rejects a candidate on its own. A recruiter reviews the evidence, can overrule anything Radius presents and makes every hiring decision. Candidate data is hosted in the EU and processed under a data processing agreement, and the employer sets how long it is kept. If you assess Radius, put the questions in this article to us as you would to any provider, and record the answers in your DPIA. See how the platform works, how Radius supports staffing agencies and our trust and compliance page.

Conclusion

A selfie ID check is three decisions. In most setups the face comparison is biometric processing under Article 9 of the GDPR. Since 1 September 2026 the Dutch exception also needs a substantial public interest in lawful access, and efficiency or cost savings do not count. Consent rarely rescues the check, because a candidate seldom has a free choice. Dutch identity duties ask for a document before work, a placement or a proposal, not a face match at the application. The safest design has a person check identity at the legal moment and treats any biometric option as something to justify in a DPIA with counsel.