Biometrics — fingerprints, facial recognition, voice — promise stronger verification. But in South Africa, biometric data sits inside the strictest category of the Protection of Personal Information Act (POPIA), and using it without care can create more risk than it removes.

What POPIA says

Under POPIA, biometric information is special personal information. Processing it is generally prohibited unless specific conditions are met — most importantly, that the person has given informed, voluntary consent, and that the processing is necessary and proportionate.

That means you cannot simply start collecting fingerprints or facial scans because the technology allows it. You must be able to justify the why.

The consent problem

Consent is only meaningful if it is informed and freely given. A customer hurried through a sign-up screen with a pre-ticked box has not truly consented. Consent that is bundled, buried or coerced does not survive scrutiny — and a POPIA breach carries real consequences, including penalties and reputational damage.

Getting the balance right

The answer is not to avoid biometrics, but to use them deliberately. Strong verification does not always require a biometric. In many cases, a well-built identity and address check — backed by clear consent and a clean audit trail — delivers the assurance you need with far less legal exposure.

Where biometrics are genuinely justified, be transparent about what is collected, why, how long it is kept, and how a person can withdraw consent. Verification should build trust, not erode it.

J-Cred’s approach is to verify without unnecessary friction or unnecessary data — the right level of assurance, with consent at the centre.