Biometric data is different from a punch card in one important way: an employee can be issued a new card, but they cannot be issued new fingerprints. That asymmetry is the whole basis for treating it carefully.
Store templates, never images
A properly configured terminal stores a mathematical template derived from the fingerprint, not a picture of it. The template cannot be reversed into a usable print. Confirm this with your vendor before deployment — it is the single most important technical control, and not every cheap device does it.
Tell people what you are collecting
Employees should know what is captured, why, how long it is retained and who can access it. This is straightforward to do — a short written notice at enrolment — and it removes most of the friction that biometric rollouts otherwise generate.
Offer an alternative where you can
Some people cannot enrol reliably: worn fingerprints from manual work are common in industrial settings. A card or PIN fallback is not a security weakness if it is logged the same way, and it prevents a small group of employees being penalised by the technology.
Delete on exit
When someone leaves, their biometric template should be deleted, not merely deactivated. Build this into the exit checklist alongside collecting the access card. Retaining biometric data for former employees serves no operational purpose and creates ongoing liability.
Restrict who can export
Attendance data reveals patterns of movement and presence. Limit export rights to named HR accounts, log every export, and avoid the common default where every supervisor has full admin access to the terminal.