Face Recognition for Attendance: The Permit Most Buyers Do Not Know About

Consent matters, and it is not the constraint that decides whether the project is lawful. Under Oman's Personal Data Protection Law, issued by Royal Decree 6/2022, processing biometric data is prohibited except after obtaining a permit from the Ministry. That sits in Article 5, alongside genetic data, health data, racial origin, religious and political opinions, and criminal records.

A face template is biometric data. So the sequence is not "get consent, then deploy". It is "obtain a permit, then deploy, with consent handled properly as well". Those are different projects with different lead times, and the difference is usually discovered after a purchase order has been raised.

Why consent cannot carry this on its own

Even setting the permit aside, employee consent is a weak foundation for biometric attendance, for a reason that has nothing to do with Oman specifically. Consent has to be freely given, and the employment relationship is not one in which refusal is costless. An employee told that the new attendance system uses their face is not in a strong position to decline, and a consent that could not realistically have been withheld is not worth much when examined.

This is why the serious question is not "did they agree" but "was there an alternative". A system that offers a non-biometric route for anyone who prefers one — a card, a PIN, a supervisor confirmation — makes the consent of everyone else meaningful. A system where the camera is the only way to be recorded as present has made agreement a condition of employment, which is a different thing entirely.

What the permit means for your timeline

The permit is an administrative process with defined characteristics, and they have direct project-planning consequences:

The 45-day figure is the one to plan around. A common pattern is to buy hardware, install it, and discover that the useful part cannot be switched on for another two months — during which the old attendance process has already been decommissioned. Sequencing the application first costs nothing and removes that gap entirely.

The obligation to hold a permit sits with the controller: the employer processing its own employees' data. A vendor cannot hold it on your behalf, and a vendor claiming its product removes the requirement is describing something other than the law. What a vendor can reasonably do is make the application answerable — which means being able to state what is stored, in what form, where, and for how long.

The technical decision that changes the compliance question

There is a meaningful difference between a system that stores photographs of your staff and one that stores a mathematical template derived from a face and discards the image. Both are biometric processing. But the second holds less, is not useful to anybody who steals it, and is far easier to describe accurately in a permit application and a privacy notice.

Where inference runs matters for the same reason. A system that processes on-premise and never transmits face data offsite has no cross-border transfer question to answer — and the PDPL controls cross-border transfers, so avoiding the question is cheaper than answering it. A cloud service processing faces outside Oman is not automatically unlawful, but it adds an obligation you would otherwise not have.

Ask any vendor these three things in order: is the raw image retained, where does matching happen, and what exactly leaves the site. The answers determine how much of the PDPL you have to engage with at all.