This document contains recommendations on how to integrate the principle of data protection and privacy by design during the entire lifecycle of biometric access-control products and services, in order to achieve data protection and privacy by default . NOTE 1 The GDPR requires the effective integration of data-protection safeguards into the processing of personal data (Article 25). NOTE 2 Biometric access control includes cards and passports, biometric comparisons on card, in databases and a combination of both, as well as one-to-one and one-to-many (and many-to-many) comparisons. NOTE 3 Biometric access control is used at work and border control as well as in combination with cards and PINs and in online and mobile services. Facial recognition for access control is covered by this document. This document extends EN 17529. This document applies to aspects of data protection and privacy by design. This document is not applicable to non-biometric aspects of access control, or to aspects not relating to data protection or privacy. NOTE 4 In general, biometrics is for example covered by ISO/JTC 1/SC 37 and CEN/TC 224/WG 18.