Few technologies generate as much policy debate and practical adoption simultaneously as facial recognition. Indian Railways has deployed facial recognition across 200 major stations for passenger identification and security surveillance. Airports in Delhi, Mumbai, Bengaluru, and Hyderabad use DigiYatra, a facial recognition-based boarding system that now processes over 4 million passengers monthly. The Election Commission of India uses facial recognition-enabled voter identification in several states.

Enterprise adoption is expanding into access control, attendance management, and fraud prevention. Banks are using facial recognition for video KYC — reducing the cost and friction of customer onboarding while improving identity verification accuracy. Manufacturing plants use biometric attendance systems that prevent proxy attendance, a significant payroll fraud risk in high-headcount operations.

India's DPDPA classifies biometric data as Sensitive Personal Data, requiring explicit consent, purpose limitation, and strict data minimisation. Deploying facial recognition for employee attendance without documented consent is no longer legally defensible. Storing facial recognition data beyond its necessary retention period creates regulatory exposure.

Globally, the EU's AI Act classifies real-time facial recognition in public spaces as a high-risk AI system subject to strict compliance requirements. Several US cities have banned law enforcement facial recognition entirely. India's regulatory direction is less restrictive than the EU but more protective than it was before DPDPA.