A face is SPI. ‘Security camera’ is not a blank cheque for identification.
Facial recognition processes biometric PI, which PIPL treats as sensitive. You generally need a specific purpose, necessity, strict protection, separate consent unless another basis truly fits, and a PIA. CAC and SPC-facing rules on processing faces in public spaces tighten notice, necessity and image-collection in malls, communities and similar venues. Workplace time-clock faces are not automatically lawful because HR wants them — many employers should prefer cards or PINs. Storing face templates overseas is both SPI and a CBDT problem. Do not scrape faces off the street to train a model.
4 questions before you choose the route.
This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.
Is it identification or mere recording?
Template vs a tape nobody searches.
UseIs the space public, workplace, or access control?
Different necessity stories.
PlaceSeparate consent or another basis?
SPI gate.
ConsentWhere are templates stored?
Onshore vs export.
StoreWorking rule: Map the regulated role before marketing or launch in China.
The signal ledger.
These facts move the question beyond a label and into a product, money-flow and control analysis.
Bring a compact evidence docket—not a pitch deck.
Give a compliance team or counsel the operating facts that reveal the perimeter.
Questions people ask before they build.
Short answers for orientation. The right result can change with the service model and current rules.
Can a residential compound require face entry?
Necessity and notice rules are strict. Alternatives usually need to exist. Do not self-serve a ‘yes’.
Is a Zoom virtual background facial recognition?
Ordinary video conferencing is not the same as building a biometric template library — but storing face embeddings is.
Primary authorities
Reviewed sources support orientation, not a fact-specific assessment.