CEN/TR 18241:2025

SLOVENSKI STANDARD
kSIST-TP FprCEN/TR 18241:2025
01-oktober-2025
Vodenje zasebnosti pri izdelkih in storitvah - Izdelki in storitve za biometrični
nadzor dostopa
Privacy management in products and services - Biometric access control products and
services
Biometrische Zugangskontrolle mit Gesichtserkennung
Management de la protection de la vie privée dans les produits et services - Produits et
services de commande d'accès biométrique
Ta slovenski standard je istoveten z: FprCEN/TR 18241
ICS:
35.030 Informacijska varnost IT Security
35.240.15 Identifikacijske kartice. Čipne Identification cards. Chip
kartice. Biometrija cards. Biometrics
kSIST-TP FprCEN/TR 18241:2025 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

kSIST-TP FprCEN/TR 18241:2025
kSIST-TP FprCEN/TR 18241:2025
TECHNICAL REPORT FINAL DRAFT
FprCEN/TR 18241
RAPPORT TECHNIQUE
TECHNISCHER REPORT
July 2025
ICS
English version
Privacy management in products and services - Biometric
access control products and services
Management de la protection de la vie privée dans les Biometrische Zugangskontrolle mit Gesichtserkennung
produits et services - Produits et services de
commande d'accès biométrique
This draft Technical Report is submitted to CEN members for Vote. It has been drawn up by the Technical Committee
CEN/CLC/JTC 13.
CEN and CENELEC members are the national standards bodies and national electrotechnical committees of Austria, Belgium,
Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of North Macedonia, Romania, Serbia,
Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and United Kingdom.

Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are
aware and to provide supporting documentation.

Warning : This document is not a Technical Report. It is distributed for review and comments. It is subject to change without
notice and shall not be referred to as a Technical Report.

CEN-CENELEC Management Centre:
Rue de la Science 23, B-1040 Brussels
© 2025 CEN/CENELEC All rights of exploitation in any form and by any means
Ref. No. FprCEN/TR 18241:2025 E
reserved worldwide for CEN national Members and for
CENELEC Members.
kSIST-TP FprCEN/TR 18241:2025
FprCEN/TR 18241:2025 (E)
Contents Page
European foreword . 4
Introduction . 5
1 Scope . 6
2 Normative references . 6
3 Terms and definitions . 6
4 General. 6
4.1 Preparing the grounds for data protection and privacy by design and by default . 6
4.2 Structure for disassembling product and service into applicable categories . 6
4.2.1 Introduction . 6
4.2.2 Product layers . 6
4.2.3 Service layers . 7
4.3 Self-declaration and levels of achievement . 7
5 Process for a privacy aware development of products and services . 7
5.1 Leadership and market intelligence . 7
5.2 Preparation . 7
5.3 Design . 7
5.3.1 Determination of DPbPP requirements . 7
5.3.2 Development . 7
5.3.3 Production and service provision . 7
5.3.4 Release of products and services . 7
5.4 Performance evaluation . 7
5.5 Improvement . 7
6 Basic requirements on the design of products and services . 8
6.1 Access . 8
6.1.1 Access to data . 8
6.1.2 Copy of data . 8
6.2 Accountability . 8
6.3 Accuracy . 8
6.4 Data de-identification . 8
6.5 Data minimization . 9
6.6 Data portability . 9
6.7 Confidentiality . 9
6.8 Erasure. 9
6.9 Fairness . 9
6.9.1 Determination of user age . 9
6.9.2 Configurable children age threshold . 9
6.10 Information security . 9
6.10.1 Unauthorized or unlawful processing . 9
6.10.2 Data loss . 9
6.10.3 Information protection targets . 9
6.10.4 Restore . 10
6.11 Lawfulness . 10
6.11.1 Data disclosure . 10
6.11.2 Consent . 10
kSIST-TP FprCEN/TR 18241:2025
FprCEN/TR 18241:2025 (E)
6.12 Objection to processing . 10
6.13 Automated decision making . 10
6.14 Restriction of processing . 10
6.15 Storage limitation . 10
6.16 Transparency . 10
6.16.1 Information . 10
6.16.2 Record of processing activities . 10
7 Requirements to the self-declaration of privacy aware design . 11
7.1 Process requirements . 11
7.2 Preparation based on the product and service layer requirements . 11
7.3 Preparation additionally based on conduction of a DPIA . 11
7.4 Determination of the level of achievement . 11
7.5 Self-declaration statement . 11
Bibliography . 12

kSIST-TP FprCEN/TR 18241:2025
FprCEN/TR 18241:2025 (E)
European foreword
This document (FprCEN/TR 18241:2025) has been prepared by Technical Committee CEN-
CENELEC/JTC 13 “Cybersecurity and Data Protection”, the secretariat of which is held by DIN.
This document is currently submitted to the Vote on TR.
This document has been prepared under a Standardization Request given to CEN by the European
Commission and the European Free Trade Association, and supports essential requirements of
EU Directive(s) / Regulation(s).
kSIST-TP FprCEN/TR 18241:2025
FprCEN/TR 18241:2025 (E)
Introduction
EN 17529 applies to all products and services in general, in order to achieve data protection and privacy
by design and by default. Its scope includes biometric access-control products and services. For this
specific category of products and services, this document adds information that explains how industry
can use EN 17529 in the case of biometric access-control pro
...