The application of biometric data is increasingly prevalent. Examples include unlocking smart phones with fingerprints, identity authentication by voiceprints for telephone banking and access control at airports by facial recognition, etc. Biometric data is relatively sensitive personal data. Unlike passwords, one cannot ‘reset’ his/her biometric data if it is leaked. Extra caution is therefore warranted for its collection, use and security. The PCPD has recently revised the “Guidance on Collection and Use of Biometric Data”. We have elaborated on the good practices in collecting and using biometric data, thereby reinforcing the protection of sensitive personal data. Some noteworthy principles and measures for data collectors and users include: