VFS Global founder and CEO Zubin Karkaria has said the company does not retain applicants’ biometric data, explaining that fingerprints and photographs collected during visa applications are transferred to the relevant embassy or government system.
In an interview with NDTV, Karkaria addressed concerns about the handling of sensitive personal information and reports questioning the company’s data practices. He said biometric information is transmitted to the government responsible for the visa application rather than being stored by VFS Global.
The assurance is significant for millions of travellers who submit fingerprints, facial photographs and passport information through outsourced visa application centres. It also raises a broader question: who controls that data after it leaves the collection centre, and what safeguards protect it?
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
What Happens When You Give Your Fingerprints?
Karkaria described the biometric collection process as a controlled transfer from the application centre to the relevant government.
Applicants place their fingers on a digital scanner and provide their passport information and facial photograph. Once the required information is captured and checked, it is transmitted to the embassy or government server.
He said the frontline computers used by VFS Global function as restricted terminals and that staff cannot download, save or print biometric data from them.
“I don’t keep any biometrics,” Karkaria told The Indian Express in a separate interview.
The claim concerns VFS Global’s own handling of the information. It does not mean the government receiving the application deletes the data immediately or that biometric information is never stored anywhere.
Who Actually Stores Visa Biometric Data?
VFS Global acts as an outsourced service provider for governments. Its role can include collecting applications, documents and biometric information, while the relevant government retains responsibility for visa decisions.
The storage and retention rules depend on the destination country.
For example, the European Commission states that fingerprints and digital photographs collected for Schengen visas are recorded in the Visa Information System, a secure central database. Fingerprints may be reused for subsequent applications within the prescribed period.
Similarly, the United States Department of State explains that visa applicants’ electronic fingerprints are stored in a government database and can be used for identity verification at US ports of entry.
These examples show why the statement “VFS does not keep biometrics” must not be confused with “your biometrics are not stored”. The receiving government may retain them under its own legal and administrative framework.
Why Is Biometric Data Sensitive?
Unlike a password, biometric characteristics cannot easily be changed if they are compromised. This makes the security of collection, transmission, storage and access particularly important.
Biometrics can help prevent identity fraud and the use of stolen or counterfeit travel documents. However, their value as identity markers also means that misuse or unauthorised access can create serious privacy risks.
What Personal Information Does VFS Retain?
Karkaria said the company retains limited personal information only for the period required by the relevant government or to complete the service.
In his interview with The Indian Express, he said details such as a name, telephone number and address are kept until the passport is returned and are then automatically erased.
The NDTV interview also referred to government-mandated retention periods before information is purged.
Those statements should be understood as the company’s description of its practices. Retention requirements may differ depending on the country, visa category and applicable contract.
The publicly available interview material does not provide a complete technical breakdown of every database, backup system or government-specific retention schedule.
Security Controls Extend Beyond Computer Systems
Karkaria also described operational safeguards used to protect passports and application materials.
He said VFS Global monitors vehicles transporting passports, including their routes and unexpected stops. The company’s systems can alert staff if a vehicle deviates from its assigned route or remains stationary beyond a specified period.
He also referred to internal compliance checks and audits carried out by governments and external bodies.
These measures are intended to reduce risks involving physical documents and sensitive applicant information. However, the number of audits or existence of monitoring systems alone does not establish that a company is immune from data breaches or misconduct.
Independent verification, incident reporting and clear accountability remain essential parts of a credible security framework.
VFS Rejects Claims Raised in Lighthouse Report
The NDTV interview addressed allegations and questions raised in a Lighthouse report concerning VFS Global’s handling of applicant data.
Karkaria rejected the claims and maintained that the company does not retain biometric information.
The full Lighthouse findings and supporting evidence were not available for independent examination in this review. It would therefore be inappropriate to declare the allegations disproven or to treat them as established facts.
The distinction is important: a company’s denial is part of the public record, but an independent assessment requires access to the underlying evidence and technical practices.
What Applicants Should Check Before Submitting Data
Visa applicants should use official embassy websites or authorised service-provider portals to book appointments and confirm requirements.
They should also review the privacy notice for the specific destination country, because the government receiving the application determines how biometric information may be used and retained.
Applicants can look for information about the purpose of collection, retention periods, access rights, data-sharing arrangements and available complaint mechanisms.
A visa application centre should never be treated as an independent authority that can guarantee a visa. The decision remains with the relevant government.
What this means for you: Your fingerprints and facial photograph may be retained by the destination government even when the collection provider says it does not store them. Read the relevant country’s privacy notice and use only authorised appointment channels. Do not provide biometric information to unknown agents promising guaranteed visas, faster approvals or special access.
The420 Insight: The most important distinction in the interview is between collecting data and controlling its long-term storage. VFS Global’s assurance addresses its own systems, but applicants also need transparency from the governments that receive and retain biometric records. Security claims should be supported by independently verifiable controls, clear retention rules and accessible complaint procedures. As biometric identity systems expand, accountability must cover the entire chain of custody rather than only the point where a fingerprint is captured.
https://www.linkedin.com/company/policetechnology/
