Illinois BIPA

Illinois Biometric Information Privacy Act - written consent, retention schedule, private right of action.


Short name	BIPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers BIPA

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for BIPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for BIPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`IL-BIPA-15E` Reasonable Standard of Care in Storage	Private entities must store, transmit, and protect biometric data using the reasonable standard of care within their industry, which implies verifiable integrity of the software systems storing and transmitting that data (740 ILCS 14/15(e))	Scan
`IL-BIPA-15A` Retention Schedule and Destruction Policy	Entities in possession of biometric data must maintain a written, publicly available retention schedule and destruction guidelines, which requires formally identified, timestamped documentation of the systems holding the data (740 ILCS 14/15(a))	Scan
`IL-BIPA-15B` Informed Written Consent Transparency	Collection of biometric data requires prior written notice and a written release from the subject; supporting such demonstrable transparency calls for standard machine-readable descriptions of the collecting systems (740 ILCS 14/15(b))	Scan
`IL-BIPA-15D` Disclosure and Third-Party Restrictions	Biometric data may not be disclosed or disseminated without consent or another statutory basis; enforcing this restriction requires knowing which suppliers and third-party components can access or move the data (740 ILCS 14/15(d))	Scan
`IL-BIPA-INV` Knowledge of Biometric Processing Systems	Complying with retention, destruction, and protection duties presupposes the entity knows which systems and software components hold or process biometric data at all, i.e. an enumerated component inventory (740 ILCS 14/15, possession-based duties)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`BIPA-10`	Biometric Identifier Definitions
`BIPA-15a`	Written Retention & Destruction Policy
`BIPA-15b`	Informed Written Consent
`BIPA-15c`	Prohibition on Sale or Profit
`BIPA-15d`	Third-Party Disclosure Restrictions
`BIPA-15e`	Storage & Transmission Standards
`BIPA-20`	Private Right of Action Remediation Tracking
`BIPA-15a-DESTROY`	Biometric Data Destruction

Policy templates

Written for BIPA:

BIPA Written Biometric Data Policy
BIPA Informed Consent Procedure

And 22 from the standard set, adapted to BIPA.