Biometric authentication verifies a person by a physical trait such as a fingerprint, a face or an iris, instead of something they know (a password) or carry (a card). In screen and video platforms it shows up at two very different points: staff signing into the management system, and visitors identifying themselves at a kiosk.
The staff case is straightforward and usually a net gain, because it rides on the device's own secure enclave: the fingerprint never leaves the phone or laptop, and the platform only receives a yes.
The caveat is the visitor case, and it is a different risk entirely. A kiosk capturing a biometric is processing special-category data under GDPR and KVKK, requiring explicit consent, a retention policy, and a genuine alternative for anyone who declines. Unlike a password, a biometric cannot be reset after a breach. The subject is stuck with it for life, which is why regulators treat it as they do.
The practical rule: authenticate against the device, never against your own biometric database. If a proposal involves storing templates on your infrastructure, the question to answer first is what happens when that store is compromised.