The following Best Practices are guidelines for privacy-sympathetic deployment, providing institutions with an understanding of the types of protections and limitations commonly implemented. These Best Practices are meant to address the full breadth of biometric applications and technologies, from small-scale physical access to nationwide identification programs. Therefore, it is not expected that any deployment will be compliant with all Best Practices, and non-compliance with one or more Best Practices does not necessarily make a deployment privacy-invasive. If a certain deployment is not compliant, for example, with Best Practices relating to Scope and Capabilities, that deployment will need to comply with Best Practices relating to Disclosure, Auditing and Accountability in order to counterbalance this lack of compliance. It is helpful to think of these Best Practices as providing a wide range of checks and balances against potential privacy-invasive usage.