AI video analytics introduces specific GDPR considerations beyond standard CCTV because the system actively processes video to extract structured information about identifiable individuals — their location, movement patterns, and behaviour. Understanding these considerations is essential for any organisation deploying AI analytics in the UK or EU, because a DPO or legal team that cannot get clear answers on data privacy will delay or block the procurement.
This page provides general guidance for informational purposes only. It does not constitute legal advice. GDPR obligations vary by organisation type, jurisdiction, and deployment context. Always consult your Data Protection Officer or legal counsel.
Standard CCTV is relatively well understood under GDPR — it records footage that may contain images of identifiable individuals, and the standard compliance framework applies. AI analytics introduces an additional layer: the system is not just recording footage passively, it is actively processing it to extract structured information about individuals.
This active processing may include identifying people's locations within a facility, tracking their movement trajectories across cameras, classifying their behaviour (running, loitering, carrying objects), and generating structured event logs that describe individual activity over time. This is a fundamentally different processing operation from passive recording, and GDPR treats it differently.
Three questions a DPO will ask: (1) What personal data is being processed? (2) What is the lawful basis for processing it? (3) Are there special category data implications?
Raw footage is personal data if individuals are identifiable — by appearance, clothing, context, or other distinguishing features. This is the same classification as standard CCTV and carries the same obligations.
The structured event data generated by the AI — person detected in zone 3 at 14:27:03, remained for 47 seconds, trajectory from entrance to server room — is also personal data. It describes the movements and behaviour of identifiable individuals in a structured, searchable format. In some respects, metadata is more privacy-sensitive than raw footage because it is easier to search, aggregate, and correlate across time periods.
If the AI processes facial features for recognition or identification purposes, this constitutes special category biometric data under GDPR Article 9, requiring explicit consent or a specific exemption. Most object detection and behaviour analytics do not use facial recognition — they detect 'a person' without identifying who that person is. This distinction is critical and should be clearly documented in the DPIA.
If the system aggregates movement data over time to build patterns — for example, tracking an individual's routine movements through a facility across multiple days — this may constitute profiling under GDPR Article 4(4). Retention of metadata and event logs should be treated with the same care as footage retention.
Most commercial AI video deployments rely on legitimate interests as the lawful basis for processing. This requires a documented Legitimate Interests Assessment (LIA) that demonstrates: the processing serves a genuine security interest, it is necessary (less invasive alternatives would not achieve the same outcome), and the individual's rights do not override the organisation's interests.
A Data Protection Impact Assessment (DPIA) is required where the deployment is likely to result in high risk to individuals. Large-scale systematic monitoring using AI analytics almost always meets this threshold. The DPIA should cover: processing purposes and scope, data flows (where footage and metadata are stored, who has access, whether third-party processors are involved), retention periods for both footage and metadata, risk mitigation measures, and the DPO's assessment.
For AI video analytics deployments, a DPIA is not optional in practice — even if the legal threshold is debatable, conducting one demonstrates due diligence and is expected by regulators.
Privacy by design means building data protection into the deployment architecture from the start, not adding compliance measures after the system is operational.
Minimum viable detection: Configure the system to detect only what is operationally necessary. Do not enable all available detection classes by default — if the security requirement is perimeter intrusion, detect people and vehicles only. Disabling unnecessary detection classes reduces the volume of personal data processed.
Retention minimisation: Set the shortest retention period consistent with operational needs. Differentiate between continuous footage (shorter retention — typically 30 days) and AI-flagged event clips (longer retention if justified by investigation requirements). See the video retention policy guide for sector-specific recommendations.
Access controls: Restrict access to live and recorded footage to named individuals with documented operational need. Role-based access control should limit who can view live feeds, who can search recorded footage, and who can export clips.
Audit logging: Maintain detailed logs of who accessed footage, when, and for what purpose. These logs are required for responding to Subject Access Requests and regulatory inquiries, and they provide the evidence trail that demonstrates compliance.
Data processor agreements: If using a cloud analytics platform or third-party storage provider, a Data Processing Agreement (DPA) must be in place. The DPA defines the processor's obligations regarding data security, retention, breach notification, and sub-processor management.
SafetyScope is designed with privacy by design principles. The platform provides granular retention controls that allow different retention periods for continuous footage vs AI-flagged events, role-based access management with full audit logging of all footage access and export activity, and a standard Data Processing Agreement for all cloud deployments.
The platform does not use facial recognition for standard detection operations — it identifies 'person' as an object class without processing biometric facial data. For on-premises deployments, all footage and metadata remain within the customer's network boundary, with no data transmitted externally.
Published: 2026-03-02 · Updated: 2026-04-02