Retailers often assume that any camera-based counting system is a privacy problem waiting to happen. In practice the opposite is usually true: counting people well is one of the least invasive ways to measure a store, provided the system is designed, configured and documented correctly. The risk is not the camera. The risk is a deployment that quietly collects more than it needs, stores it longer than necessary, and leaves no record of either.
This article explains the distinction that everything else depends on — counting versus identifying — then covers GDPR essentials, a country-by-country snapshot for Southeast Asia, and a practical checklist you can hand to a supplier or an internal risk team.
Not legal advice. The law names and dates below are provided for orientation. Data protection regimes change frequently and enforcement practice varies by jurisdiction. Confirm your specific obligations with qualified local counsel before you deploy.
The core distinction: counting is not identifying
People counting systems detect that someone is present and that they moved in a certain direction. Identification systems determine who that someone is. Almost every compliance question resolves into which of the two your system actually does.
The design goal is a pipeline that:
- detects people as generic objects or silhouettes, without a face template;
- outputs counts, directions, dwell times and heatmaps as aggregate data;
- does not retain raw images, or retains them only for a short, defined period;
- does not run facial recognition, and cannot be switched on to do so accidentally.
That is achievable with current technology. Depth-based 3D and thermal sensing can be especially privacy-friendly because neither depends on a recognisable visual likeness.
But "we count, we don't identify" is a design intention, not a legal conclusion. You have to be able to demonstrate it, in configuration and in documentation.
When anonymous counting stops being anonymous
Anonymity can break in ways retailers do not expect:
- Any stored video frame in which a person is identifiable is personal data under most regimes, even if nobody ever looks at it.
- Persistent tracks that follow an individual through a store over time can become personal data when combined with other sources, such as payment or loyalty data.
- Biometric templates used for unique identification fall into a special, more sensitive category.
- Inferred attributes — age or gender estimates, for example — carry extra obligations in several jurisdictions.
The practical rule: the more granular and the longer-lived the data, the more likely it is to attract full personal-data obligations. Design for minimum granularity and minimum retention.
Design choices that keep a deployment defensible
- Process at the edge. Compute counts on the device and transmit only results, not video.
- Store aggregates, not frames. Keep counts, dwell distributions and heatmaps; avoid retaining raw imagery.
- Set short retention. If video must be stored briefly, define and enforce the shortest interval that serves the purpose.
- Disable identification features permanently. If a platform ships a face-recognition module, ensure it is disabled and cannot be re-enabled without a documented, authorised change.
- Segment the network. Put counting devices on a separate VLAN with restricted outbound access.
- Encrypt in transit and at rest, and control access by role.
- Sign a data processing agreement with any vendor that handles data on your behalf.
GDPR essentials for retail counting
The General Data Protection Regulation — Regulation (EU) 2016/679 — has applied since 25 May 2018 across the EU (and, in national form, in the EEA and the UK). For a counting deployment the relevant points are:
- Lawful basis. Where no personal data is processed, GDPR does not apply at all. Where it does — for example, if identifiable video is stored — many retailers rely on legitimate interests under Article 6(1)(f). That basis requires a documented balancing assessment (a legitimate interest assessment), not just an assertion.
- Data protection impact assessment (DPIA). Article 35 requires a DPIA for processing likely to result in high risk, including systematic monitoring of a publicly accessible area on a large scale. Whether a given counting system crosses that threshold depends on scale, granularity and retention — assess it rather than assume.
- Transparency. Articles 12–14 require clear information to individuals. In practice this means signage at entrances, with a layered notice (for example, a QR code leading to full detail).
- Data minimisation and storage limitation. Article 5 requires you to collect only what you need and keep it only as long as necessary. This is where most avoidable risk lives.
- Processor relationships. Article 28 requires a written contract with any vendor processing data on your behalf, covering scope, security and sub-processors.
- International transfers. Chapter V governs transfers outside the EEA — relevant whenever your analytics platform or support is hosted in another region.
- Special category data. Article 9 applies where biometric data is processed for the purpose of uniquely identifying a person. Avoiding identification avoids this category entirely.
- National guidance. Some member states add their own CCTV rules, and supervisory authorities publish CCTV guidance worth reading even where not strictly binding.
Southeast Asia: a country-by-country snapshot
Across the region, comprehensive data protection laws now exist in all five major markets, but their maturity, guidance and enforcement differ considerably.
Vietnam
Vietnam's Personal Data Protection Decree — Decree 13/2023/ND-CP, commonly called the PDPD — took effect on 1 July 2023 and is the framework most teams currently plan around. It introduced obligations around consent, notice, impact assessments and cross-border transfers. Vietnam has since moved toward a dedicated data protection law; confirm its commencement and any implementing guidance with local counsel, as the position is evolving.
Thailand
Thailand's Personal Data Protection Act B.E. 2562 (2019), referred to as the PDPA, came into force on 1 June 2022, with the Personal Data Protection Committee (PDPC) as regulator. It follows a GDPR-like structure: lawful basis, notice, data subject rights, breach notification and cross-border transfer rules. Video surveillance guidance has been issued, and retailers should treat employees and customers separately.
Indonesia
Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP) was enacted in October 2022 with a two-year transition period that ended in October 2024. It establishes data subject rights, consent requirements and transfer conditions. Implementing regulations have been developed in stages, so confirm current detailed requirements locally.
Philippines
The Data Privacy Act of 2012 (Republic Act No. 10173) is one of the region's older comprehensive regimes and is enforced by the National Privacy Commission (NPC). The NPC has issued advisories and guidance on CCTV use, including requirements around notice and proportionality, making it a useful reference for retail deployments.
Practical takeaway for multi-country retailers: these laws converge on the same handful of duties — lawful basis, notice, minimisation, retention limits, security and vendor contracts. One well-documented deployment can usually satisfy all of them, with local counsel reviewing market-specific details.
What you must tell people
Whatever the jurisdiction, transparency requirements look similar in practice:
- a visible sign at each entrance, before people enter the monitored area;
- the purpose in plain language ("measuring visitor numbers");
- who the controller is, and how to contact them;
- a layered notice for anyone who wants detail;
- a separate, clearer notice to staff about workplace monitoring.
Do not describe the system as "security cameras Only" if it also performs analytics, and do not describe analytics as "anonymous" unless you can evidence the absence of stored identifiable data.
Retention and deletion strategy
Retention is where good intentions most often fail. Define a schedule per data type and automate it:
- Counts and aggregates: retained longest, being least sensitive. Set a retention horizon tied to a business need, such as a rolling comparison period.
- Track or path data: retained only as long as the analysis requires; often days rather than months.
- Video: ideally not stored at all. Where stored, keep the minimum, encrypt it, and purge automatically.
- Backups: include them in the deletion schedule; retention failures usually hide in backups.
- Vendor access logs: retain long enough to audit.
If you hold no personal data, access and objection requests become far simpler to answer — a strong argument for the design above.
Questions to ask your supplier
Useful procurement questions for any counting vendor:
- Does the device store or transmit video by default, and can recording be disabled while analytics continue?
- Where is data processed — on the device, on a local server, or in the cloud — and in which region?
- Does the platform include facial recognition or biometric identification? Can it be permanently disabled and proven disabled?
- Exactly what data is exported: counts, tracks, images, inferred demographics?
- What retention controls exist, and can they be enforced from the platform?
- Is data encrypted in transit and at rest? How is access controlled and logged?
- Will you sign a data processing agreement, and can the system run entirely on-premise if required?
- Who are your sub-processors, and where are they located?
You can see how these principles map onto real deployments in our solutions, and read about how we build for privacy-by-design on our about page.
Compliance self-check list
- [ ] Determine whether the system processes personal data at all, and document the reasoning.
- [ ] Confirm the lawful basis, and complete a balancing assessment if relying on legitimate interests.
- [ ] Screen for DPIA requirement if monitoring public areas at scale.
- [ ] Install entrance signage with purpose, controller identity and contact.
- [ ] Issue a separate staff monitoring notice.
- [ ] Configure edge processing so raw video is not retained.
- [ ] Set and enforce a retention schedule per data type, including backups.
- [ ] Disable identification features and record the setting in the deployment log.
- [ ] Sign a data processing agreement and confirm data residency.
- [ ] Segment the network and restrict device outbound access.
- [ ] Keep an access log and review it periodically.
- [ ] Re-review after any refit, firmware change or platform migration.
FAQ
Can we run people counting without customer consent? In many jurisdictions, yes — either because the system processes no personal data, or because you rely on a lawful basis such as legitimate interests with proper notice and a documented assessment. Confirm the position for your configuration and market with counsel.
If the data is anonymous, does GDPR still apply? Truly anonymous data — which cannot be reconnected to an individual by any means reasonably likely to be used — falls outside GDPR. The risk is that tracks, timestamps and location data, combined with other sources, can make data personal again. Test that assumption.
Do we need a DPIA? Not automatically, but systematic monitoring of publicly accessible areas on a large scale is a recognised trigger. Assess it, document the conclusion, and refresh it if the deployment changes.
Is a store heatmap personal data? An aggregate heatmap showing where crowds stand is generally low risk. One that can be traced to an individual, or derived from persistent personal tracks, is a different matter. Granularity decides.
Does a camera that counts people count as "processing personal data"? Not necessarily — if it genuinely outputs only aggregates and stores nothing identifiable, it may sit outside the scope of personal data law. That is exactly why privacy-preserving architecture is worth insisting on during procurement.
Next step
Privacy compliance in retail counting is mostly a matter of architecture and documentation, not of avoiding the technology. Choose a deployment that counts without identifying, notify clearly, retain little, and keep a record of every decision. If you want help scoping a privacy-by-design rollout for your stores, our team can walk through the configuration options with you.