Every safety manager who has proposed camera analytics knows the moment. You are in a meeting, the case for fewer injuries is watertight, and then someone from the workforce council folds their arms and asks the question that quietly kills the project: "So you're going to watch us all day, then." The room cools. The IT lead mentions GDPR. The idea is parked "until we've looked into the data protection side."
That instinct is correct. Camera analytics in a workplace is, in law, the systematic processing of personal data on a large scale. Handled carelessly, it is exactly the kind of surveillance the General Data Protection Regulation was written to restrain. Handled properly, it is not only lawful but defensible, and it earns the trust of the very people it protects.
The difference is not the technology. It is how you deploy it.
Why safety cameras are personal data, even without faces
A common misconception is that if a system does not run facial recognition, GDPR does not apply. It does. A person is "identifiable" if they can be singled out by any reasonable means, and on most sites the combination of shift rosters, a distinctive high-vis jacket and a timestamp is more than enough. Special-category biometric data carries its own heavy conditions, but you are firmly inside the regulation long before you get there.
So the question is never "does GDPR apply?" It always does. The question is whether your deployment satisfies it.
Start with a DPIA, and start early
Under Article 35, a Data Protection Impact Assessment is mandatory for systematic monitoring of a publicly or semi-publicly accessible area, and for large-scale processing. Workplace video analytics ticks both boxes. Skipping the DPIA is not a paperwork oversight; it is itself a breach.
Treat the video analytics DPIA as the design document for the whole rollout, not a form you complete afterwards. A sound one works through:
Necessity and proportionality
Can the safety outcome be achieved by less intrusive means? If a bollard or a physical barrier solves the vehicle-pedestrian conflict, use the bollard. Where a hazard genuinely requires eyes on it continuously, across a whole site, at three in the morning, human patrols are neither realistic nor safer. Write that reasoning down.
Lawful basis
Consent is almost never the right basis in an employment setting, because the power imbalance between employer and worker means consent cannot be freely given. Most deployments rest instead on legitimate interests, balanced against the rights of staff, or on the legal obligation to provide a safe place of work. Name your basis and justify it.
Data minimisation
This is where good safety AI separates itself from ordinary CCTV. The system should detect an event, not build a dossier. Capture the hazard, not the identity.
Risk mitigation
Retention limits, access controls, anonymisation, on-site processing. The mitigations are where a DPIA stops being theory.
The architecture is the compliance
Here is the point most vendors skate over. The single biggest factor in your CCTV privacy compliance is not policy wording. It is where the video is processed and where it goes.
A cloud-based analytics product streams your footage off-site to a third party's servers, often in another jurisdiction. That creates international transfer questions, expands the number of people who can theoretically view your staff, and hands a fresh target to anyone interested in your data. Every one of those is a line item on your risk register.
An on-premise system removes the problem at the root. The analysis happens on hardware inside your own perimeter. Footage never leaves the site. There is no transfer to assess, no third-party processor to audit, no cloud breach to notify. When the workforce council asks where the images go, the honest answer is: nowhere. They stay here, and they are deleted on schedule.
This is the design our own platform was built around, and it was not an afterthought. The detection was forged offshore, on drill floors in national oil-major operations, where footage of critical infrastructure cannot under any circumstances leave the installation. That constraint, proven across a major international port and airport as well, made on-premise processing and privacy-by-design non-negotiable from the first line of code, well before it became a selling point onshore. A system that already reduced unsafe behaviour by around 90 per cent without exporting a single frame is a system that meets a data protection officer's questions with answers, not apologies.
Anonymise by default
The strongest privacy posture treats identity as something the system actively avoids. A person on the ground is detected as a fall event and a location, not as "Dave from the second shift". Bounding boxes and silhouettes carry the safety signal; the underlying identity is neither extracted nor stored unless an incident genuinely requires review, and then only under controlled access. Configure retention so routine footage expires in days, not years. The less you keep, the less you can lose.
Bring people in before you switch it on
GDPR compliance and workforce trust are the same project viewed from two angles. Transparency is a legal duty under Articles 13 and 14, and it is also the thing that turns a suspicious workforce into a supportive one.
Tell staff what the system does and, just as importantly, what it does not do. It is not measuring productivity. It is not counting toilet breaks. It watches for the forklift reversing toward a blind corner and the colleague who has not moved in ninety seconds. Publish the DPIA summary. Consult the safety representatives. Put up clear signage. People accept a safety net far more readily than a spy, and the distinction is one you can prove.
A short checklist before go-live
- Completed DPIA, reviewed by your DPO, updated as the deployment changes.
- A documented lawful basis that is not employee consent.
- On-premise or edge processing, with a written data-flow map showing footage stays on site.
- Anonymisation by default and a defined, short retention period.
- Role-based access, audit logs and a breach-response plan.
- Worker consultation and transparent signage completed before switch-on.
Do this, and camera analytics stops being the project that dies in the meeting. It becomes the rare initiative that reduces injuries and satisfies the regulator and keeps faith with the workforce, all at once.
The GDPR compliance checklist for AI safety monitoring
Before deployment
- Complete a Data Protection Impact Assessment covering the processing description, necessity and proportionality assessment, risk assessment and proposed mitigation measures
- Update the employee privacy notice to describe the AI monitoring processing before the system goes live
- Notify employee representatives (trade unions, works council) of the monitoring scope and purpose
- Obtain Data Protection Officer review and approval of the DPIA
- Document the legal basis for the processing (legitimate interests in safety management, or compliance with a legal obligation under HASAWA)
At deployment
- Confirm that the technical configuration enforces the retention periods documented in the DPIA
- Confirm that access controls limit footage access to the personnel defined in the DPIA
- Confirm that the anonymisation options (facial blurring, role-only identification) are configured as specified
- Place visible camera notices at the monitoring locations confirming that AI safety monitoring is in operation and referring employees to the privacy notice
Ongoing compliance
- Review the DPIA annually, or when the monitoring scope changes significantly
- Maintain a data subject access request process and log for monitoring-related requests
- Conduct periodic access log reviews to confirm that footage is only being accessed by authorised personnel for authorised purposes
- Include AI monitoring in the annual data protection audit conducted by the DPO
Your cameras already see the hazards. The task is to let them help without watching the people. See how privacy-first safety AI works on your own site — book a demo.
