GDPR-compliant people counting is now the default expectation for any UK retailer, transport operator, cultural venue or public-realm team that wants visitor data without regulatory risk. Every camera or sensor pointed at a doorway raises the same question from procurement, legal and privacy teams: does this meet UK GDPR and ICO expectations? This guide explains, in plain English, how modern privacy-by-design footfall analytics deliver accurate visitor insight with GDPR-compliant people counting — without ever identifying a single person.Book a free 20-minute footfall review
Why GDPR-compliant people counting matters in 2026
For UK operators, GDPR-compliant people counting is no longer a nice-to-have. The Information Commissioner’s Office has tightened expectations around any camera-based system, and boards now expect a defensible privacy story alongside the commercial ROI. Choosing the right architecture up front — anonymous 3D sensing, on-device processing, encrypted aggregate events — is the difference between a footfall project that flies through legal review and one that stalls for months.
Is people counting personal data under UK GDPR?
Under the UK GDPR and the Data Protection Act 2018, and per Information Commissioner’s Office guidance, personal data is any information that can identify a living individual — directly or indirectly. A raw CCTV feed of faces is personal data. An anonymous count of how many depth-map “blobs” crossed a virtual line is not. The distinction matters, because it determines whether a full Data Protection Impact Assessment (DPIA), lawful basis, signage and subject-access processes are triggered. Modern 3D sensors are designed to sit firmly on the non-personal side of that line.
What “privacy by design” actually means for footfall analytics
Article 25 of the UK GDPR requires data protection by design and by default. For a people-counting deployment, that translates into five practical controls:
- Process only aggregate counts, never identifiable images.
- Perform detection on-device (edge processing) so raw video never leaves the sensor.
- Minimise data: store direction, timestamp and zone — nothing else.
- Encrypt data in transit and at rest.
- Document retention, access and deletion in a lightweight DPIA.
If a vendor cannot map their product to these five controls in a single page, that is a red flag.
2D cameras vs 3D stereo sensors: why the hardware choice is a GDPR decision
A traditional 2D IP camera captures a recognisable RGB image. Even if you promise not to store it, the device is technically capable of biometric processing — which invites ICO scrutiny. A 3D stereo-vision people counter, by contrast, works from a depth map: it sees height and shape, not faces or clothing. The output is a count, not an image. Choosing 3D hardware is often the single fastest route to a defensible privacy posture.
The seven-point GDPR checklist for any UK people-counting project Book a free 20-minute footfall review
Use this checklist before you sign a purchase order:
- Lawful basis documented (usually legitimate interests for aggregate counts).
- DPIA completed and signed off by your DPO or senior sponsor.
- Privacy notice and on-site signage updated where required.
- Contract or DPA in place with the sensor vendor and any cloud processor.
- Data minimisation confirmed in writing — no faces, no re-identification.
- Retention period defined (30–90 days is typical for aggregate counts).
- International transfer risk assessed if dashboards are hosted outside the UK.
Where AI 3D people counting fits: retail, transport, culture, public realm
Privacy-safe footfall data unlocks measurable value across sectors. In retail, it drives conversion rate, staff scheduling and marketing ROI. In transport and the public realm, it supports safer crowd management and capacity planning. In museums, libraries and stadiums, it evidences visitor numbers for funders and grant reporting. In every case, AI 3D people counting delivers operational value that comes from the count — not from any individual’s identity — which is exactly why GDPR-compliant designs perform just as well commercially.https://smarturbansensing.co.uk/radiator-outlet-leeds-case-study/
How Smart Urban Sensing delivers GDPR-compliant people counting by default
Smart Urban Sensing deploys AI3DPro stereo-vision sensors that count on-device and emit only anonymous, aggregate events over an encrypted channel. There are no faces, no biometrics and no personal identifiers in the pipeline. Every installation ships with a DPIA template, a data-flow diagram and a data processing agreement, so procurement, legal and IT can sign off in days rather than weeks. The result: accurate footfall analytics that stand up to ICO scrutiny and to your customers’ privacy expectations.
Frequently asked questions
Do I need a DPIA for a people counter?
For 3D anonymous counting the risk is low, but a lightweight DPIA is still best practice and is often requested by legal or IT before rollout.https://smarturbansensing.co.uk/pandora-jewellery/
Do I need signage if the sensor does not record images?
If no personal data is processed, formal privacy notices are usually not required — but visible signage builds public trust and is strongly recommended in customer-facing sites.
How long can I keep footfall data?
Aggregate counts are not personal data, so retention is a business decision. Most UK operators keep 12–24 months of aggregated data for trend analysis and delete raw event logs after 30–90 days.
Is cloud-hosted footfall analytics still GDPR-compliant?
Yes, provided the processor is contracted under a DPA, data is encrypted, and any transfers outside the UK are covered by appropriate safeguards.
Next steps
If you are evaluating a footfall project and need a clear privacy story for your board, legal team or funders, Smart Urban Sensing can share a sample DPIA, data-flow diagram and reference architecture for GDPR-compliant people counting. Book a free 20-minute review to see how privacy-by-design footfall analytics and GDPR-compliant people counting work together on your sites.Book a free 20-minute footfall review
Retail and shopping centres
Find out what your entrance data should be telling you
In 20 minutes we review your entrances, current counting setup and conversion questions, then tell you what accurate footfall data would change. No obligation, no hard sell.
