AI video analytics for CCTV works well for counting people and vehicles, spotting someone entering a restricted zone, checking PPE, measuring queues and flagging safety events. It is far harder, and far riskier, to identify individuals or read their emotions. Under UK GDPR, adding analytics to existing cameras usually means completing a DPIA before you switch anything on.
This article is written for operations, facilities and compliance leads at UK businesses weighing up AI CCTV. It covers what the technology does reliably, where it gets difficult, and the data protection steps the ICO expects. It is practical guidance from people who build these systems, not legal advice. For a specific deployment, speak to your data protection officer or a solicitor.
What can AI video analytics reliably do on business CCTV?
The dependable use cases share one trait. They ask "is there a person or vehicle here, and what is it doing?" rather than "who is this?". Object detection models are trained on huge volumes of people and vehicles, so these tasks are mature and testable.
- People and vehicle counting. Footfall through an entrance, vehicles in and out of a yard, trucks waiting at a gate.
- Zone intrusion. An alert when someone enters a fenced area, a loading bay edge or a machine cell outside permitted hours.
- PPE detection. Whether people in a marked area are wearing hi-vis or hard hats.
- Queue length and wait time. How many people are queuing at a counter or how long vehicles wait at a weighbridge.
- Loitering and dwell time. Someone staying near a door, fence line or cash point for longer than a set threshold.
- Occupancy. How many people are in a room, canteen or muster point at a given moment.
- Safety events. A pedestrian inside a forklift lane, a blocked fire exit, smoke, or a person on the ground.
Each of these produces an event or a number. That matters for both accuracy and privacy, because you can often keep the count or the alert and discard the footage.
What is hard or high-risk with AI CCTV?
Some capabilities are technically possible but carry far more legal and practical risk.
Facial recognition
Facial recognition compares a face against a watchlist or database to identify a person. The ICO's biometric data guidance states that when you use biometric data for the purpose of uniquely identifying someone, it is special category biometric data. That means you need an Article 9 condition as well as a lawful basis, a thorough DPIA, and evidence that a less intrusive method would not work. Accuracy across different demographic groups and the consequences of a false match both have to be assessed. For most private businesses the case is hard to make.
Emotion detection
Systems that claim to read mood, aggression or intent from faces or body language are a poor bet. In a 2022 statement, the ICO warned organisations about immature emotion analysis technologies, saying such tools "may not work yet, or indeed ever" and that it had yet to see emotion AI meet data protection requirements.
Individual performance monitoring
Using analytics to track how fast named workers move or how long they spend at a station is technically similar to occupancy counting, but the privacy impact is very different. It singles out individuals, it can affect their employment, and it rarely meets the "necessary and proportionate" test unless there is a clear and documented reason.
How do AI CCTV use cases compare on accuracy and privacy risk?
The table below is a qualitative guide based on what the analytics outputs and who it affects. Your own risk depends on the setting, who is filmed, and what you do with the results.
| Use case | Typical accuracy concerns | Privacy risk |
|---|---|---|
| People counting | Crowds and occlusion at busy entrances; double counting at doors | Low |
| Vehicle counting | Night glare from headlights; vehicles partly hidden by others | Low |
| Occupancy | Seated or partly hidden people; camera coverage gaps | Low |
| Queue length | Defining where a queue starts and ends; people standing in groups | Low |
| Zone intrusion | Shadows, animals and weather triggering false alarms | Low to medium |
| Safety events (pedestrian in vehicle lane, blocked exit) | Camera angle hides the distance between person and vehicle | Medium |
| PPE detection | Small items at distance; similar colours to hi-vis; poor light | Medium (linked to named workers) |
| Loitering and dwell time | Legitimate waiting looks the same as suspicious waiting | Medium |
| Number plate recognition | Dirty or angled plates; speed; lighting | Medium to high (identifies individuals) |
| Facial recognition | Angle, lighting, resolution, demographic accuracy differences | High (special category data) |
| Emotion detection | Weak scientific basis for inferring feelings from appearance | High |
What does UK GDPR require for AI CCTV?
The ICO's main reference is Video surveillance (including guidance for organisations using CCTV). It explicitly covers emerging tools such as facial recognition and machine learning. At the time of writing, the ICO notes the guidance is under review following the Data (Use and Access) Act, so check the current version before you rely on any detail.
A DPIA before you switch it on
The ICO's accountability section says a DPIA is a legal requirement that applies in most cases relating to video surveillance, and that it should be done prior to any processing. It names monitoring people at a workplace and monitoring publicly accessible places on a large scale as examples. If your DPIA shows a high risk you cannot reduce, you must consult the ICO before going ahead.
A useful DPIA for AI CCTV records the specific problem, why analytics is necessary and proportionate, less intrusive options you considered, accuracy testing, who sees alerts, and how long each type of data is kept.
Purpose limitation
Decide what the analytics is for and write it down. A system installed to stop pedestrians walking into forklift lanes should not quietly become a tool for disciplining staff. If you want to use the data for a new purpose, assess that purpose separately and tell the people affected.
Data minimisation and retention
The ICO's CCTV checklist expects images to be stored for a defined period with access limited to a small number of authorised people. Analytics makes it easier to minimise. Keep counts and anonymous events for trend reporting, keep short clips around genuine alerts, and let routine footage expire on your normal schedule.
Signage and transparency
People must know they are being recorded. Visible signs should show that CCTV is in operation and who runs it, and your privacy notice should say what analytics you apply and why. Staff should be told directly, not left to read it on a sign.
Should video analytics run at the edge or in the cloud?
Where the processing happens affects cost, reliability and privacy.
Edge processing runs the model on a small computer on site, next to the cameras or the recorder. Raw video never leaves the building. Only events, counts and short clips are sent on. This saves bandwidth, keeps working if the internet drops, and supports data minimisation. The trade-off is hardware on each site that needs monitoring, patching and occasional replacement.
Cloud processing sends video streams to a cloud provider for analysis. It is easier to scale models across many sites and to update them centrally. But continuous upload of many camera streams needs serious bandwidth, and you are moving more personal data off site, which adds security and data transfer questions to your DPIA.
Many deployments end up hybrid: detection at the edge, with events and anonymised statistics sent to the cloud for dashboards. Our AI edge infrastructure work covers choosing, deploying and managing that on-site hardware.
How do you roll out AI CCTV compliantly?
A sensible rollout follows the same order every time.
- Define one problem. "Reduce pedestrian incidents in the goods-in yard" is a better brief than "make our cameras smart".
- Check the cameras. Analytics depends on resolution, angle and lighting. Our guide to getting computer vision out of the cameras you already own explains how to audit them.
- Complete the DPIA. Do it before the pilot, not after, and involve whoever owns data protection.
- Pilot on a few cameras. Measure detections and false alarms against what actually happened, over day, night and different weather.
- Set retention and access. Decide who receives alerts, who can view clips and when data is deleted.
- Review on a schedule. Check accuracy, check the system is still needed, and update the DPIA when anything changes.
If you are unsure whether the idea is worth it, a short AI proof of concept on recorded footage will answer the accuracy question before you buy hardware.
Frequently asked questions
Is AI CCTV legal in the UK?
Yes, AI video analytics on CCTV can be lawful in the UK, provided it complies with UK GDPR and the Data Protection Act 2018. You need a lawful basis, a clearly defined purpose, a DPIA in most cases, clear signage and a defined retention period. Higher-risk uses such as facial recognition face much stricter conditions.
Do we need a DPIA to add analytics to existing CCTV?
In most cases, yes. The ICO describes a DPIA as a legal requirement that applies in most cases relating to video surveillance, and expects it to be completed before processing starts. Adding AI analytics changes what the system does with footage, so it should be assessed even if the cameras were already covered.
Can a business use facial recognition on its CCTV?
It is possible but difficult to justify. Using biometric data to uniquely identify someone makes it special category data under UK GDPR, which requires an additional legal condition, a thorough DPIA and strong evidence that the use is necessary and proportionate. Most businesses can meet their goal with less intrusive analytics.
Is people counting personal data?
The video used for counting is personal data if people can be identified in it. The aggregated count itself, such as "143 visitors between 9am and 10am", is usually not. Processing frames at the edge and keeping only the counts is a good way to reduce privacy risk.
How long should we keep CCTV footage with analytics?
UK law does not set a fixed period. The ICO expects you to define one, justify it, and delete footage when it is no longer needed. Many organisations keep routine footage for a short period and retain clips linked to specific incidents for longer.
Talk it through with us
If you are weighing up AI CCTV for a site, start with the problem you want to solve and the cameras you already have. We are happy to look at both with you through our AI video analytics for CCTV service, including where the analytics should run and what your DPIA needs to cover.
