How we plan to meet UK data protection law
When the door camera checks a face, it makes a face code. A face code is biometric data, which the law treats as a special category of personal data, even if it is deleted a moment later. The law allows a system like this only when it is necessary, proportionate and tightly controlled. This page is our plan to meet that bar. The regulator is the Information Commission (still known as the ICO). It has not approved anything here.
- To check faces at all
The law lists preventing and detecting crime as a recognised reason to use personal data. That removes one test: weighing our interests against people's rights. We must still show that the system is necessary and proportionate.
UK GDPR Article 6(1)(ea) and Annex 1, paragraph 5, in force since 5 February 2026.
- For face codes, which are biometric data
Face codes get extra protection. We may use them only where this is necessary to prevent or detect crime, for a substantial public interest, and where asking each person for consent would defeat that aim. We must also write a policy on how we protect them, called an appropriate policy document.
UK GDPR Article 9(2)(g). Data Protection Act 2018, section 10(3) and Schedule 1, paragraph 10. The policy document: Schedule 1, paragraphs 5 and 39.
- For theft reports
A theft report is data about an alleged crime, even when nobody is charged. The same strict condition applies to it, including when a file goes to the police.
UK GDPR Article 10. Data Protection Act 2018, sections 10(5) and 11(2), and Schedule 1, paragraph 10. Paragraph 10(2): no policy document is needed for a disclosure to the police.
- Who is responsible
Socioculus will be the data controller for the face matching and for the list of reported people. Each member business stays the data controller for its own CCTV and its own reports. It is also the controller for the hidden-item alerts on its cameras, which Socioculus will run for it as a processor, under a written contract. A written agreement with each member will set out who does what.
UK GDPR Articles 4(7) and 28(3). The company name, company number and Information Commission registration number will appear here once the company is formed and registered.
Only what is needed
- Every face will be checked, and almost nothing kept. A face code that does not match is deleted at once. There is no visitor list and no tracking between businesses.
- Hidden-item alerts will not recognise anyone. They will flag movements, such as an item going into a bag, not faces. A clip reaches the list only when a member of staff saw the person leave without paying and reports it. Your business is the data controller for these alerts, and we will run them for you under a written contract.
- Members cannot search the list. They get alerts and nothing else. Only trained Socioculus staff will open the list, and only to confirm that two reports show the same person, to build a case file that the reporting businesses asked for, to answer a request, an objection, a complaint or a police request, and to audit reports.
- Each alert will hold as little as possible. It will show the picture from the report, the kind of incident, the number of reports and the date of the last one, but never the money total.
People decide
- Staff will check every clip. Hidden-item alerts only suggest. A report needs someone who saw the person leave without paying.
- A trained person will confirm every link. Before members nearby get alerts, a trained Socioculus person confirms that both reports show the same person and logs the decision. Socioculus will also audit a sample of reports, and a member whose reports fail an audit loses the right to report.
- Staff will check every alert. An alert is never a reason on its own to accuse, search or stop anyone.
- Software will make only two choices. It flags clips, and it finds faces that may match: at the door, and between a new report and the list. A person makes every choice after that. Nothing in Socioculus bans, blocks or reports anyone automatically. The law does not allow that here, because our processing relies on the crime basis above (UK GDPR Article 22B(4)). Staff record what they decided after each alert, so false alerts can be counted.
Fair and limited
- Each business must show the need. Face checks at the door start only where a business can show a real theft problem, from its own incident records or crime reference numbers. We will help you collect them, and tell you before you commit whether face checks can start at your business. For other members, hidden-item alerts inside may be enough.
- Less intrusive ways come first. Our impact assessment must show that staff, ordinary CCTV and local business-watch schemes are not enough on their own.
- Area alerts will need two reports. One report will alert only the business where it happened. Socioculus will also check new reports from other members against it. Members nearby get alerts only after two separate businesses report the same person and a trained Socioculus person confirms the match. We will also set a minimum value for a report. These are proposed rules: we will publish the final thresholds with our impact assessment.
- Children will not go on the list. We refuse reports about anyone who is or may be under 18.
- Reports will not last for ever. They will be deleted automatically 6 months after the last report about the person, or 12 months where violence or threats were reported. No entry lasts past a fixed maximum, which our impact assessment will set.
- It will be tested before launch. We will check face matching and hidden-item alerts for accuracy and bias across ages, sexes, skin tones and disabilities, on the cameras members use, and publish the results.
Open to the public
- Every member will put up signs. People will see them at the door before they walk in.
- People can use their rights. They can ask what we hold, object to the checks, and get a wrong report removed.
- People can complain. The regulator recommends that they come to us first. They can then complain to the Information Commission.
Before the first camera goes live
1 of 15 steps done
Set up
Done: Map the law that applies.
This page is built on that research.
To do: Form the company and pay the data protection fee.
The fee goes to the Information Commission. Paying it is a legal duty, not an approval.
Data Protection (Charges and Information) Regulations 2018, regulation 2
To do: Appoint a data protection officer.
The law requires one when an organisation's main work is large-scale monitoring of people, or large-scale use of biometric or crime data. Socioculus would do both. We will publish the officer's contact details and send them to the Information Commission.
UK GDPR Article 37(1)(b), 37(1)(c) and 37(7)
Assess the risk
To do: Ask the Information Commission for early advice.
Its Innovation Advice service answers specific questions about plans that are not live yet. The answers are informal and not legally binding, so they are not an approval.
Voluntary. ICO Innovation Advice service
To do: Test face matching and hidden-item alerts for accuracy and bias.
We test on the cameras members will use, with volunteers who agree. This includes people whose movements differ because of a disability. We publish the results.
ICO Opinion on live facial recognition, 2021, section 4.6
To do: Ask the public what they think.
We ask shoppers, and groups that speak for them, about the plan. Their views go into the impact assessment.
UK GDPR Article 35(9); ICO Opinion 2021, annex section 3.3
To do: Write the data protection impact assessment.
It uses the test results, the public's views and the data protection officer's advice. It must be finished before any camera at a member's door checks a face.
UK GDPR Article 35(1) and 35(2)
To do: Write the appropriate policy document and the record of processing.
They explain how we follow the law for face codes and theft reports, and when we delete them.
Data Protection Act 2018, Schedule 1, paragraphs 5, 39 and 41; UK GDPR Article 30
To do: Consult the Information Commission formally if a high risk remains.
If the assessment shows a high risk that we cannot reduce, we must not start until we have consulted it. It replies within 8 weeks, or up to 14 in complex cases. It can also limit or ban the plan.
UK GDPR Article 36(1) and 36(2)
Prepare members and the public
To do: Sign a written agreement with every member.
It says who decides what, how long reports last and who answers requests. It includes the contract the law requires for the hidden-item alerts we run for each member.
UK GDPR Article 28(3)
To do: Put up the signs and publish the full privacy notice.
Both must be in place before any camera checks a face.
UK GDPR Articles 13 and 14
To do: Train every member's staff, and the Socioculus people who confirm matches.
Staff learn to check the picture, ask politely and never search or hold anyone. Our people learn to compare two reports with care, so that a person really makes each decision.
UK GDPR Article 22A(1)(a)
To do: Open the complaints process the law requires.
People can complain online or in another way. We confirm each complaint within 30 days and tell the person the outcome. The same routes take access requests and objections.
Data Protection Act 2018, section 164A, in force since 19 June 2026
Go live
To do: Start with a pilot in one area.
In law, a pilot is real use. So every step above comes first.
ICO Opinion on live facial recognition, 2021, section 3.1.1
To do: Review the impact assessment before each new area.
We use what the pilot showed, such as how many alerts were false.
UK GDPR Article 35(11); ICO Opinion 2021, annex section 3.1
No regulator has approved Socioculus. No licence makes facial recognition lawful for a UK business. The law sets the conditions, and the Information Commission enforces them. In 2023 the regulator said that its decision on another retail system was “not a blanket approval” of that system or of live facial recognition. This page shows the design we plan to put to it.