What your DPO will ask about people counting
Visitor measurement raises data protection questions. These are the ones a DPO or compliance team typically asks, and where the written answers live. This page is general orientation and is not legal advice.
On this page
In a DPIA for people counting, a DPO works through the usual questions: what is collected, whether visitors are asked for anything, what is kept, whether anyone can be picked out of the data, whether cameras store images, and where the numbers go. The written answers sit on our GDPR page, data deliverables, privacy policy and FAQ.
Counting visitors means measuring people in a physical space, and most ways of doing it touch something that could be personal: signals from a phone, or images at a door. A data protection officer (DPO) or compliance team therefore asks what is collected, what is kept and whether anyone could ever be picked out of the data. A DPIA (data protection impact assessment) covers those questions for visitor measurement. The point-by-point answers are set out under what compliance teams ask us; this page covers the assessment around them.
Do we need a DPIA for people counting?
Your own DPO or compliance function makes that call, and we do not make it for you. We supply the material that shortens the work. That is documentation that the method produces anonymous, aggregated statistics and no personal data, plus written answers to the questions that remain.
Whether your organisation runs a formal impact assessment, and what it must cover, stays your decision. Nothing on this page replaces your own assessment.
Does the method produce personal data?
No. The method delivers aggregated statistics, and no stored record of any individual sits behind them. Visitor counts, dwell times, flows, capture rates and trends arrive as aggregated figures, and all personal data is irrevocably deleted as part of the method itself.
Does UK GDPR change the answers?
No. For UK-based organisations the relevant framework is UK GDPR, the retained EU GDPR under the Data Protection Act 2018. The same questions apply and the answers hold: the method produces anonymous, aggregated statistics, so no personal data is in scope under either EU GDPR or UK GDPR. A DPO covering UK operations reads UK GDPR wherever this page refers to EU GDPR.
Does the EU AI Act come up in a DPIA for people counting?
It can, and it depends on the method. The EU AI Act is a growing item on compliance checklists. Camera-based people-counting systems that use computer vision to classify individuals may fall under Annex III, the Act’s list of high-risk AI systems. Wi-Fi and cellular methods sit outside that scope, since they handle no biometric data and identify no individuals. If your assessment needs to address EU AI Act risk categorisation, the method-level distinction is the starting point.
Where can a DPO find the written answers?
The compliance position is set out on GDPR-compliant footfall analytics, including what the regulatory approval means for a review. Bumbee Labs runs the only footfall method in Europe approved by a data protection authority, so the central question of whether the method produces personal data has already been asked and answered by that authority. The step-by-step journey from signal to statistic (collection, anonymisation, filtering, processing and insight) is described on data deliverables. Our privacy policy states the position plainly: we do not identify individuals, and we do not build profiles of the people being counted. Shorter answers to the most common questions sit in the FAQ.
Can our DPO talk to Bumbee Labs directly?
Yes. We answer compliance questions directly and in writing, and we can arrange a walkthrough of the method, the data journey and the dashboard with your DPO in the room. The documentation is written in plain language. Organisations with high privacy bars, such as municipalities, libraries and transport hubs, put the same questions to us before committing. When you are ready, talk to our team and bring your DPO’s questions.
Curious what this looks like for your venue?
Frequently asked questions
Who decides whether a DPIA is needed for people counting?
That judgement belongs to your own DPO or compliance function, and we will not make it for you. We provide the material that makes the assessment quick: documentation showing that the method produces anonymous, aggregated statistics and no personal data, and direct answers to whatever remains.
What documentation can we hand to our DPO?
Start with the GDPR page, the privacy policy and the step-by-step data journey on data deliverables. Our team answers any further compliance questions directly and in writing, and we can arrange a walkthrough with your DPO in the room.