What to require when procuring people counting

Procuring people counting for a public body means buying visitor numbers as anonymous, aggregated statistics, measured with Wi-Fi, 3D sensors or mobile network data. This guide is written for municipalities that measure city centre footfall or visitors to public buildings. Bumbee Labs is the company behind the only footfall method in Europe approved by a data protection authority.

This page is orientation from the supplier side, not procurement or legal advice, and your own procurement and data protection functions set the final wording.

Which requirements belong in a people counting tender?

Which privacy requirements go into the tender documents?

A municipality can write anonymity by design into the tender documents: aggregated statistics, nothing stored that could identify anyone, and nothing asked of visitors, who need no app or login. If cameras or sensors are involved, require that video is processed for analytics only and that no personal images are stored. GDPR-compliant footfall analytics sets out the position behind it.

How do we test the accuracy claims in the bids?

A municipality should treat an accuracy figure in a bid as a claim and ask what sits behind the visitor count: a documented review of the method, independent validation, and accuracy verified against reality. At Bumbee Labs every deployment is verified with manual control measurements; people counting accuracy compares the methods.

Should the tender fix the technology or describe the venues?

Describe the venues and the question each must answer, then let bidders propose the method that fits. Camera-free Wi-Fi suits indoor public buildings, Wi-Fi with cellular covers streets, squares and districts, and a 3D sensor gives the exact count at one door. Hybrid people counting combines them; how to count visitors compares them.

Our DPO wants a DPIA before we sign: what do we ask the supplier for?

Whether a DPIA is needed, and what it covers, is for the municipality’s data protection officer to decide. The tender can ask each bidder for what shortens that work: documentation that the method gives anonymous, aggregated statistics and no personal data, and written answers to the remaining questions. DPIA for people counting lists a DPO’s usual questions.

Should we buy visitor counting as a service or buy the sensors ourselves?

Start by deciding what the municipality wants to own. Bought sensors leave their upkeep and checking with the buyer; under a measurement service the supplier carries that work. Wi-Fi counting usually runs on a building’s existing access points, while 3D sensors go only at the doors that need them. Procuring traffic counting covers the same choice for streets.

Who owns the data when the contract ends?

Write it into the tender: the visitor data belongs to the contracting organisation. Specify delivery as well, since statistics that never leave a portal are of little use. Ask for dashboards for each stakeholder group, an open and documented People counting API, and scheduled exports and reports for boards and funding bodies. Data deliverables names the metrics to ask for.

What else do public bodies ask when buying people counting?

• Does camera-based counting fall under the EU AI Act? Camera-based people-counting systems using computer vision may fall within Annex III (high-risk AI), so ask bidders to declare whether theirs does and to document the answer either way. Wi-Fi-based and cellular-based methods are architecturally outside Annex III scope. For the dates, see EU AI Act.
• How do we weigh quality against price in the evaluation? The weights are for your procurement function to set. The criteria bidders can be tested on are their documented review, independent validation, verified accuracy, delivery, data ownership and fit to each venue.
• Can a library, a pool and the town centre go in one tender? Different spaces need different methods, so ask for the method that fits each place and a single delivery: in a hybrid setup all methods deliver to one analytics platform and API. See Library footfall and Public pools & swim centres.
• Which references can we ask for? Ask for references where accuracy was checked and GDPR compliance documented. Those were the two grounds on which a major Stockholm transport hub chose its measurement system.
• Is a manual pedestrian survey enough? Counting by hand covers only the hours it was done, misses secondary entrances, re-entries and unstaffed hours, and varies with whoever counts. Automated counting gives a continuous, auditable series; see visitor figures for funders.
• We are a UK organisation: does UK GDPR change the requirement? UK organisations buying visitor measurement should specify UK GDPR compliance (the retained EU GDPR under the Data Protection Act 2018) in their tender requirements. The privacy obligations are equivalent, and the same “anonymity by design” requirement applies.