This is not legal advice; it is a set of practical notes from an engineer who has sat through meetings with the legal and compliance teams of dozens of customers over five years. Consult your lawyer on every project. But if you walk in with a clear architecture, the meeting takes an hour; if you don't, six weeks.
First decision: no face recognition
We made this a product decision in 2021 and never changed it. Face recognition means processing biometric data; under Turkish data-protection law (KVKK) and GDPR that is special-category personal data, which may be processed only with explicit consent or under a narrow set of legal conditions (KVKK Article 6, as amended in 2024; GDPR Article 9) and with additional safeguards. Retail analytics, workplace safety and production monitoring do not need faces. "How many people came in, how long did they stay, is he wearing a helmet, how close did she get to the forklift" are questions that do not require identity.
Customers ask for "recognising loyal customers". Our answer is no. That it is technically possible does not make it legally or ethically possible, and besides, no analytics metric covers the cost of a face database that leaks one day.
Where does the video go?
Nowhere. The stream is processed on the site server, the frame is decoded in memory, detection runs, the frame is discarded. No video is written to disk. What leaves is metrics and events: numbers, timestamps, rule identifiers. Showing this on the architecture diagram with arrow directions closes the legal team's first question.
Exception: some safety customers want the frame of the moment, to see the "person without helmet" alert with evidence. In that case the frame is stored, but under two conditions: faces blurred and automatic deletion after a defined period. The period follows the customer's own policy, 7–30 days. This setting is enabled at installation; the default is off.
Is anonymisation really anonymous?
A frequent and fair question. Giving a person a tracking identity means a temporary number valid until that person leaves the frame. The identity is not persistent, there is no record matched to the person, and the person is not given the same number when they come back the next day. In projects with age and gender estimation, the estimate is kept only as an aggregate: "60% of those entering in this hour were women". There is no individual record.
We give this as a written undertaking, because the word "anonymous" alone is not enough; what is collected and what is not has to be written line by line.
Notices and signage
The store or the plant already has cameras and already has a privacy notice. When analytics is added, the purpose section of the notice is updated: "statistical analysis" is added next to "security". That is the customer's own job; we provide a draft, the legal team writes the final text. For employee-facing safety analytics, the workers' representative and the occupational-safety specialist must be informed separately; in a few projects the union joined the meeting, and the sentence "no identity, no frames, only an alert" settled the matter.
Access and logging
Who accessed the server, when and why is logged. Every operation that changes a rule, draws a polygon or views an event frame is logged with the user name. This log is open to the customer. Our remote-support access is limited to the window the customer opens, over VPN, and logged in the same way.
Retention periods
| Data | Retention | Note |
|---|---|---|
| Raw video | Not stored | Processed in memory and discarded |
| Event frame (optional) | 7–30 days | Faces blurred, automatic deletion |
| Metrics (aggregate counts) | Indefinite | Contain no personal data |
| Access log | 1 year | Per customer policy |
Data for model training
Improving the model needs samples from the field. We do this under a separate clause agreed with the customer: for a defined period, from defined cameras, frames with faces blurred, for labelling and training only. If the customer does not want it, we do not take it; the model then runs on general data and field calibration takes longer. We explain that trade-off openly.
The one page we bring to the meeting
The architecture diagram (video stays on site), the list of data collected and not collected, the retention table, the access model, our role as sub-processor. When this page is ready, the legal meeting ends in an hour. When it is not, two months are lost before the project starts. In computer-vision projects the most expensive delay is not the GPU; it is compliance uncertainty.
Frequently asked questions
Can video analytics work without face recognition?
Yes. Questions such as how many people came in, how long they stayed, whether someone wears a helmet or how close they got to a forklift do not require identity. A person only gets a temporary tracking number valid until they leave the frame, and age or gender estimates, where used, are kept only as aggregates.
What data does video analytics store, and for how long?
Raw video is not stored; it is processed in memory and discarded. Optional event frames are kept for 7–30 days with faces blurred, aggregate counts that contain no personal data are kept indefinitely, and access logs are kept for 1 year depending on the customer's policy.
Does adding video analytics change the privacy notice?
Yes. The purpose section of the existing camera privacy notice is updated so that statistical analysis is listed next to security. The customer's legal team writes the final text, and for employee-facing safety analytics the workers' representative and the occupational-safety specialist must be informed separately.
What should you bring to the legal meeting for a video-analytics project?
One page with the architecture diagram showing that video stays on site, the list of data collected and not collected, the retention table, the access model and the supplier's role as sub-processor. This is not legal advice; consult a lawyer on every project, including on KVKK, Türkiye's data-protection law, and GDPR where it applies.