Is People-Counting Data Personal Data (GDPR)?

If you run footfall analytics, the question of whether people counting data is personal data under GDPR comes up fast. Your DPO asks it. Your legal team asks it. Sometimes a nervous store manager asks it. The honest answer is more reassuring than most people expect, but it has an edge to it.

This guide walks through it in plain English. We cover what GDPR actually means by personal data, why anonymous aggregate counts usually fall outside that definition, and the narrow cases where the line can move. We also cover the part vendors often skip: counting visitors from video still touches personal data on the way to the number, even when nothing identifying is kept.

We are not your lawyers, and this is not legal advice. Treat it as a starting point for a conversation with your own advisor.

Key takeaways

Anonymous aggregate counts that cannot be linked to a person generally are not personal data under GDPR.
This is general information, not legal advice. Your specific setup and your jurisdiction both matter.
CountPort stores numbers and summaries, not images, faces or identities, and does not profile visitors across cameras.
Producing counts from video can involve personal data momentarily, which is why on-site, image-free handling matters.
Document your setup and confirm your obligations with your own data protection advisor before you deploy.

The short answer, and an important caveat

Here is the plain version. Anonymous aggregate counts that cannot be traced back to a specific person are generally not personal data under GDPR. A figure like "412 visitors entered between 9am and 10am" tells you nothing about any individual. Nobody can be picked out of it. On its own, it sits outside the regulation's personal-data rules.

The caveat matters as much as the answer. This is general information, not legal advice, and the correct answer for you depends on your exact setup. The deciding question is always the same: can anyone be identified from the data, either directly or by combining it with something else? If the answer is a clear no, you are usually on the anonymous side. If it is "maybe, in this one corner case", you have work to do.

CountPort does not offer a compliance guarantee or any regulatory certification. We can explain how the technology is built and why the output is designed to be anonymous. We cannot sign off on your deployment, your policies or your local interpretation of the law. That is your advisor's job, and we want to be straight about it.

GDPR defines personal data as information relating to an identified or identifiable natural person. The key word is identifiable. If a piece of information can be tied to a specific human, directly or indirectly, it is personal data and the regulation applies. A name is the obvious case. So is a face, a licence plate, a device ID or a customer number.

Truly anonymous information is different. If data has been stripped of anything that could identify a person, and cannot be reconnected to one with reasonable means, it falls outside GDPR's scope. The regulation's own recitals say so. Anonymous data is just data.

It helps to separate three terms people often blur together:

Term	What it means	Under GDPR?
Anonymous	Cannot be linked to a person by any reasonable means	Generally outside scope
Pseudonymous	Identifiers replaced with a token, but re-linkable with a key	Still personal data
Aggregate	Combined into group totals (counts, averages) with no individual records	Generally outside scope if it cannot single anyone out

One more point, because it is the one that trips people up. Even when the final output is anonymous, the act of producing it can involve personal data along the way. Reading a camera feed to detect bodies means processing a video frame that contains identifiable people, if only for a fraction of a second. The output can be clean while the processing step still needs care. We come back to this below.

Why CountPort's output usually sits on the anonymous side

What CountPort stores is numbers. Visitor counts, real-time occupancy, dwell time, zone and heatmap figures, queue and wait-time measurements, timestamps and summaries. These are group-level metrics. None of them describes a named person, and none of them lets you reconstruct who walked through your door.

There are no faces in that output. No biometric templates, no names, no email addresses, no device identifiers, no MAC addresses. The detection works on body shapes in the frame, not on identity. If you want the longer version of how that works, see people counting without facial recognition.

Where the video runs matters too. Frames are processed on-site, on a back-office PC, mini-PC or supported camera. The raw video stays in the building. Only aggregated numbers leave it. That on-premise design is a deliberate privacy choice, and it is worth comparing against the cloud alternative in on-premise vs cloud video analytics.

One thing CountPort deliberately does not do: it does not re-identify or de-duplicate visitors across cameras. There is no cross-camera profile that follows a shopper from the entrance to the fitting room to the till. Each camera counts within its own view, with staff excluded where you set that up. Because no persistent visitor identity is built, there is nothing to re-link. The wider picture lives in our privacy-first people counting overview, and the engineering detail sits on the technology page.

Where the line can move

Anonymous is not a magic word you sprinkle on data. It is a conclusion you reach about a specific dataset in a specific context. A few situations can move the line.

Very small counts are the classic example. A figure of "one visitor in the executive suite at 7:14am" can, in a small enough setting, point at an identifiable person, especially if someone already knows who tends to be there at that time. Aggregate data protects identity by hiding individuals in a crowd. When the crowd shrinks to one or two, that protection weakens.

Combination is the other risk. Counts that are harmless alone can become identifying when joined with other records you hold. If you cross a precise per-minute count for a private area with a door-access log or a staff rota, you may be able to infer who that count was. The data did not change. The context did.

Jurisdiction matters as well. Regulators and courts do not all draw the anonymisation threshold in the same place, and the test of what counts as "reasonable means" to re-identify someone is interpreted differently across the EU and beyond. A setup that is plainly fine in one country deserves a second look in another.

None of this is a reason to avoid counting. It is the reason a documented review and your own advisor matter. The goal is to confirm that your particular reports, at your particular granularity, in your particular locations, genuinely cannot single anyone out.

The processing step: handling video responsibly

Now the part vendors tend to gloss over. To turn camera video into a number, the system has to look at the video. For a brief moment, that frame contains identifiable people. Even if nothing identifying is ever stored, that momentary processing can itself involve personal data. Being honest about this builds more trust than pretending it does not happen.

The design choices around that step are what reduce exposure. Processing happens on-site, so frames are not shipped to a remote server. Images are not retained: a frame is read, bodies are detected and counted, and the frame is gone. What persists is the count, not the picture. The shorter the life of the image and the smaller the footprint of where it travels, the less there is to worry about.

This is a reason to document your setup, not a reason to skip footfall analytics. Write down what is processed, where it runs, what is stored, and for how long. A clear record turns a vague worry into a defensible position.

Signage is part of responsible handling too. Letting people know that anonymous counting is in use is good practice and, depending on your circumstances, may be expected. We cover the specifics, including when signage or a notice is appropriate, in do you need signage or consent for anonymous footfall counting.

A practical position for buyers and DPOs

If you need a stance you can defend, this is a reasonable one. Collect the minimum needed. Process video on-site. Keep no images. Store only anonymous aggregate output that cannot single anyone out. That combination is straightforward to explain to a regulator, a customer or your own board.

For your records, document the following:

What the system processes (video frames) and what it stores (counts, occupancy, dwell, zone, queue figures and timestamps).
Where processing happens (on-premise) and confirmation that raw video does not leave the building.
That no faces, biometric templates, names or device identifiers are kept, and that visitors are not profiled across cameras.
Your retention period for the aggregated output and who can access it.
The signage or notices in place at each site.
The review you carried out to confirm the output is anonymous at your chosen granularity and locations.

To structure that work, walk through how to run a privacy review for a camera-based counting system alongside the signage guide above. Together they cover most of what a thorough DPO will ask for.

Then confirm it with your own data protection advisor before deployment. We have tried to be honest about what the technology does and does not do, but your compliance rests on your full setup, your policies and your jurisdiction. A short review now is cheaper than an awkward conversation later.

Frequently asked questions

Anonymous aggregate counts that cannot identify anyone generally fall outside GDPR's personal-data rules. The answer depends on your specific setup and granularity, so confirm it with your own advisor.

If the stored output is truly anonymous numbers, those records are generally outside scope. That said, processing video to produce them can involve personal data briefly, so responsible handling of the processing step still matters.

Can anonymous counts ever become personal data?

In rare cases, yes. Very small counts, or combining the counts with other information you already hold, could make someone identifiable. Context and jurisdiction matter, which is why a documented review helps.

No. We explain how the technology is designed for privacy, but we do not offer compliance guarantees or certifications. Your compliance depends on your full deployment, your policies and your local rules.

Where to go next

The short version: anonymous aggregate counts usually sit outside GDPR's personal-data rules, the processing step still deserves care, and your own advisor should have the final word. To put that into practice, start with how to run a privacy review for a camera-based counting system, then read the privacy-first people counting overview to see how the design choices fit together.

Is People-Counting Data Personal Data Under GDPR? A Plain-English Look