GDPR

General Data Protection Regulation

The General Data Protection Regulation, abbreviated GDPR, is a European Union regulation on information privacy in the European Union and the European Economic Area. It is a European law that expanded the privacy and security protections for individuals' personal information. It regulates the collection, use, transfer, storing and other processing of personal information of individuals located in the EEA.

Personal data

Personal data is any information that relates to an identified or identifiable living individual (data subject). Different pieces of information, which together can lead to the identification of a particular person, may also be considered personal data.

Context

VIS processes video feeds where employees’ faces may be visible and potentially identifiable, although it does not include any facial recognition or face detection capabilities. Its monitoring features are restricted to authorized personnel only, and its optional storage is limited to incident-related footage. Logging features may indirectly result in the identification of personnel due to patterns of incidents linked to specific shifts or workstations.

To improve the performance of its detection models, Event Gates may collect and process images for inclusion in training and test datasets. These images may occasionally contain individuals. In such cases, deployers should assess their obligations under the GDPR.

This document is intended for end users and system integrators to help them evaluate their GDPR responsibilities. It also outlines the privacy-specific features of the software and the measures Event Gates implements to protect personal data.

Compliance

Introduction

Is it personal data?

Yes — images or videos where people can be identified (even indirectly) are considered personal data under GDPR.

Even if:

Faces are not the main focus,
Footage is only used for safety monitoring,
It’s stored locally and not shared.

So GDPR does apply to the Event Gates Safety AI systems.

Roles

Data Controller: Customer who deploys and runs the system
Data Processor: Event Gates, for following purposes:
- Remote access for support purposes
- AI training purposes
Data Processor: Partners such as system integrators, for support or installation purposes

Key GDPR Obligations

The core principle of the General Data Protection Regulation (GDPR) is to give individuals control over their personal data while ensuring that organizations process this data lawfully, fairly, and transparently. It requires that personal data be collected for specific, explicit, and legitimate purposes, kept accurate and up to date, stored no longer than necessary, and protected with appropriate security measures. Organizations must demonstrate accountability, obtain valid consent where required, and respect individuals' rights—such as the right to access, correct, delete, or transfer their data. GDPR emphasizes data minimization and privacy by design as essential practices.

Lawful Basis for Processing

Article 6 of the GDPR outlines the lawful bases for processing personal data. According to this article, personal data can only be processed if at least one of the following six conditions is met:

Consent – The data subject has given clear and informed consent for their data to be processed for a specific purpose.
Contract – Processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract.
Legal obligation – Processing is necessary to comply with a legal obligation to which the controller is subject.
Vital interests – Processing is necessary to protect someone’s life.
Public task – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Legitimate interests – Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

In summary, Article 6 provides the legal justifications for data processing, and one of these bases must be satisfied for processing to be lawful under the GDPR.

Lawful basis for Safety AI

Basically it says, you must have a legal reason to record and process the footage.

For safety-related use, the most relevant bases are:

Legitimate interest (Art. 6(1)(f)): E.g., “Monitoring human-machine interaction for occupational safety and incident investigation.” Must pass a 3-part test:
1. Purpose: Clearly defined safety objective
2. Necessity: No less-intrusive means
3. Balancing: Does not override individual rights
Or in some cases, Legal obligation (Art. 6(1)(c)): If national laws require incident documentation or safety controls.

Data Minimization

Article 5(1)(c) of the GDPR states the principle of data minimization. It reads:

"Personal data shall be: adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed."

This means organizations must only collect and process the minimum amount of personal data needed to fulfill a specific, clearly defined purpose. Collecting excessive or irrelevant data is not allowed under this principle. The goal is to reduce privacy risks for individuals and encourage responsible data handling practices.

Safety AI and data minimization

Safety AI inherently follows the principle by only collecting what's strictly necessary:

Only events are recorded✔️
no blanket recording✔️
detected persons are blurred✔️

Storage Limitation

Article 5(1)(e) of the GDPR establishes the principle of storage limitation. It states:

"Personal data shall be: kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed..."

In essence, this means that personal data should not be retained indefinitely. Once the purpose for which the data was collected has been fulfilled, the data must be deleted or anonymized—unless continued storage is required by law or for specific, legitimate purposes such as archiving in the public interest, scientific or historical research, or statistical use, in which case safeguards must be in place. This principle is designed to prevent unnecessary retention and reduce the risk of misuse.

VIS Housekeeping

VIS housekeeping feature automatically deletes old video and image files to free space including log records. Event Gates plans to implement a more strict retention feature but does not support manual deletion of files to protect log files against corruption.

Access Control and Security

Article 32 of the GDPR is about security of processing. It requires data controllers and processors to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Article 32 emphasizes a risk-based, proactive approach to data security, requiring organizations to prevent unauthorized access, loss, or damage to personal data through appropriate safeguards.

Safety AI and data security

Safety AI support data security by:

storing data on an isolated edge device ✔️
no internet or network access required ✔️
access is only possible through username and password ✔️

Deployers should also consider the physical security of the devices.

Transparency

Articles 13 and 14 of the GDPR require organizations to provide individuals with clear and comprehensive information about how their personal data is used. Article 13 applies when data is collected directly from the individual, while Article 14 applies when data is obtained from other sources. In both cases, the organization must inform the individual about the data controller's identity, the purpose and legal basis for processing, data recipients, retention period, rights of the individual, and any data transfers or automated decision-making. Article 14 additionally requires disclosure of the data’s source and categories. These provisions ensure transparency and empower individuals to exercise their data protection rights.

An internal privacy notice can be a good choice for Safety AI deployers. An internal privacy notice is typically used for:

Employees
Contractors
Interns or other internal personnel

It informs them how their personal data is collected and processed in the context of employment or service. You can review and use this sample internal privacy notice for Safety AI systems.

Data Subject Rights

Data Subject Rights under the GDPR are the rights granted to individuals (data subjects) to control how their personal data is collected, used, and managed by organizations (data controllers and processors). These rights ensure transparency, accountability, and fairness in data processing.

Individuals may have the right to:

Access their data
Request deletion (if not required for legal safety review)
Object to processing (unless overridden by safety obligations)

Deployers need internal procedures to hande such requests.

Data Protection Impact Assessment

A Data Protection Impact Assessment, also called a DPIA is a process required under Article 35 of the GDPR to help organizations identify and minimize the data protection risks of high-risk processing activities. It is especially important when using new technologies or handling sensitive data at scale. A DPIA ensures that privacy risks are assessed before processing begins and that appropriate safeguards are in place to protect individuals’ rights and freedoms.

A DPIA is necessary when data processing is likely to result in a high risk to individuals’ rights and freedoms—such as when using automated decision-making, profiling, large-scale processing of sensitive data, or systematic monitoring of public spaces. It is required before such processing begins to ensure risks are identified and mitigated in advance. The purpose of a DPIA is not only to protect individuals but also to help organizations demonstrate GDPR compliance, avoid legal or reputational harm, and implement privacy-by-design principles from the outset.

A DPIA is required when:

System is used for systematic monitoring in a work environment, especially if used at scale
AI is involved
There is a potential risk to individuals' rights

As a rule of thumb, we advise deployers to conduct a DPIA. Please refer to the additional documentation, which includes a sample and a template specifically designed for Safety AI deployments.

Summary: What you likely need to do

Task	Required?	Notes
Lawful basis justification	✅	Likely “legitimate interest” or “legal obligation”
Data minimization	✅	Only record when needed — you already do
Set retention policy	✅	Delete older event videos automatically
Access control logs	✅	For accountability and audits
Signage or internal notice	✅	Let individuals know they may be recorded
DPIA	✅	Especially if workplace-wide
Appoint a DPO	⚠️	Required if you monitor systematically and at scale