Yes — with the right approach

Retailers can use surveillance and analytics lawfully under UK GDPR, provided processing is necessary, proportionate and transparent. The ICO publishes clear guidance on CCTV and on AI/biometrics.

The compliance checklist

• Clear signage and a published privacy notice.
• A documented lawful basis (legitimate interests + LIA).
• A DPIA for AI/analytics processing.
• Strict retention limits and access controls.
• Privacy-by-design: avoid unnecessary biometric/facial data.

Privacy-first by design

De Flow AI focuses on behaviour and items rather than identifying individuals, supporting a proportionate, ICO-aligned deployment. See our approach to compliant detection in loss prevention.