Facial recognition processes biometric data, which the UK GDPR treats as special category data, and it does so about people who have not chosen to be scanned. That places it at the top of the regulator’s list of concerns. It can still be deployed lawfully, but only if the reasoning is sound, the safeguards are real and the evidence exists before anyone asks for it.
We take you through each stage: whether the deployment is necessary and proportionate, which lawful basis and special category condition apply, how the watchlist is governed, and how accuracy, oversight, retention and redress work in practice. Our advice does not depend on any particular vendor, so it covers the decision itself as well as the paperwork.
What we deliver
- Necessity and proportionality assessment, including the honest question of whether facial recognition is the right tool at all
- Data Protection Impact Assessment (DPIA) and Legitimate Interests Assessment (LIA)
- Lawful basis, Article 9 condition and Appropriate Policy Document
- Watchlist governance built on our Subjects of Interest taxonomy: who can be added, on what evidence, for how long, and how they are removed
- Accuracy and bias assurance aligned to BS 9347:2024 and NIST-validated testing
- Human-in-the-loop procedures, so that no one is refused or challenged on the say-so of an algorithm alone
- Data minimisation and retention, including immediate deletion of non-matches
- Signage, privacy information, rights handling and a route to redress
- Independent due diligence on technology suppliers
- Readiness for assessment against the FRACT Standard
If you cannot explain it to the person on the watchlist, you cannot defend it to the regulator.