What changes the amount and type of data processed?
Choose whether a camera runs permanently or is only aimed after a radar event, and whether processing happens locally or externally. The result is deliberately qualitative – not a GDPR score.
The GDPR assesses processing – not sensor types
Among other things, the regulation asks about purpose, legal basis, proportionality, data minimisation, transparency, retention period, access protection and risks for the data subjects. "Radar" or "camera" is therefore not a compliance label.
Processing must be for specified, explicit and legitimate purposes.
Data should be adequate, relevant and limited to what is necessary.
Personal data should not be kept longer than necessary.
Data-protection principles should be built into processing technically and organisationally.
Radar data is not automatically "anonymous"
Whether information is personal data depends on whether it relates to an identified or identifiable natural person. Even seemingly technical data can become personal data when combined with other information.
Technical track
An anonymous movement trajectory without any link to a person can contain markedly less identifying information than an image.
Track + identity system
If a track ID is linked to access credentials, license plates, video or other identifiers, personal data can result.
Radar-first can be an architectural choice for less persistent image data
A radar-first system can perform the task "detect and track a moving object" without continuous high-resolution image capture in the first place. Whether this approach is preferable from a data-protection standpoint in a concrete case nevertheless depends on the protection need and the processing as a whole.
Accurate framing: radar can support data minimisation. Not: radar is automatically GDPR-compliant.
Local processing reduces data flows – but not automatically all risks
When raw data and event logic are processed on site, less data needs to be transmitted to external systems. Access protection, logging, updates, roles and a deletion concept nevertheless remain relevant security questions.
local capture
local processing
relevant event only
optional cueing
existing workflow
purpose-bound deletion
Event-triggered PTZ changes the data path
A PTZ camera can be aimed at a target candidate already being tracked by radar. This can reduce the duration and spatial breadth of image processing – provided the concrete system logic and configuration actually implement this principle.
Permanent wide-area observation
Image data is continuously processed or stored, regardless of whether a relevant event is present.
Targeted verification
Image processing begins or focuses only after a defined technical trigger. This can support data minimisation.
Not only capture, but also persistence determines data exposure
Retention
How long are tracks, images or events stored?
Access
Who may access raw data, events and video?
Export
Is data transmitted to the cloud, service providers or central control rooms?
Purpose
Is data used only for the defined security purpose?
Logging
Is it traceable who accessed sensitive data, and when?
Deletion
Are there technical deletion periods, and are they actually implemented?
Privacy can be treated as a system requirement
Possible technical design questions
Can the primary sensor operate without image data? Can video be event-based rather than continuous? Can raw data stay local? Can recording, export and retention be configured separately? Are roles and access traceable? Are only the data needed for the purpose activated by default?
This page is a technical framing, not legal advice
For a specific site, the controller, purpose, legal basis, information obligations, balancing of interests or other requirements, and where applicable a data-protection impact assessment, must be reviewed separately.
No blanket permissibility
Neither radar nor camera is permissible or impermissible merely because of the sensor type.
Further legal frameworks possible
Depending on the deployment context and design, further rules besides the GDPR can apply, for example the AI Act. Whether and to what extent depends on the concrete use case and must be reviewed separately.
Context matters
An industrial site, public space or employment context can trigger different requirements.
Video is particularly sensitive
Video can directly capture identifiable information; specific EDPB guidelines exist for this.
Frequently asked questions about radar and privacy
Is radar GDPR-free?
No. Whether the GDPR applies depends on the personal-data link and the processing context, not on the name of the sensor.
Is camera surveillance always more problematic?
Not categorically. Video often contains richer identifying information, but can be permissible depending on purpose and legal basis. The concrete design is decisive.
What does data minimisation mean?
Processing only the personal data that is adequate, relevant and necessary for the specified purpose.
Does the AI Act automatically apply to a radar system with AI classification?
No, not for that reason alone. The AI Act (Regulation (EU) 2024/1689) ties its requirements to specific use cases and risk categories, not to the mere use of an AI method. Classification as a high-risk system requires that a specifically named use case is met – a radar that classifies flying objects does not automatically fall under it. Whether requirements arise in an individual case depends on purpose, deployment environment, integration and the role of the provider or operator, and must be reviewed separately. This page makes no statement about a specific site in this regard.
Does local edge processing help?
It can reduce external data transmission and simplify control, but it does not replace further security and data-protection measures.
Sources
- Regulation (EU) 2016/679 (GDPR), Art. 5. Principles relating to processing of personal data, including purpose limitation and data minimisation.
- Regulation (EU) 2016/679 (GDPR), Art. 25. Data protection by design and by default.
- Regulation (EU) 2024/1689 (AI Act). Harmonised rules on artificial intelligence. The use cases and risk categories defined therein are determinative; a classification does not follow merely from the use of an AI method.
- European Data Protection Board (2020). Guidelines 3/2019 on processing of personal data through video devices.