DPIA Guide: Demographic Classification

This guide is designed to support controllers using Indivd's Demographic Classification add-on. The add-on extends existing anonymous statistics by associating each Group Anonymity Token with a limited set of perceived demographic attributes, such as approximate age group, apparent gender expression, and general clothing style. All classifications are generated within the same anonymised processing environment and never applied to identifiable individuals. No images are stored, no biometric templates or facial recognition mechanisms are used, and no individuals are tracked.

This guide is not legal advice but a practical tool to support your data protection compliance. It aligns with the GDPR and the AI Act and complements the DPIA for People Counting.

Note: For further documentation, see the attached documents at the end of this guide.

This article contains the following topics:

• 1. Why and when to conduct a DPIA
• 2. Understanding the processing activity
• 3. What the system is used for
• 4. Your role and responsibilities
• 5. Transparency and visitor information
• 6. Internal communication and union involvement
• 7. Ethical and legal residual risks and mitigations
• 8. AI Act: Assessment of prohibited use cases

1. Why and when to conduct a DPIA

On the basis of how the Demographic Classification add-on is designed and provided, we do not deem that the associated processing of personal data qualifies as high risk, rendering a DPIA mandatory. Diligent controllers may however still decide to carry out a DPIA. The add-on involves the use of new technology and may qualify as large-scale processing under Article 35 GDPR, despite processing being limited to 1-2 milliseconds per frame.

2. Understanding the processing activity

Indivd's Demographic Classification add-on operates entirely within the same anonymised processing environment described in the white paper for Indivd Anonymizer. It extends anonymous statistics by associating each Group Anonymity Token with a limited set of perceived demographic categories. The resulting data remain anonymous and are used exclusively for population-level statistical insights.

Processing workflow:

No personal or special category data is ever stored or retained.

1. Cameras record video footage of visitors as they enter the location.
2. Recorded images are encrypted and transmitted to the processing instance within the customer's VPN.
3. The processing instance identifies and isolates relevant portions of the image.
4. The classification model processes the isolated image segments, generating Group Anonymity Tokens with noise introduction. Demographic classification is attached to the token. Images are immediately deleted.
5. All image data is automatically deleted without being stored on any permanent storage device. Only Group Anonymity Tokens and demographic classification are kept after this step.
6. Group Anonymity Tokens and associated demographic classification are deleted within three hours.
7. Anonymised statistics are stored and analysed within Indivd's processing environment to generate insights.

What data we collect:

All data is instantly anonymised. No personal data is stored. Anonymised data is retained up to 3 hours solely for statistical aggregation.

1. A transient Group Anonymity Token: a randomised value used solely for statistical grouping, deleted within three hours.
2. Broad demographic categories attached to each token: approximate age group, perceived gender expression, general clothing style, and clothing features (e.g., presence of coat or hat).

What we do not collect:

No personal data is ever stored or retained: Raw image data is processed in volatile memory and deleted within 1-2 milliseconds. No image is written to disk or transmitted externally.

No biometric data is processed: The classification is based on a coarse demographic estimation performed within milliseconds in volatile memory. It does not analyse facial geometry for identification, create biometric templates, or enable unique identification or authentication of any person. The processing is therefore not considered to involve special categories of personal data as defined in Article 9 GDPR, including biometric data.

No facial recognition or identification is possible: The classification model assigns broad demographic categories to transient image frames. It does not locate, process, or retain facial geometry for identification purposes. The output consists only of coarse category codes.

No tracking of specific individuals: The system does not create persistent identifiers. Group Anonymity Tokens are randomised, short-lived (deleted within three hours), and designed so that singling out, linkability, or inference is not possible in accordance with Recital 26 GDPR.

No sensitive characteristics inferred: The system does not classify based on protected characteristics such as race, ethnicity, religion, or any biometric identifier. Only broad, non-identifying categories are used.

These limitations are not just policy decisions. They are enforced by the system design and technical architecture. It is technically impossible for the system to collect or store such data.

3. What the system is used for

The anonymised data is used solely by the customer to understand visitor composition at a population level, enabling evidence-based decisions on marketing, product assortment, and operational planning.

Purposes:

1. Identify which demographic groups (such as approximate age group or perceived gender expression) are more likely to visit certain areas within the store.
2. Evaluate which product zones attract specific segments.
3. Support changes in store layout or marketing strategy based on statistical trends in visitor demographics.
4. Adapt the utilisation of resources and internal operations by predicting demographic flow patterns.
5. Use anonymised benchmark data to compare demographic engagement across stores or regions.
6. Understand how different demographic groups respond to changes in campaigns, assortment, or layout.
7. Reduce investment risks and increase strategic precision by analysing behaviour and representation across various demographic groups.
8. Adapt business models, such as introducing new services, product lines, or concepts, based on the demographic composition of store visitors.

4. Your role and responsibilities

As a customer, you are the data controller. Indivd acts as the data processor. You are responsible for ensuring appropriate signage and transparency measures (GDPR Article 13). Detailed processor obligations and safeguards are set out in Indivd's Data Processing Agreement (DPA), which governs all third-party processor relationships.

5. Transparency and visitor information

Clear signs must be posted at all monitored locations. These can be integrated with existing security signage and supplemented with QR codes or web links. In accordance with Article 13 GDPR and the EDPB's video surveillance guidance, layered transparency is essential.

Even with strong anonymisation, perceived surveillance can raise ethical concerns and affect public trust. Public communication should clearly explain what data is used for, how it is anonymised, and how individuals' rights are respected. This includes easily accessible privacy notices, understandable language for non-technical audiences, and providing contact details for data protection inquiries.

Recommendation: Use Indivd's signage examples and ensure alignment with GDPR Article 13 and EDPB video surveillance guidance. These are available in the Indivd Help Center.

6. Internal communication and union involvement

For systems involving workplace environments, it is essential to address internal transparency and ensure that employees understand the system's purpose and limitations. Because the system cannot distinguish between individuals, it is not technically or operationally capable of monitoring employee behaviour.

• Union representation: If your organisation has union representation or safety delegates, involve them early in the DPIA process and before rollout. Doing so strengthens trust, helps prevent misunderstandings, and demonstrates accountability.

Identified risks and mitigation measures:

• Human (Risk: Low R1-R2): Information will be posted at each monitored location. Staff will be informed of the system's purpose and how data is handled before deployment.
• Technology/Physical work environment (Risk: Low R1-R2): The strict anonymisation method ensures no data can be linked to individuals or recreated. Demographic categories are intentionally broad and non-identifying.
• Organisation (Risk: Low R1-R2): Store teams will not access the system or data. Separate information briefings are provided instead.
• Organisation (Risk: Low R1-R2): Signage and briefings ensure internal transparency and prevent misinterpretation of the system's role and impact.

7. Ethical and legal residual risks and mitigations

Beyond technical alignment with applicable law, ethical considerations are essential to responsible data processing. Even with anonymisation, the perception and context of data use can influence trust and public acceptance. This section outlines residual ethical and legal risks and how they are addressed through Indivd's technical, organisational, and communicative measures.

Residual ethical risks:

• Re-identification: Not possible due to Group Anonymity Tokens, categorical abstraction, and controlled noise introduction.
• Longitudinal tracking: Mitigated by short token lifespan. All Group Anonymity Tokens are deleted within three hours.
• External data linkage: Outputs contain no direct or quasi-identifiers. Insights describe aggregated patterns, not persons. Contractual barriers prohibit any data-linking attempts.
• Transparency misunderstanding: Addressed with layered visitor and employee information.

Controls in place:

• Immediate image deletion in volatile memory within 1-2 milliseconds. No image is written to disk.
• Transient tokens: Group Anonymity Tokens and their demographic categories are deleted within three hours.
• Broad categories only: age group, perceived gender expression, clothing style, and clothing features. No classification based on protected characteristics such as race, ethnicity, or religion.
• EU-hosted infrastructure.
• Union consultation and employee communication for workplace deployments.
• Indivd enforces a strict anonymisation policy that requires a documented risk analysis for any change, update, or enhancement to the classification or anonymisation method. Any change that would reduce anonymisation capability is categorically prohibited.
• Risk-assessed new categories: any additional demographic attribute undergoes a documented de-anonymisation risk assessment before activation. Categories rated high on sensitivity or uniqueness are not used.

Identified ethical and legal risks and mitigations:

1. Beneficial use risk

   Risk: Sensitive or intrusive data collection may harm organisational reputation.
   Mitigation: All personal data is anonymised in real time (within 1-2 milliseconds). The anonymisation method prevents identification and only retains anonymous group-level data, reducing privacy impact and supporting alignment with ethical standards.

2. Security risk

   Risk: Unauthorised access or data breaches could compromise confidentiality and trust.
   Mitigation: A comprehensive security framework is in place, including encrypted data storage, secure transmission protocols, role-based access control, and regular internal audits. See the attached documentation for details.

3. Fairness risk

   Risk: Employee or individual surveillance may be perceived as intrusive or discriminatory.
   Mitigation: The system is specifically designed to prevent tracking or profiling of individuals, including employees. All data is anonymised and aggregated, and no personal identifiers are retained.

4. Governance risk: Children's data

   Risk: Inadvertent capture of children could be perceived as high-risk.
   Mitigation: The system does not process or identify age-related or biometric data at the individual level. Anonymisation ensures that individuals, including children, cannot be singled out or tracked. Nonetheless, care must be taken to avoid unintended inferences about vulnerable groups from aggregated patterns. As part of your DPIA, you should assess whether your specific deployment context might indirectly affect such groups.

5. Governance risk: Combination of demographic attributes

   Risk: A rare combination of demographic attributes (e.g., uncommon style within a specific age group) could make an observation unique in a small sample.
   Mitigation: Categories are intentionally coarse. Data exist only at group level. Only a small set of non-sensitive variables is processed. Categories rated high on sensitivity or uniqueness are excluded by design.

6. Governance risk: AI literacy

   Risk: Failure to communicate AI functionality clearly could affect legal alignment and public trust.
   Mitigation: Indivd provides layered information (e.g., signage, digital notices) and public guidance on how the system operates and individuals' rights under the GDPR.

8. AI Act: Assessment of prohibited use cases

Indivd's Demographic Classification add-on has been assessed against Article 5 of the EU Artificial Intelligence Act (AI Act), which outlines explicitly prohibited AI practices. Below is a clear summary explaining why the technology does not fall within any prohibited categories.

• Biometric categorisation: Indivd does not categorise or classify individuals based on sensitive or protected characteristics such as race, ethnicity, sexual orientation, or political affiliation. Demographic data is only aggregated based on non-sensitive categories like age and gender, strictly at a group level, never identifying or profiling individuals.
• Surveillance of workers: The technology provides insights on visitor composition during operational hours. It is not designed or capable of monitoring employees or collecting data outside store hours.
• Manipulation of human behavior: The system provides statistical insights without influencing or manipulating individual decisions.
• Exploitation of vulnerable individuals: The system does not exploit vulnerabilities related to age, socio-economic status, or other sensitive attributes. The outputs are purely analytical.
• Social scoring: The technology does not evaluate or classify individuals or groups based on social behaviour or personal characteristics. It exclusively generates group-level insights.
• Biometric identification in public spaces: No biometric identifiers are used. Image data is deleted within 1-2 milliseconds. No face is located or analysed for identification purposes at any stage.
• Facial recognition database or scraping: Indivd does not create or expand facial recognition databases, nor does it use any scraping techniques. Data collected is anonymised instantly and does not support facial recognition.
• Emotion recognition: The system does not analyse or infer emotional states.

Indivd's Demographic Classification add-on does not meet the criteria of any prohibited AI practices defined by Article 5 of the EU AI Act. The technology has been intentionally designed around privacy-by-design principles, robust anonymisation, data minimisation, and ethical use, supporting lawful and responsible data processing.