The most common question in a conversation about video-based flow analytics is blunt: does this breach the LGPD, Brazil's data protection law? The answer depends on three things: what is done with the image, how roles are defined and how precise the words are.
First, the words
Raw video is personal data. Trajectories, sessions and events derived from video are pseudonymised personal data: they do not identify someone directly, but the LGPD applies to them in full. Only irreversible aggregates, with a minimum population per bucket and no session identifiers, can be treated as anonymised.
Calling operational data "anonymised" when it is pseudonymised is not a detail: it changes obligations, deadlines and the trust of the customer's data protection officer.
Then, the roles
The retailer decides purpose and means: it is the controller. The platform processes on its behalf: it is the processor. That defines who installs the in-store notice, who answers data subjects, who reports incidents to the ANPD and who secures the pipeline. A data processing agreement records that division before any real footage is processed.
The safeguards
| Safeguard | What it means in practice |
|---|---|
| No facial recognition | No representation of a face is extracted or stored |
| Ephemeral identifiers | A track belongs to a session, not to a person |
| Mandatory masks | Shop windows, street and payment terminals stay out of the analysis |
| Short retention | Recorded automatic deletion, and deletion on demand |
| Data residency | Hosting in a Brazilian region by default |
| Transparency | In-store poster and employee notice, with ready templates |
The legal basis
The working hypothesis is the controller's legitimate interest, assessed per deployment with the three-part test: purpose, necessity and balancing. The impact assessment comes before the first processing and is revised at every material change.
The honest limit
Without a civil identification key, the platform cannot locate "one person's data". What it can do is report the categories and periods processed and run deletions by store and period. That limit is stated in the contract and in the reply to the data subject, because promising what cannot be delivered is the most expensive mistake in privacy.