CCTV analytics and data protection: answers to common client questions
The questions mall managers, store operators and their legal teams ask us most, and how we answer them under UU PDP and PP 33/2026.
By Stella Nurina Susanto · October 2026These are the questions we hear in almost every first meeting. The answers explain how we work and what Indonesian law asks of you. They aren't legal advice, and your counsel should review your own setup.
Is counting visitors from CCTV allowed?
The Personal Data Protection Law (UU PDP) allows cameras in public places for security, disaster prevention and traffic management, provided a notice is displayed and the footage isn't used to identify anyone. Counting visitors without identifying them is how we work, but business analysis isn't one of the purposes the law lists. How your company documents that use is a question for your legal team, and we're happy to join that conversation.
When do the new rules apply?
UU PDP has applied in full since October 2024. Its implementing regulation, PP 33/2026, was signed in July 2026 and applies from 16 January 2027. That gives you until then to have the notice, assessments and agreements below in place.
Do we need a sign at the entrance?
Yes. PP 33/2026 requires a notice stating that a camera is operating, with the operator's contact details. For an enclosed area it goes at the entrance; for an open area, somewhere people see it before they enter. It has to be clear, firm and brief.
The common international practice is a short sign at the door that links to a fuller privacy notice. Here's wording you can adapt:
Kamera di area ini digunakan untuk keamanan dan untuk menghitung jumlah pengunjung secara anonim. Kami tidak mengenali wajah atau identitas siapa pun.
Cameras in this area are used for security and to count visitors anonymously. We never identify faces or individuals.
Pengelola / Operator: [store or mall name] · [email] · [phone]
Info lengkap / Full privacy notice: [QR code] [link]
The fuller notice behind the QR code should say who you are, what the cameras are used for and on what legal basis, what data is produced (counts, not identities), how long footage is kept, that AIQU processes it on your behalf, and how visitors can contact you or object.
Who is responsible: you or AIQU?
You are. The store or mall decides why the footage is processed, so you're the data controller. AIQU processes footage on your instructions, so we're the data processor. That's why the sign carries your name and contact details, not ours. Our responsibilities are set out in a data processing agreement between us.
Do you use facial recognition?
No. The system detects and tracks anonymous shapes to count people, measure dwell time and queues. Nobody is named, matched to a face, or followed across days or locations.
What happens to our footage?
You upload recordings you already have. We use them only to produce your counts and metrics, and the raw footage is deleted 30 days after upload. Your dashboard shows totals and averages only.
Can tenants or other branches see our data?
No. Each tenant only ever sees its own storefront, alongside anonymised corridor figures. Branches and clients never see each other's data.
What paperwork should we prepare?
Under PP 33/2026, companies should expect to have:
- a data protection impact assessment before high-risk processing, with AI and machine learning named as examples;
- a written analysis if you rely on legitimate interest as your legal basis;
- a privacy notice covering the required information;
- a data processing agreement with any processor, including AIQU.
Larger operators that monitor public areas systematically and at scale may also need to appoint a data protection officer. Your counsel can confirm whether that applies to you.
Can you help us prepare?
Yes. We'll walk your legal team through exactly how footage is processed, stored and deleted, and share our data terms so they can review them before any footage is sent.