Country-specific DPIA support for AI retail analytics deployments
Formiti supports Palexy with jurisdiction-specific Data Protection Impact Assessments for its AI-powered Store Analytics deployments across multiple countries — addressing privacy, surveillance, transparency, and AI governance considerations on a per-market basis.
About Palexy
AI-powered retail store analytics
Palexy provides AI-powered retail store analytics that use existing CCTV infrastructure and store data to generate operational insights for retailers. Its platform delivers visibility into customer journeys, traffic patterns, engagement, conversion behaviour, service quality, and staff alignment with footfall.
These insights help retailers optimise in-store operations, allocate staffing more effectively, and improve customer experience — without requiring new sensor hardware. Because the analytics layer derives from camera-based observation in physical retail environments, deployment must be assessed against the privacy and AI governance expectations of each jurisdiction in which it operates.
How Formiti supports Palexy
Specialist privacy and AI governance partner for global deployment
Formiti delivers country-specific DPIA support for Palexy's deployments, enabling retail clients to implement Store Analytics with a defensible governance position in each market. Our assessments examine the full lifecycle of camera-derived processing against local legal expectations.
Privacy risk assessment
Identification and treatment of risks to data subjects from camera-derived analytics.
Surveillance proportionality
Necessity and proportionality analysis for in-store visual observation.
Transparency & lawful basis
Notice design and lawful processing analysis aligned to local supervisory expectations.
Controller / processor mapping
Clear allocation of roles between Palexy, retailers, and integration partners.
Cross-border considerations
Transfer mechanisms, localisation expectations, and intra-group data flows.
AI governance relevance
Mapping to emerging AI governance frameworks where applicable per jurisdiction.
Why this matters
AI retail analytics needs jurisdiction-specific assessment
Retail analytics solutions that rely on camera infrastructure and behavioural inference operate at the intersection of personal data protection, workplace monitoring rules, consumer transparency expectations, and AI governance maturity. These do not move at the same pace, and they vary significantly between jurisdictions.
A DPIA — or its local equivalent — provides a structured way to evaluate proportionality, document mitigations, and demonstrate accountability to supervisory authorities and to retail customers procuring the technology.
Country summaries
Executive summaries by jurisdiction
Each summary reflects Formiti's jurisdiction-specific assessment of Palexy Store Analytics against local privacy and AI governance expectations. Select a country to view the executive summary of assessment findings.
Australia
Privacy Act 1988 (APPs)
Privacy: CCTV-based analytics in retail must align with APP 3 and APP 5 transparency obligations and reasonable necessity tests.
AI relevance: Voluntary AI Ethics Principles apply; emerging guidance on automated decision-making in customer environments.
United Arab Emirates
Federal PDPL (No. 45 of 2021)
Privacy: Lawful basis, controller/processor clarity, and explicit transparency for video-derived analytics required.
AI relevance: UAE National AI Strategy and Charter shape expectations for ethical and accountable AI deployments.
Indonesia
PDP Law (UU 27/2022)
Privacy: Consent and legitimate interest pathways must be carefully assessed for in-store visual analytics.
AI relevance: MoCI AI Ethics Circular sets expectations for transparency and human oversight of AI systems.
Malaysia
PDPA 2010, including 2024 Amendments
Privacy: The General, Security, Notice and Choice, and Data Integrity Principles apply to in-store camera-derived analytics.
AI relevance: Accountability for anonymised retail analytics, signage, retention, and governance controls is central to responsible deployment.
Qatar
Law No. 13 of 2016 (PDPPL)
Privacy: Special-nature data handling and notice obligations apply to retail surveillance-derived processing.
AI relevance: Qatar National AI Strategy emphasises responsible deployment and oversight in commercial settings.
Japan
APPI (as amended)
Privacy: Purpose specification, retention minimisation, and PPC guidance on camera-image use in retail apply.
AI relevance: METI AI Governance Guidelines and Hiroshima AI Process inform accountable AI use cases.
South Korea
PIPA
Privacy: Strict CCTV provisions, signage, and processing-purpose limits apply to in-store visual analytics.
AI relevance: PIPC AI Privacy guidance and the AI Framework Act set expectations for risk assessment.
Vietnam
PDPD (Decree 13/2023) & PDP Law 2025
Privacy: DPIA-equivalent assessments and data subject notice obligations apply to camera-driven analytics.
AI relevance: National AI Strategy 2030 and emerging guidance shape ethical AI deployment expectations.
Saudi Arabia
PDPL (as amended)
Privacy: Lawful basis, transparency, and cross-border transfer rules apply to retail analytics processing.
AI relevance: SDAIA AI Ethics Principles and Generative AI Guidelines inform accountable AI deployments.
Philippines
Data Privacy Act 2012
Privacy: NPC advisories on CCTV and proportionality tests apply to in-store behavioural analytics.
AI relevance: DTI AI Roadmap and NPC guidance inform responsible AI use in customer-facing contexts.
Thailand
PDPA B.E. 2562 (2019)
Privacy: Lawful basis selection, notice, and PDPC guidance on CCTV in commercial premises apply.
AI relevance: ETDA AI Governance Guideline shapes risk-based expectations for AI deployments.
United Kingdom
UK GDPR & DPA 2018 (DUAA 2025)
Privacy: ICO CCTV guidance, transparency under Articles 12–14, and legitimate interests assessments apply to in-store visual analytics.
AI relevance: UK pro-innovation AI framework and ICO guidance on AI and biometrics shape accountable deployment expectations.
Hong Kong
Personal Data (Privacy) Ordinance (Cap. 486)
Privacy: PCPD CCTV guidance, Data Protection Principles, and notification/openness obligations apply to retail video analytics.
AI relevance: PCPD Model Personal Data Protection Framework for AI informs responsible AI deployment in commercial settings.
Singapore
PDPA 2012 (as amended)
Privacy: PDPC Advisory Guidelines on CCTV and image data, plus consent and notification obligations, apply to in-store visual analytics.
AI relevance: Model AI Governance Framework and AI Verify inform expectations for transparent, accountable AI deployments.
Frequently asked questions
About the Palexy DPIA programme
What is the Palexy Store Optimizer platform?
Palexy Store Optimizer is an AI-powered retail analytics platform that uses in-store cameras and edge processing (Palexy PBOX and secure RTSP streams) to deliver privacy-preserving, non-identifying demographic and footfall insights without retaining persistent identifiers.
Why does Palexy need country-specific DPIAs?
Each jurisdiction imposes distinct legal bases, transparency, CCTV signage, biometric, cross-border transfer, and AI governance requirements. Formiti delivers a per-country DPIA so Palexy and its retail customers can evidence compliance with local privacy laws and regulator guidance.
Does Palexy perform facial recognition or biometric identification?
No. Formiti's assessments confirm that the Palexy Store Optimizer does not perform biometric identification or facial recognition and does not create persistent templates that uniquely identify individuals.
Which countries are covered by the Formiti DPIA programme for Palexy?
Coverage currently includes Australia, United Arab Emirates, Indonesia, Malaysia, Qatar, Japan, South Korea, Vietnam, Saudi Arabia, Philippines, Thailand, United Kingdom, Hong Kong, Singapore.
Deploying AI-enabled retail analytics internationally?
Speak with Formiti about cross-border DPIA support and AI governance for retail analytics programmes. We provide jurisdiction-specific assessments, controller/processor mapping, and supervisory-ready documentation.