Retail sector compliance: GDPR & AI Act

Why the 'Retail & Distribution' sector is concerned

The retail and distribution sector processes customer data at scale: loyalty cards, purchase histories, CRM, point-of-sale systems, e-commerce. Loyalty programmes and prospecting concentrate the key GDPR issues (legal basis, information obligations, profiling).

Point-of-sale security involves video surveillance, which is governed by GDPR both for asset protection and employee monitoring purposes (proportionality, information requirements).

On the AI side, recommendation systems generally fall within the limited-risk category. By contrast, 'smart' cameras used for behavioural analysis or in-store recognition involve sensitive data and a use case regulated by the AI Act — one that should not be deployed without an appropriate framework.

GDPR — loyalty programmes, CRM, video surveillance

The retailer acts as data controller for loyalty programmes, CRM, payment processing, and video surveillance. It must govern profiling and direct marketing, inform customers and employees, ensure proportionate video surveillance, and manage retention periods.

Key obligations

• Legal basis and information notice (loyalty programmes, prospecting).
• Framework for marketing profiling.
• Proportionate and declared video surveillance.
• Security and retention periods.

AI Act — recommendation and cameras

Recommendation and personalisation generally fall under limited risk (transparency). 'Smart' cameras for behaviour analysis or recognition involve biometric data and a regulated use case that should be ruled out without an appropriate framework.

Key obligations

• Qualify uses (recommendation = limited risk).
• Prohibiting unauthorised biometric analysis in stores.
• Transparency on AI usage.
• Alignment with GDPR (profiling, biometrics).

Comparative overview of regulations

How these regulations interact

Retail compliance focuses primarily on GDPR: loyalty programmes, prospecting, profiling and video surveillance concentrate regulatory scrutiny. Recommendation AI is layered on top via profiling (GDPR) and transparency (AI Act).

The emerging area of vigilance is in-store analytics: 'smart' cameras and biometrics combine GDPR obligations (sensitive data) with AI Act requirements (regulated use). In the absence of an appropriate framework, abstaining is the safer approach.

Application timeline

• 1GDPR. In force; frequent audits (loyalty programmes, video surveillance).
• 2AI Act. Biometric restrictions from February 2025; progressive transparency.

Applicable penalties

GDPR up to €20M or 4%, AI Act up to €35M or 7% for prohibited practices. Disproportionate video surveillance and non-compliant marketing are frequent grounds.

Compliance roadmap

• 1Govern loyalty schemes. Legal bases, transparency and profiling under control.
• 2Frame prospecting. Consent/opt-out and unsubscribe.
• 3Scaling video surveillance proportionately. Information, proportionality, and retention periods.
• 4Ruling out biometrics in stores. Prohibiting unauthorised biometric analysis.
• 5Steer. Register, DPO, and periodic review.

How Data Comply One supports the sector

Data Comply One covers GDPR and the AI Act on a single platform, with an outsourced DPO, and supports distributors on loyalty programmes, video surveillance and the question of smart cameras.

DCO offers tailored templates (loyalty programme notices, video surveillance DPIA, prospecting framework).

Frequently asked questions