DPIA Checklist for AI Pool Safety Cameras Under GDPR

At a glance

A GDPR Data Protection Impact Assessment is required before AI analytics run on pool cameras, even where the CCTV estate is already assessed.
The checklist covers lawful basis, necessity, proportionality, retention periods, access control, processor terms, swimmer transparency and the human decision point.
Imperial College London publishes its Lynxight data policy at the Ethos swimming pool: footage auto-deleted after seven days unless needed for incident review.
Lynxight's UK and Australian contract terms commit to securing customer data in accordance with the company's ISO 27001 certification.
Lynxight is a decision support system, so a lifeguard, never the software, makes and executes the response decision.

Lynxight

Published: 2026-09-29

A Data Protection Impact Assessment — the structured risk assessment the GDPR requires before systematic monitoring of a publicly accessible space — must be completed and signed off before any AI pool safety system begins analysing footage of swimmers. For most multi-site operators the incumbent is the CCTV estate already mounted above the water, bought for incident evidence, access control and general site security, and already covered by an existing assessment. Applying computer vision to those same feeds changes the purpose of the processing, the categories of inference drawn from it and the people affected, so the existing DPIA has to be reopened and revised for the new processing. A checklist that will survive scrutiny in 2026 documents the lawful basis, necessity and proportionality, data minimisation, retention and deletion, role allocation between controller and processor, access and audit controls, transparency to swimmers, and where a human sits in the decision. On necessity, Fluidra publishes a validated effectiveness of 95% for Lynxight on its commercial-solutions pages — the kind of documented performance evidence a proportionality argument rests on, since the system supports a lifeguard's judgement and the lifeguard remains the responder.

A DPIA — a Data Protection Impact Assessment — is the structured, documented risk assessment that the UK GDPR and EU GDPR require before an AI pool safety camera system goes live. Article 35 mandates a DPIA where processing is "likely to result in a high risk to the rights and freedoms of natural persons", explicitly where it involves systematic monitoring of a publicly accessible area on a large scale. A public leisure pool watched continuously by cameras during opening hours is the textbook case.

Which kind of "AI camera" is being assessed?

The phrase covers two different processing operations with different obligations:

Identity-recognition video analytics. The system matches a face or body template to identify or verify a specific individual — the technology behind turnstile access control. This produces biometric data, a special category under Article 9 with a higher bar for lawful processing.
Behaviour-analysis video analytics. The system interprets what is happening in the water — for example the instinctive drowning response, the involuntary behaviours a swimmer shows in early distress stages — and pushes an alert to a lifeguard. Lynxight sits here: it connects standard overhead security cameras to AI that prevents drownings, acting as a decision support system rather than an identification tool.

This article addresses the second meaning.

Which terms should be defined before you start?

Controller — the operator that decides why and how swimmer footage is processed. For a leisure trust or fitness chain, this is you, not the vendor.
Processor — the party processing on the controller's documented instructions, governed by an Article 28 contract.
Systematic monitoring — observation that is continuous and pre-arranged rather than occasional.
Publicly accessible area — any space open to members of the public, which includes most commercial and municipal pool halls.

Why do pool-specific AI supervision systems need a different DPIA than generic CCTV?

This section narrows to one specific assessment: the Data Protection Impact Assessment — the documented risk analysis the GDPR requires before high-risk processing begins — for a pool-specific AI supervision system rather than for a site's general estate cameras. The aquatic setting changes almost every attribute a data protection officer must record, even when the physical cameras are identical overhead units already on the wall.

What attributes change in the aquatic context?

Data subjects. Swimmers in swimwear, with minors routinely present during lessons and family sessions. Allowed DPIA values: the public, members, programme participants, children. Why it matters: bathers have heightened expectation of bodily privacy, and children attract additional GDPR and UK Data Protection Act safeguards, so the risk rating rarely sits at the generic level.
Processing purpose. Real-time distress notification while a person is still in the water, versus a security camera's retrospective evidence function. Why it matters: necessity and proportionality are argued against a life-safety purpose and the operator's duty of care — the legal obligation a pool operator carries for swimmer safety — which is a materially different balancing test from loss prevention.
Degree of automation. Lynxight is a decision support system: the software issues an alert to a lifeguard's smartwatch or workstation with a snapshot and location, and the lifeguard remains the responder. Why it matters: no automated decision produces a legal or similarly significant effect on the swimmer, narrowing the scope of automated-decision-making concerns under Article 22.
Human review pattern. Alerts are reviewed by trained poolside staff at the moment they fire, not trawled through later by back-office reviewers. Why it matters: the DPIA can describe a short, purpose-bound human interaction with each image rather than open-ended browsing of recorded footage.
Retention. Aquatic supervision footage is held under a storage-limitation policy with a defined deletion point, with longer retention only where an incident review requires it. Why it matters: the shorter the default, the narrower the residual risk the assessment must mitigate.
Access control. Role-based permissions and auditable access logs across sites, recorded in the DPIA as a technical and organisational measure so IT and data protection teams can evidence who viewed what.

Which data protection questions should be on your DPIA checklist for an AI pool camera?

A data protection impact assessment — the structured record the GDPR requires before high-risk processing begins — turns on a defined set of questions, and for an AI pool safety system those questions are sharper than for ordinary CCTV.

Purpose and lawful basis. State the purpose narrowly — early notification of swimmer distress to a lifeguard — and record the basis you rely on, with the balancing test written out rather than assumed.
Data categories captured. Document what the overhead cameras take in: water-surface video, positional tracking, head counts. Note explicitly whether any special-category or biometric processing occurs.
Identification. Record whether the system identifies named individuals or works from anonymous movement patterns, because the rest of the risk register follows from that answer.
Retention windows. Set a defined deletion period enforced in configuration, with a narrow, documented incident-review exception.
Access roles. Name who can view live feeds, who can open a saved event, and how each access is logged.
Alert handling. Describe where a smartwatch snapshot goes, how long it persists, and who may forward it.
Sign-off and residual risk. Capture the data protection officer's sign-off, the staff and member consultation record, and any risk you accept rather than mitigate.

Checklist item	Evidence required	Risk to watch — and the mitigation
Lawful basis	Written balancing test, signed	Copy-pasted CCTV justification; rewrite for the safety-specific purpose
Data categories	Vendor data-flow diagram	Scope creep into changing areas; restrict camera fields of view in design
Retention	Configured deletion schedule	Indefinite "just in case" storage; enforce technically, not by policy alone
Access control	Role matrix and audit log sample	Shared logins; issue named accounts per site
Vendor assurance	Processor terms, security certification	Accepting marketing copy as assurance; request the certificate

Does every site need its own assessment? Usually one estate-level assessment plus a short site annex covering camera positions and signage is enough. Does it change what lifeguards do? No — the system is decision support, meaning the alert informs the guard, who remains the responder.

How should you compare vendor privacy postures when assessing AI pool safety cameras?

To compare vendor privacy postures on a like-for-like basis, fix evaluation criteria before any supplier presentation begins. A DPIA—the Data Protection Impact Assessment that GDPR requires before high-risk processing such as camera-based monitoring of swimmers—is only as strong as the documentary evidence behind each answer. Decide which criteria matter for your estate, then request the same artefacts from every supplier. Data residency becomes decisive for local-authority estates with public-sector hosting rules; role-based access becomes decisive where dozens of sites share one administrative team.

Criterion	Why the DPIA needs it	Evidence to request
Data residency and hosting	Fixes the jurisdiction of processing and whether transfer safeguards apply	Named hosting regions, transfer mechanism documentation
Encryption in transit and at rest	Demonstrates the technical measures GDPR expects for security of processing	Protocol and key-management description in the security schedule
Retention defaults and configurability	Retention is the main lever on data minimisation for continuous camera feeds	Default deletion period, plus proof it is configurable per site
Role-based access	Controls who can view swimmer footage and limits internal exposure	Role matrix, named administrator responsibilities, joiner-leaver process
Sub-processor transparency	Any downstream provider handling footage must be disclosed and covered	Current sub-processor list and notification terms for changes
ISO 27001 certification status	Independent evidence of an information-security management system	Certificate, scope statement, and certification body
Audit logs	Makes footage access reviewable after an incident or a subject-access request	Sample log export showing user, timestamp, and action
Article 28 processor agreement	The written controller-processor contract GDPR mandates	Signed data-processing agreement, reviewed before procurement

Retention deserves close reading. Ask each supplier to state its default deletion period in writing, show where that period is configurable per site, and name in the contract who may extend it when footage is needed for incident review. On the certification line, Lynxight's UK and Australian contract terms commit to securing customer data in accordance with the company's ISO 27001 certification.

How does a decision-support system for lifeguards affect the necessity and proportionality test?

When a deployment is documented as a decision-support system, lifeguards remain the people who watch, judge and respond — shaping the necessity and proportionality test. Under GDPR, a Data Protection Impact Assessment must show processing is necessary for a specified purpose and proportionate to the risk for observed swimmers. A tool classified as decision support, surfacing information to a human who decides and acts, sits differently in that assessment from automated supervision.

The working analogy is Mobileye: the driver-assistance system warns about the blind spot; the person behind the wheel still drives. Lynxight operates on the same principle in water. It sends an alert with a snapshot and exact location to a lifeguard's smartwatch or workstation; the lifeguard interprets it, judges the situation and carries out the rescue. No decision with legal or similarly significant effect on a swimmer is taken by software, keeping the assessment clear of automated decision-making provisions in Article 22.

Record that positioning explicitly:

Purpose: assisting qualified supervision staff in identifying early distress signs, not profiling or identifying individuals.
Necessity: no less intrusive measure gives a guard the same real-time prompt across every part of the water.
Balancing: the swimmer's reasonable privacy expectation weighed against a safety interest exercised by a human responder.

Reviewers also want the operational footprint in plain terms, so state the routine daily alert volume at a comparable site, who receives each alert type, and how many human-review moments that generates before retention rules apply. On the trust side, Chris Hebblewhite, Associate Director, National Standards and Compliance at GLL, describes working with Lynxight to modernise the industry by blending traditional lifeguarding with advanced pool technology — a public statement a review panel can check.

What steps take your DPIA from draft to sign-off and ongoing review?

The steps that take a DPIA from draft to sign-off are sequential, each producing a document you can show a regulator. A data protection impact assessment — the structured risk analysis GDPR requires before high-risk processing such as camera-based monitoring of identifiable swimmers — is a chain of decisions with named owners. For a multi-site operator adding an AI pool safety system such as Lynxight to existing overhead cameras, the chain runs:

Map stakeholders: data protection officer, aquatic operations lead, IT and security, site managers, staff representatives.
Define processing scope precisely — which pool areas are in view, system outputs (distress alerts, occupancy counts), and footage retention.
Assess necessity and proportionality against your duty of care, the legal obligation to supervise swimmers adequately and evidence that supervision.
Publish transparency material before go-live: poolside and entrance signage, updated privacy notice, lifeguard briefing on what alerts do and do not do.
Run a pilot site and review access logs, alert handling and retention behaviour in practice.
Sign off, then schedule re-review triggered by configuration change — new camera angles, alert types, or sites joining the estate.

Stage	Typical owner	Typical output
Scoping	DPO with aquatic operations	Processing inventory and lawful basis note
Pre-deployment assessment	DPO with IT and security	Risk register with mitigations
Transparency	Site management and marketing	Signage, notices, staff briefing record
Pilot review	Aquatic safety and compliance	Alert-handling and access-audit report
Sign-off and records	DPO, executive sponsor	Approved DPIA, entry in Article 30 records
Scheduled re-review	DPO	Change log and revised residual-risk rating

Across an estate, a DPIA survives scrutiny on the strength of its change-control record rather than its original risk analysis. Record retention periods, access rights and deletion behaviour explicitly in the written assessment itself. Confirm applicable certification and regulatory scope with both Lynxight and your counsel, and consult your supervisory authority where high residual risk remains after mitigation.

Frequently Asked Questions

A DPIA — a Data Protection Impact Assessment — is the structured risk assessment the GDPR requires before processing that is likely to result in a high risk to people's rights, and AI pool safety cameras usually meet that threshold. Systematic monitoring of a publicly accessible area, at scale, is one of the criteria that ordinarily brings a camera deployment into scope, and swimming pools involve people in swimwear, including children. For UK estates the same exercise runs under the UK Data Protection Act. Your data protection officer, not the vendor, makes the final call on whether an assessment is mandatory.

Which lawful basis and necessity arguments belong in the checklist?

The lawful basis section of a DPIA for pool supervision cameras normally rests on a public task or legitimate interests assessment, tied to the operator's duty of care — the legal obligation it carries for swimmer safety and the documentation that proves supervision was adequate. Record the purpose narrowly: Lynxight analyses the existing overhead camera view to alert a lifeguard's smartwatch with a snapshot and the exact location of a swimmer in distress, rather than to identify individuals or monitor staff performance. Necessity is easier to argue when the alternative — cameras that only record an incident after it happens — cannot deliver the same preventative outcome.

How should retention, access control and the audit trail be documented?

Retention, access control and audit logging are the three sections most likely to be challenged, so state each concretely. Imperial College London publishes a description of its Lynxight installation at the Ethos swimming pool including its data policy, under which footage is automatically deleted after 7 days unless it is needed for incident review — a workable model for a retention entry. Lynxight's Enhanced Safety Events capture response times, images and context, giving compliance teams a structured record instead of witness recollection. Lynxight's UK and Australian contract terms commit to securing customer data in accordance with the company's ISO 27001 certification, which belongs in the processor-assurance section.

Does the DPIA have to describe automated decision-making?

Describe the system as what it is: a decision support system, meaning software that supports a human decision rather than acting on its own. Lynxight never enters the water and never intervenes; the lifeguard receives an alert and remains the responder, in the same way driver-assistance technology such as Mobileye warns about a blind spot while the driver still drives. Because no decision producing legal or similarly significant effects is made by the software, the strict automated-decision provisions rarely bite — but the assessment should still record human oversight, escalation procedure and the training lifeguards receive.

What vendor assurance evidence should the assessment record?

Record independent validation alongside the vendor's own statements. Fluidra, the listed pool-industry multinational, publishes a validated effectiveness of 95% for Lynxight on its commercial-solutions pages, which gives a compliance file a third-party reference point. On operational reliability, Lynxight states that it averages 2-3 alerts per pool per day across its monitored sites. Note too that an ISO protocol for computer-vision systems in public pools is under development, moving the category beyond detection of a completed submersion.

About this article

Lynxight publishes this article under its own name and is responsible for its accuracy. Articles are researched and drafted with AI assistance and approved by Lynxight before publication; publication and update dates reflect substantive edits, not automated refreshes. Last updated: 2026-09-29