Regulators, analysts and practitioners keep coming back to one question about AI video analytics: where should the footage and the inferences drawn from it be processed? This roundup sets six published statements side by side, from the UK, Australia and the UAE. They agree that every camera frame is personal data that someone must justify. They split on whether control over the infrastructure settles that question or only begins it.
THE QUESTION
What Is The Case For Keeping Video Analytics On-Premise?
The case is that video of people is personal data, and every copy, transfer and third-party processor adds a duty the operator must justify and defend. Processing on infrastructure the organisation controls keeps the number of copies, places and parties as small as possible.
Nobody quoted here was interviewed for this article. Each quote is taken word for word from the published page linked beside it. The sources were chosen because the reader of this article answers to these frameworks: UK GDPR in Britain, the Privacy Act in Australia, the PDPA in Singapore and the PDPL in the UAE, along with buyers in the United States who sell into those markets or follow them.
THEME ONE
Regulators Start From The Intrusion Itself
The regulators begin before any architecture question. They say any system that analyses faces or bodies interferes with privacy from the moment it switches on, and that the operator has to show why it is needed.
Carly Kind, Privacy Commissioner at the Office of the Australian Information Commissioner, wrote in the OAIC blog post "Facial recognition technology in retail settings: after the Bunnings decision", published on 19 November 2024:
"the use of facial recognition technology interferes with the privacy of anyone who comes into contact with it."
For a buyer, this means the privacy impact covers everyone the camera sees, including customers, contractors and passers-by who are never flagged. An analytics design that sends every frame to an outside service exposes all of those people to a second organisation's systems. In July 2026 the OAIC went further. Its updated guidance on facial recognition in retail spaces confirms that Australian law requires a precautionary approach, with each deployment assessed on its own against the Privacy Act.
The UK's Information Commissioner's Office guidance on surveillance systems makes the same point in operational terms. Organisations must identify the minimum personal data their purpose needs, and keep it only for the shortest period that purpose requires. A default retention length does not meet that test. An on-premise design makes the minimum easier to prove, because the operator can show exactly what is stored, where it is stored and when it is deleted.
THEME TWO
Proportionality Decides Which Analytics Should Run
Both regulators ask whether a gentler method would do the job. That question comes before any question about where the processing happens.
In the same OAIC post, Carly Kind wrote:
"Entities should ask whether other, less intrusive methods could achieve the same outcome."
This quote should change how a buyer scopes a project. A site that wants to count people at a door, or check helmets at a gate, has a less intrusive option than identifying faces. Choosing analytics that never establish identity, and keeping even those on site, is the kind of answer the Commissioner's question invites.
William Webster, the UK's Biometrics and Surveillance Camera Commissioner, set out a similar threshold in his response to the live facial recognition consultation, published on GOV.UK on 24 February 2026:
"Consequently, the use of intrusive technologies should only be used for very serious offences and not minor infringements."
The same response says operational thresholds and false positive and false negative rates must be carefully monitored and audited. For a buyer, an audit like that needs access to the system's settings, logs and detection records. That access is simplest when the system runs on hardware the operator holds, and harder when the thresholds sit in a vendor's cloud.
THEME THREE
Sovereignty Means Control Over Data And Over The AI
The industry voices put the argument in terms of ownership and visibility. Their view is that control over the infrastructure is what makes everything else possible.
Daniel Valle, CEO of SCC Middle East, speaking at the UAE Data Summit 2026, was reported by Gulf News on 16 June 2026:
"Your data is your identity. Don't give it away."
Read alongside the UAE's PDPL, this is an argument for treating video of employees, visitors and customers as an asset that stays in the organisation's hands. It is a blunt version of the minimisation duty the regulators describe.
Ahmed Alhadidi, Chief Strategy Officer at Ansen, speaking at GISEC Global 2026, was reported by Gulf News on 16 September 2026:
"sovereignty is about knowing, with confidence, what the AI running on top of that infrastructure is actually doing."
Alhadidi's point matters most to security teams. Hosting video locally is one step. An operator also has to be able to see which models run, which events they raise and where those events go. A buyer should ask any vendor to show its outbound network traffic, what it stores and how it updates its models.
Gaurav Gupta, VP Analyst at Gartner, was quoted in a Gartner press release reported by Petri IT Knowledgebase on 3 February 2026:
"Data centers and AI factory infrastructure form the critical backbone of the AI stack that enables AI sovereignty."
Gupta is writing about national and regional AI infrastructure, and his point carries down to a single site. The compute decides who has sovereignty. If the inference runs on a server in the operator's comms room, the operator holds it. If the inference runs somewhere else, the operator holds a contract.
READING THEM TOGETHER
Where The Experts Agree And Where They Split
All six voices agree that the operator has to justify, contain and account for video analytics. They split on what has to be justified first. The regulators ask whether the processing should happen at all. The industry voices ask who controls it once it does.
| Person | Role | Publisher and Date | Core Point |
|---|---|---|---|
| Carly Kind | Privacy Commissioner, OAIC | OAIC, 19 November 2024 | Facial recognition intrudes on everyone it sees |
| Carly Kind | Privacy Commissioner, OAIC | OAIC, 19 November 2024 | Test less intrusive methods first |
| William Webster | Biometrics and Surveillance Camera Commissioner, UK | GOV.UK, 24 February 2026 | Reserve intrusive tools for very serious offences |
| Daniel Valle | CEO, SCC Middle East | Gulf News, 16 June 2026 | Keep ownership of your data |
| Ahmed Alhadidi | Chief Strategy Officer, Ansen | Gulf News, 16 September 2026 | Sovereignty means knowing what the AI does |
| Gaurav Gupta | VP Analyst, Gartner | Petri IT Knowledgebase, 3 February 2026 | Infrastructure underpins AI sovereignty |
The honest reading is that on-premise processing answers the industry's question and only part of the regulators'. Keeping video local reduces transfers, processors and exposure. It does not make an unnecessary facial recognition deployment lawful in Sydney or Manchester. Here are three conclusions a buyer in any of the five markets can act on.
Justify Before You Deploy
Write down the purpose, then choose the least intrusive analytic that serves it. Counting, zone entry and PPE checks do not need to identify anyone. Keep identification for the cases Webster describes, and record the reasoning the OAIC expects for each deployment.
Contain What You Collect
Process on hardware you control, store events and snapshots on site, and set a retention period from the purpose, as the ICO requires. Fewer copies in fewer places means fewer duties under UK GDPR, the Privacy Act, the PDPA and the PDPL.
Prove What The System Does
Following Alhadidi and Webster, keep the thresholds, error rates and outbound connections open to audit. An operator who can show its auditors the configuration and the network traffic holds a stronger position than one who points to a vendor's assurance.
WHERE ARSA FITS
How ARSA Approaches On-Premise Video Analytics
ARSA runs no cloud inference service. Its analytics run either on an edge appliance next to the cameras or as software on servers the customer already owns. On the appliance, detection, alerting and the local dashboard work with no network connection, and cloud connectivity is optional and off by default. The system analyses streams without recording them. Event metadata and detection snapshots stay on the unit, and video retention stays with the customer's own VMS or NVR, where the retention period the ICO asks for can be set.
The modules match the proportionality advice above. PPE detection, hazard zones, people counting, vehicle counting and audience measurement do not need to identify anyone. Organisations with server capacity can run the same analytics on their own hardware through the AI Video Analytics Software. Camera placement follows the published ARSA-CVS-001 standard: 2 MP minimum at 15 fps, and 262 PPM for helmet detection. ARSA delivers outside Indonesia. Where visa conditions prevent ARSA engineers from travelling, a qualified local partner installs under ARSA supervision. A Remote Camera Design Review or a pilot deployment can test whether a site's cameras are suitable before anything is committed. For a wider comparison of the architectures, see Edge AI Vs Cloud AI for Enterprise Video Analytics.
FAQ
Frequently Asked Questions
Why Do Security Leaders Keep AI Video Analytics On-Premise?
They do it to keep control of personal data and to keep the system auditable. Processing video on infrastructure the organisation holds limits copies, transfers and outside processors. It also gives auditors direct access to thresholds, logs and outbound traffic, which the UK Biometrics and Surveillance Camera Commissioner says must be monitored and audited.
Does On-Premise Processing Make Video Analytics Compliant With UK GDPR?
No. It helps, but it does not settle the question on its own. The ICO still expects the minimum personal data for a defined purpose and the shortest retention period that purpose requires. Local processing makes those duties easier to meet and to prove, and the purpose still has to justify the processing.
What Does Australia's Privacy Commissioner Expect Before Facial Recognition Is Deployed?
The Commissioner expects a precautionary, case-by-case assessment under the Privacy Act. The OAIC's guidance asks entities to consider whether less intrusive methods could achieve the same outcome. For many safety and counting tasks, analytics that never identify a person meet that test.
How Long Should Surveillance Footage And Analytics Data Be Kept?
Keep it for the shortest period the stated purpose requires. The ICO says retention must follow from the purpose, so a vendor's default setting is not enough. Separating detection events from recorded video lets each be kept for its own justified period.
What Does Data Sovereignty Mean For Video Analytics In The UAE?
It means the organisation keeps ownership of its data and can see what the AI processing it is doing. Speakers at the UAE Data Summit and GISEC Global 2026 framed it that way. It fits the UAE's PDPL, under which the organisation that controls the data stays accountable for it.
For a reader who wants to see on-premise analytics in practice, the ARSA AI Box Series shows one way to do it, and you are welcome to get in touch with questions about a specific site.
