AI hologram receptionists and UK GDPR.

Before you start

This is general guidance based on ICO publications, not legal advice. Your data protection officer or adviser should review your own setup.

With and without face recognition

Why face recognition counts as special category data

The ICO's biometric recognition guidance explains that biometric data becomes special category data when it is used to uniquely identify someone. A receptionist that matches a face to a visitor record is doing exactly that. The ICO also says processing starts when the data is collected, not only at the matching step, and still counts even when no match is found. So the rules apply to the camera at the gate as well as the greeting in the lobby.

Lawful basis and an Article 9 condition

Under UK GDPR you need a lawful basis (Article 6) and, for special category data, a separate condition (Article 9). The ICO says explicit consent is likely to be the most appropriate condition for special category biometric data. Two points from its guidance matter for a reception:

• Explicit consent must be stated. You can't infer it from what someone does, such as walking past the camera. It has to be a clear statement, such as a box the visitor ticks at registration.
• There must be a real choice. The ICO's examples say consent is only freely given if people have a genuine alternative with no downside. For a reception, that could be signing in at the desk without a photo. For staff, the ICO points to alternatives such as swipe cards or PINs.

If no condition applies, the ICO says you must consider other ways to meet your purpose and must not use a biometric recognition system.

Do a DPIA first

The ICO's DPIA guidance lists biometric data used to identify people among the kinds of processing likely to be high risk, and its biometric guidance says you must complete a DPIA before you use a biometric recognition system. The ICO also describes a DPIA as a living document to review before each deployment, so update it if you move the unit, add a site or change what it collects.

A useful DPIA for an AI receptionist covers what the camera captures and where, what is stored and for how long, who can see the visitor log, whether any data leaves the building, and what visitors who decline are offered.

Signage and notices

People have the right to be informed. The ICO says organisations must actively give people privacy information, and recommends layered and just-in-time notices. Its guidance on biometric systems notes that people can't exercise their rights if they don't know the processing is happening. For a reception, that means:

• a clear sign where the camera is, before the visitor reaches it;
• a short notice at the registration point, with the choice to sign in without a photo;
• a fuller privacy notice, on your website or by QR code, that names the controller, the purpose, the retention period and how to object or ask for deletion.

A sign alone is not enough if visitors can't avoid the camera. Place the unit so people can choose.

Retention

UK GDPR does not set fixed retention periods. The ICO expects you to base the period on business need, keep a retention schedule and delete in line with it. Decide this before go-live and put it in the privacy notice.

A working example: Race Eco Chain

Race Eco Chain, in India, runs Maya, a life-size AI receptionist on a gold-finish HoloBox911. A visitor registers once on a tablet in the guard room and takes one photo. The host gets an email straight away, and when the visitor reaches the lounge, Maya greets them by name. The privacy design shows what a careful setup looks like:

• faces are turned into numbers on the device, and no video is recorded or stored;
• conversations are live only;
• gate photos and the visitor log delete themselves after 30 days by default;
• phone numbers and email addresses are never spoken aloud;
• anyone Maya can't match with confidence gets a general welcome, never the wrong name.

Race Eco Chain is not subject to UK GDPR, so treat it as an example of design, not of UK compliance.

What HoloBox911 offers for UK data protection

• Face recognition is optional. Visitors can simply speak to the host or use the touch panel. See AI hologram host.
• UK hosting, or on-premise and offline. For UK clients, the AI's data is hosted on servers in the UK, and for European clients it is handled under EU data protection rules. The AI can also run on-premise and offline, and models can be trained on-premise, so visitor data and your documents can stay in the building. At Maruti Suzuki's vendor conference at Bharat Mandapam, an on-premise avatar answered questions on more than 750 projects, and nothing left the building.
• Answers from your documents. The host answers from the documents you approve first, and uses the web only if you turn that on.
• Agreed in writing. Where data goes is agreed for your site before go-live and put in writing.
• Certified. HoloBox911 holds ISO 9001 and ISO 27001.