Building sensors can tell property teams a great deal about how spaces are used. They can also collect more about people than anyone intended. In washrooms, hospitals, offices and homes, trust depends on getting this right from the start.
Privacy-first design does not mean collecting nothing. It means collecting only what each decision needs, in the least intrusive way, and being able to explain it. This checklist is for architects, consultants and property teams specifying sensing in occupied buildings.
Start from the decision, not the sensor
For each space, write down the decision the data will support, for example "send a cleaner when a washroom has been used heavily" or "alert staff if someone has not moved in an accessible toilet for a set time". Then choose the simplest signal that supports that decision.
If a decision can be made from a door contact or a people count, it does not need anything more detailed.
Match the signal to the space
- In washrooms, changing rooms and clinical spaces, use non-camera sensing such as door state, thermal or radar presence.
- In offices and meeting rooms, anonymous occupancy or people counts are usually enough for space and energy decisions.
- Where cameras already exist for security, keep their use separate from building analytics unless there is a clear, documented reason.
Define what is never collected
Write an explicit list of what the system will not capture, and design it so that it cannot. Typical examples:
- No identifiable images or audio.
- No identification of individuals, unless a separate, consented system requires it.
- No tracking of a person's movement between spaces.
A short "never collected" list is one of the most reassuring things you can show tenants, staff and regulators.
Document where processing happens
Record where data is processed and stored: on the device, on a local gateway, on a server in the building, or in a cloud service, and in which country. Processing at the edge, so that only events or counts leave the room, reduces what could ever be exposed.
Keep this record with the project documents so it can be shared with a data protection officer or a client's IT team.
Limit retention and access
- Keep raw data only as long as it is needed to produce events or reports.
- Aggregate older data, for example into hourly or daily counts.
- Give each role access only to the views it needs.
- Log who changed settings and when.
Tell people what is measured
Clear, plain-language notices at the entrance to sensitive spaces explain what is measured and why, and who to contact with questions. People are far more comfortable with sensing they understand.
Check the requirements of local data protection law. In Hong Kong this is the Personal Data (Privacy) Ordinance; other places have their own rules.