Automatic Number Plate Recognition (ANPR)
-
Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
Checklist
☐ We have identified a genuine need to read Vehicle Registration Marks (VRMs) from vehicles using public or private roads and car parks, in a way that is fair, lawful and transparent.
☐ We have conducted a Data Protection Impact Assessment (DPIA) that fully addresses our use of ANPR, and explores any impact on the rights and freedoms of individuals whose personal data are processed.
☐ We keep the number of ANPR cameras we use to a minimum, to ensure that we only use the appropriate amount in a specific area to address a particular need.
☐ We ensure that the location(s) of our cameras are fully justifiable, and are placed in such a way that they do not accidently capture any vehicles that are not of interest.
☐ We have clear and prominent signage in place to inform individuals that ANPR is in use, with sufficient detail about who to contact if they have a query.
☐ We have appropriate retention and disposal policies in place for any vehicle data we process.
☐ We have efficient governance procedures in place to be able to retrieve stored data and process it for subject access requests or onward disclosures where required.
☐ Where we process other supplementary data for the purpose of matching data obtained from cameras, we ensure that it is kept up-to-date and relevant to the purpose of the ANPR system.
☐ We comply with the Surveillance Camera code of practice where required.
Automatic Number Plate Recognition (ANPR) systems have the ability to collect and analyse large quantities of personal data in real time. Cameras process personal data when vehicles drive past their field of vision. Despite ANPR being more commonly used by law enforcement, these systems are also used by privately-owned car parks and other businesses. Millions of number plates have the potential to be scanned and cross-referenced with live databases across the UK. Due to the increasing affordability of these systems, its use in both the public and private sectors are popular.
ANPR systems generally capture:
- images of vehicles (an overview image);
- images of the vehicle’s number plate (the plate patch); and
- the vehicle registration mark (VRM)
ANPR systems also commonly supplement data collected from their cameras with additional information, such as the date, time and location of the vehicle. It is therefore important that you are aware of your responsibilities around processing personal data.
Is a Vehicle Registration Mark (VRM) personal data?
A VRM is a unique mark linked to a specific vehicle, displayed on its number plate. Surveillance technologies such as CCTV and ANPR can process VRMs for law enforcement purposes or civil matters, such as parking enforcement.
In most circumstances, a VRM is personal data. However, this can depend on the context of the processing. A VRM is personal data at the point where you collect it, if you process it as part of a surveillance system for the purposes of identifying an individual (potentially to take some action, such as to serve them with a parking fine).
This is because while the VRM may not directly identify a living individual, the purpose of the system means that you are likely to find out further information. This will enable you to identify either the driver, registered keeper or both.
How should we use ANPR?
Regardless of the sector you operate in, if you are using or intend to use an ANPR system, it is important that you undertake a DPIA prior to deployment. You should show that the use is necessary and proportionate in the circumstances, and that you have minimised the risks. This is particularly important given the amount of data an ANPR system can collect in a relatively short amount of time. You should also ensure that the information your ANPR system processes is limited to what you need to achieve your purpose, and that you are able to justify your decisions surrounding the data it captures.
When storing the information and cross-referencing it with other databases to identify individuals, you need to keep these databases:
- up-to-date;
- accurate; and
- of sufficient quality to prevent mismatches.
Similarly, both the cameras and any algorithms you use to determine a match must be of sufficient quality to prevent any misidentification of a VRM.
If you intend to share the personal data you process with third parties you need to make sure that doing so is lawful. We also advise you to have a data sharing agreement in place. This agreement should ensure that you have appropriate safeguards in place to keep the information secure, and that the amount of information you share is limited to what is necessary. Read further guidance about data sharing in our data sharing code.
You also need to have appropriate retention periods in place for the personal data you collect and store through your ANPR system. The retention periods should be consistent with the purpose you are collecting the data for. You should only keep the data for the minimum period necessary and should delete it once you no longer need it. For example, this could apply to personal data stored for vehicles that are no longer of interest.
Example
A gym uses an ANPR system that processes VRMs to monitor use of its car park when there is a two-hour parking limit. The system retains the details gathered from the ANPR system for those cars that have exceeded the time limit, but also about those who have not exceeded the parking limit.
It is likely there is no need to retain information for an extended period for vehicles that have adhered to the time limit. It would be unnecessary and excessive to do so, unless there was a justifiable reason. If not, the extended retention of this information is unlikely to comply with the data protection principles.
The gym would need to amend the system to ensure that they delete any information about vehicles that are not of interest, as soon as appropriate.
Signage
In keeping with the principle of fairness and transparency, it is important that you inform individuals you are processing their personal data. The best way to do this is through clear and visible signage explaining that ANPR recording is taking place and, if possible to do so, the name of the controller collecting the information. While it is a challenge to inform motorists that they are being overtly monitored, there are methods you can use, such as physical signs at entrances, posts on official websites and social media.
You must provide appropriate signs to alert drivers to the use of cameras on the road network or in areas that vehicles have access to, such as car parks. It is important that these signs do not affect the safety of road users. You should consider the amount of time the driver will have to read the information you provide; particularly where the road has a high speed limit.
Signs must make clear that cameras are in use and explain who is operating them. This means that individuals know who holds information about them and therefore have the opportunity to make further enquiries about what is happening with their data.
Further reading
We have further guidance on ‘what is personal data’.