The Home Office has published a data protection impact assessment for live facial recognition used by Immigration Enforcement, as the programme moves from a trial phase into formal delivery. Published on GOV.UK on 22 October 2026, the assessment covers the software, hardware and operational processing behind the system, and explains how officials evaluated and reduced the data protection risks to meet UK GDPR accountability requirements. It is a redraft of the assessment prepared for the original proof of concept, which scanned around 7,500 faces during its trial deployments.

What the safeguards say

Under the plans, cameras compare faces in real time against a deployment-specific watchlist and raise an alert when a similarity score passes a set threshold. Watchlists are limited to people sought for enforcement or criminal proceedings, such as those who entered in breach of a deportation order, and people under 18 will not be included. The document states that the technology does not make enforcement decisions: every alert must pass immediate human review and secondary identity checks before any action is taken. Images of people who do not match are deleted automatically and immediately, and no camera footage is retained after a deployment.

What is still unclear

The assessment is candid about the limits of the technology, accepting that live facial recognition interferes with the private life rights of everyone whose face is captured, while arguing that the interference is limited and proportionate. It scores the risk of legal challenge over systematic monitoring as its highest before mitigation, and flags bias across demographic groups as a live concern. Some practical details remain unfinished, including parts of the data-sharing arrangements with police for joint deployments, and the document notes that processing had not yet begun under the delivery phase when it was published. Check the official GOV.UK page, as rules change.

Sources: GOV.UK, Biometric Update.