GDPR and Elderly Monitoring: A Care Provider Guide

One in four adults over 65 falls in a given year — the CDC's figure. In a 60-bed home, that arithmetic is fifteen residents this year, before anyone falls twice. Monitoring is how you plan to catch them. GDPR compliance for elderly monitoring decides whether you can defend the data it produces — and no vendor badge decides that for you.

Start with the deployment, not the device category

"Is the product GDPR compliant?" is the wrong first question. GDPR regulates a processing operation, not a gadget: who set the purpose, what data leaves which room, who receives it, what happens next. The same radar sensor is proportionate in a bedroom feeding your night team, unjustified pointed at the staff room, and a different analysis again when alerts route to a relative's phone.

So this guide follows one deployment end to end: that 60-bed home fits radar fall sensors in resident bedrooms, alerts go to the two-person night shift, and the protocol is a room check. Ten decisions stand between the purchase order and a defensible install. The care-facility overview covers what the hardware does; this covers what the law asks of you.

1. Write a specific purpose

"Resident safety" fails as a purpose because nothing tests against it. Write the event and the response: detect a possible night-time fall in resident bedrooms and alert the on-shift night team, who follow the falls protocol. Now necessity has a shape — audio fails the test, video fails it, bedroom presence data passes.

Narrow wording also traps purpose creep. Six months in, someone will ask whether the same data shows which carer answers alerts fastest. That is staff performance monitoring — a new purpose with its own legal basis, its own notice, and an employment-law problem attached.

2. Decide controller and processor roles

A controller decides why and how; a processor acts on written instructions. Vendors reach for "processor" because it parks accountability with you — but the label only holds if the contract matches it. A vendor using resident data for its own product analytics, model training, or advertising is a controller for those purposes.

A home manager we spoke with signed for a system sold as "fully GDPR compliant", then found a clause letting the vendor use residents' movement data to improve its detection models. For that purpose the vendor was a controller — and her DPIA had been written around a processor that didn't exist.

Whatever the roles, the contract needs the full Article 28 set: documented instructions, confidentiality, security measures, named subprocessors, breach assistance, deletion or return at exit, audit rights. Terms living on a webpage the vendor edits unilaterally are not terms you show a regulator.

3. Identify Article 6 and Article 9 conditions separately

Every operation needs an Article 6 lawful basis. A fall alert about a named resident reveals health, so it also needs an Article 9 condition. One never substitutes for the other.

Consent looks easiest and fits worst. It must be freely given and withdrawable — a resident who depends on your staff for meals and medication is not refusing freely, and a withdrawal obliges you to switch the room off. Most providers land on legitimate interests or a public-task basis, paired with Article 9(2)(h) for health and social care, with the balancing test on paper. The ICO lawful-basis guidance is the UK starting point; EU operations need member-state advice.

4. Involve the person and address capacity

Sit with the resident before the installer arrives. Say what the box on the wall is, what it senses — movement, not images or sound — who gets the alert, and how to say no. A form signed at admission in 2024 explains nothing about a sensor fitted in 2026.

Capacity is care law's territory, not GDPR's. In England and Wales that means the Mental Capacity Act 2005 and a recorded best-interests decision naming the less intrusive options you rejected. A daughter's request is a reason to look at monitoring — not your lawful basis.

5. Apply data minimization to the architecture

Minimization is decided in the architecture, before anyone drafts a privacy notice. Put each design choice against the purpose and demand the evidence:

Camera-free shrinks the collection; it does not end the analysis. A movement trace tied to Room 14 that triggers your falls protocol is health data about the person who sleeps in Room 14.

6. Screen for a DPIA before procurement

Article 35 requires a DPIA where processing likely creates high risk. The European regulators' screening list names nine criteria and treats two as enough; bedroom monitoring of frail residents ticks four — systematic monitoring, sensitive data, vulnerable subjects, private space. The ICO DPIA guidance has the template.

A DPIA that earns its name covers:

• purpose, scope, people affected, and the data-flow diagram;
• necessity and proportionality, including the quieter options you rejected;
• risks to dignity, autonomy, confidentiality, and safety — not just data loss;
• controls with named owners, residual risk, and a sign-off;
• input from your DPO and, where workable, from residents and relatives;
• review triggers: new purpose, new model, new room type, new subprocessor.

Start it while it still has power to change the design. If residual risk stays high, prior consultation with the supervisory authority comes before go-live. A DPIA written after installation is a confession, not an assessment.

7. Set retention from purpose and other duties

GDPR hands you no retention number; you set one per category and defend it. For the 60-bed home: raw radar frames processed and discarded on the device; alert events filed with the falls log on your existing care-record schedule; account data deleted at contract end. The test: every category has an owner, a reason, and a deletion event — and none is "whatever the vendor ships by default."

Then prove deletion happens — active systems, exports, support copies, backups, subprocessors — and decide today what runs when a resident moves out or the contract ends.

8. Design rights and transparency into operations

One month — Article 12's clock from the moment a subject access request lands. A resident's son emails asking for every record of his mother's movement in March: who pulls it, from which system, in what format, and how do you handle entries that also describe the resident in the next bed?

Transparency runs wider than the resident. Staff walk the monitored corridors, agency workers cover nights — a lobby sticker is not a privacy notice for any of them. The moment monitoring touches staff performance, you are in employment law, where the power imbalance reads against you.

9. Verify security and resilience

Ask for evidence, not adjectives:

• access control, least privilege, and audit logs someone actually reviews;
• encryption in transit and at rest, key management, secure device provisioning;
• patching cadence, vulnerability handling, and change control;
• backup, restoration, and a safe-downtime procedure the night team has rehearsed;
• incident detection, breach assessment, and 72-hour notification support;
• subprocessor list, hosting locations, and the international-transfer mechanism;
• staff training, and access removal the day someone leaves.

ISO 27001 on the vendor's website describes the vendor. It says nothing about which of your staff opens the alert dashboard from a personal phone.

10. Keep local EU and sector rules in scope

GDPR harmonizes less than its reputation suggests. Member states layer on their own health and social-care law, surveillance rules, and capacity regimes — in Germany, the works council gets a say before you deploy anything that could observe staff. A deployment accepted in Ireland is not automatically lawful in France.

UK providers should pair this guide with the CQC and data-protection guide. The split matters: the ICO enforces data protection with fines reaching £17.5 million or 4 percent of turnover; CQC inspects care quality and holds your registration.

Procurement checklist

• one-sentence purpose and the service boundary;
• complete data inventory and flow diagram;
• controller, processor, and independent-purpose analysis;
• Article 6 basis and Article 9 condition, recorded;
• capacity, consultation, and transparency plan;
• DPIA screening and the assessment where triggered;
• minimization, permissions, retention, and rights workflow;
• Article 28 contract, subprocessors, transfers, deletion;
• security, incident, downtime, and fallback evidence;
• local legal, clinical, and safeguarding sign-off.

The approval standard for GDPR elderly monitoring

Here is the whole test. You hand over, unprompted: the purpose in a sentence, the data-flow diagram, the roles decision, the Article 6 and 9 record, the DPIA, the retention schedule with owners, the Article 28 contract, and the rights procedure. Any item that takes longer than a day to produce does not exist yet. Compliance never transfers from vendor to provider — the sensor is theirs, the deployment is yours.