Why Surveillance Concerns Matter to Your Business

You may not operate police cameras or collect vehicle location data, but your business probably handles personal information every day. Customer names, phone numbers, identity documents, delivery addresses, payment records, CCTV footage and staff attendance data can all create privacy responsibilities.

The difficult question is not simply whether technology can collect more information. It is whether you should collect it, who can access it, how long you keep it and whether people understand what is happening. A recent United States survey shows how quickly public support can change when surveillance feels excessive or poorly controlled.

According to a YouGov survey of 20,000 people, 46% of respondents opposed police surveillance cameras in their communities, while 38% supported them. The survey represented a reversal from the previous year, when most respondents supported the cameras. Source: TechCrunch

TL;DR: Customers and employees are becoming more careful about how businesses collect and use personal data. For your SME, clear notices, limited access, sensible retention and human oversight are practical ways to reduce risk and strengthen trust.

The lesson is straightforward: technology may be useful, but people expect boundaries. If your business introduces automation without explaining those boundaries, the system can create more concern than convenience.

What This Means

License plate reader systems use cameras and software to identify vehicle registration numbers and record where vehicles appear. In the United States, Flock operates more than 120,000 license plate readers, according to the report. Source: TechCrunch

Supporters may see these systems as tools for investigations, traffic management or community safety. Critics worry that the technology can create a detailed record of people’s movements, especially when access controls, oversight and deletion rules are unclear.

For an SME, the equivalent issue may appear in a smaller and less obvious form. You might install CCTV, use facial recognition at an entrance, track delivery drivers, record customer calls or connect a chatbot to your customer database. Each tool can have a legitimate business purpose. The risk begins when data collection expands beyond that purpose.

Key insight: People do not judge automation only by what it can do. They judge it by whether the purpose is clear, the boundaries are reasonable and someone is accountable when things go wrong.

This is also why privacy should not be treated as a document that sits unused in a folder. It should become part of how you design workflows. Malaysia’s Personal Data Protection Act 2010 provides the main framework for personal data protection in commercial transactions. You should review your practices with a qualified adviser where the situation is complex, especially after introducing a new system or handling sensitive information.

How This Applies to Malaysian SMEs

Retail and service businesses: If you operate a shop, salon, clinic, tuition centre or workshop, you may use CCTV to protect premises and resolve disputes. That purpose is easier for customers to understand when you display a clear notice and restrict access to authorised staff. Avoid keeping footage indefinitely when a shorter retention period can meet your operational needs. You should also know whether your camera vendor stores recordings remotely and who can retrieve them.

Delivery, logistics and field-service businesses: Tracking can help you assign jobs, confirm arrival times and respond to customer questions. However, continuous location monitoring can affect drivers’ privacy and morale if there are no clear rules. Explain when tracking is active, what information is recorded, who reviews it and when it is deleted. Separate legitimate operational monitoring from unnecessary observation of staff outside working hours.

Professional services and customer support: Accounting firms, agencies, repair companies and call centres often store identity documents, invoices, contracts and recorded conversations. Automation can organise these records, but access should match job responsibilities. A customer service employee may need a ticket history, while not needing access to unrelated identity documents. Role-based permissions reduce accidental exposure and make investigations easier.

Small online businesses: If you use forms, messaging platforms, email marketing or a customer relationship management system, you are still making decisions about personal data. Collect only information that helps you fulfil a clear business purpose. For example, a delivery address may be necessary for fulfilment, while a date of birth may not be. A shorter form can also make it easier for customers to complete an enquiry.

Staff management: Attendance software, biometric devices and productivity dashboards may appear efficient, but they can create strong employee concerns. Before introducing them, document the problem you are solving and consider a less intrusive option. Tell employees how the information will be used, avoid repurposing it without notice and ensure managers do not treat an automated flag as proof of misconduct.

A Simple Data Responsibility Check

Business question	Practical action
Why are we collecting this data?	Write one specific operational purpose before activating a feature.
Who needs access?	Create user roles and remove access when duties change.
How long should we keep it?	Set a review or deletion date instead of keeping everything permanently.
Can people understand the process?	Use a short privacy notice at the point of collection.
What happens if the system is wrong?	Provide a human review process for important decisions.

The table is a starting point, not a substitute for legal advice. Your obligations may differ depending on the type of data, industry and service providers involved.

Practical Takeaways for Your Business

• Map your data: List what customer and employee information you collect, where it is stored and which vendors can access it.
• Use purpose limits: Do not collect extra information merely because a software feature makes it possible.
• Write plain-language notices: Explain what is collected, why it is needed and how people can contact you with questions.
• Limit administrator accounts: Use individual logins rather than shared credentials, and review access regularly.
• Set retention rules: Decide when invoices, recordings, messages and applications should be reviewed or removed.
• Check suppliers: Ask software providers where data is stored, how it is protected and what happens when you end the service.
• Keep humans involved: Automated alerts can assist decisions, but they should not automatically determine disciplinary, credit or customer outcomes without review.
• Test your process: Ask a staff member to explain your privacy notice and data-handling steps. If they cannot, simplify them.
• Prepare an incident plan: Decide who will investigate, contain and communicate a suspected data exposure.

The Bigger Picture

The debate over police license plate cameras shows that public acceptance is not permanent. A system can be promoted as useful, yet lose support when people believe safeguards are weak or oversight is missing. The report also noted that more respondents said the surveillance would not make them feel safer. Source: TechCrunch

For Malaysian SMEs, this creates a practical opportunity. You do not need a large compliance department to build better habits. You need clear purposes, sensible limits and an owner who takes responsibility for the systems used by the business.

Trust can become part of your customer experience. When you explain why you request information, avoid unnecessary collection and respond promptly to concerns, customers have a reason to feel comfortable dealing with you. Employees are also more likely to accept monitoring when they understand its boundaries and can challenge mistakes.

As automation becomes more common, the businesses that stand out will not necessarily be those collecting the most data. They will be the ones using the right data carefully, explaining their choices clearly and correcting problems quickly. Before adding another camera, tracking tool or automated workflow, ask one simple question: Would I be comfortable explaining this process directly to the person affected? If the answer is no, redesign the process before switching it on.

Ready to Streamline Your Operations?

Your business should run itself. AutoRunBiz deploys AI agents to automate your daily operations — WhatsApp orders, invoicing, customer follow-ups, and accounting. Book a free 15-min ops audit to see where automation fits your business →