Of all the tools in a modern video analytics stack, facial recognition is the one that draws the sharpest reactions. It is, on one hand, the most powerful capability you can layer onto a camera network: the ability to spot a specific person in a crowd, in real time, is something no human guard can do reliably across dozens of feeds. On the other hand, it is the most scrutinised feature in the entire field, and rightly so. It touches identity, consent, and the uneasy line between security and surveillance.
If you are a security decision-maker in Malaysia weighing whether facial recognition belongs in your environment, you deserve a measured answer rather than a sales pitch. This article sets out what the technology actually does, where it earns its place, the concerns you should take seriously, and how to deploy it responsibly under the Personal Data Protection Act 2010 (PDPA).
A note on how it works. Like the rest of the ADA AI analytics suite that G Five AI Security deploys, facial recognition runs as a software layer on your existing CCTV. There is no hardware swap and no rip-and-replace. That matters for governance as much as cost, because it means you can switch a capability on, scope it tightly, or turn it off entirely without touching the physical estate.
Key takeaways
- Facial recognition is a targeted tool, not a dragnet. Its legitimate purpose is matching faces against a defined watchlist, not tracking everyone who walks past a camera.
- Accuracy is conditional. Performance depends on image quality, lighting, angle, and the quality of your reference images. Treat every match as a lead, not a verdict.
- Human review is non-negotiable. A responsible deployment uses the system to flag a possible match, then has a trained person confirm it before any action is taken.
- PDPA 2010 applies. Facial templates are personal data. Notice, purpose limitation, proportionality, and retention limits are obligations, not optional extras.
- Governance is what separates acceptable from unacceptable. The same software can be a proportionate safety measure or an overreach, depending entirely on the policy around it.
What facial recognition actually does
Watchlist matching. The core function of ADA Mugshot is to compare faces seen on camera against a curated list of reference images you have chosen to monitor. For lighter face-analytics tasks such as demographic profiling of visitor flow, ADA Magic handles real-time face detection without watchlist matching. When the system finds a likely match, it raises an alert. It is not building a profile of every visitor; it is looking for the specific people you have a defined reason to watch for.
Persons of interest. In practice, a watchlist might include individuals previously involved in theft, fraud, or abusive behaviour on your premises, or people subject to a legitimate access restriction. The system surfaces a possible sighting so your team can respond before an incident escalates rather than after.
VIP recognition. The same matching logic can be used to greet known and welcome guests. A hotel, private club, or showroom can be quietly alerted that a returning VIP has arrived, allowing staff to offer a personal welcome. This is a service application of the technology, and it still requires the same care around consent and data handling.
Access control. In tightly defined, opt-in settings, facial recognition can support entry to restricted areas, confirming that the person at a door is an enrolled, authorised individual. Here the subject has actively enrolled and consented, which makes it one of the more straightforward use cases to justify.
Where it genuinely helps
Repeat offenders. Retail and commercial sites contend with the same small group of individuals returning to offend. A watchlist lets staff be alerted to a known repeat offender on arrival, so they can observe, deter, or politely decline service before a loss occurs. This is a far cry from monitoring the general public.
Banned or barred individuals. Venues that have legitimately barred someone for safety reasons can be notified if that person attempts to return, supporting a duty of care to staff and other patrons.
Locating a vulnerable or missing person. In a campus, hospital, or large facility, a time-limited search for a specific missing individual, properly authorised, can be a humane and proportionate use of the technology.
Investigation support. After an incident, the ability to confirm whether a particular individual was present can sharpen an investigation and reduce the time spent reviewing footage manually. Combined with the broader analytics described in our pillar article on how AI is revolutionising CCTV in Malaysia, this turns a passive archive into something usable.
For commercial operators, these scenarios map onto everyday risk. Our commercial security overview and the wider industries we serve set out where facial recognition tends to fit alongside other analytics rather than standing alone.
The legitimate concerns
An honest assessment has to give equal weight to the risks. These concerns are real, and dismissing them is how organisations end up with deployments they cannot defend.
Accuracy and bias. No facial recognition system is perfect, and performance is not uniform. Poor lighting, an unusual angle, a low-resolution camera, or a poor-quality reference image all degrade results. There is also a well-documented risk that error rates can differ across demographic groups. You should never assume the technology performs equally for everyone, and you should test it against your own conditions rather than trusting headline claims.
False matches. Because the system deals in probabilities, it will sometimes flag the wrong person. The harm from acting on a false match, confronting an innocent visitor or denying them service, can be serious and lasting. This is precisely why a match should trigger human review, not automatic action.
Consent. People generally do not expect their faces to be analysed and matched against a database when they enter a shop or building. Where consent is impractical, the legal basis and the proportionality of the processing become all the more important.
Function creep. Perhaps the most insidious risk is gradual expansion. A system installed to catch a handful of repeat offenders quietly becomes a tool for tracking staff attendance, then for analysing customer behaviour, then for something no one originally agreed to. Without firm policy boundaries, scope tends to widen on its own.
PDPA 2010 and responsible deployment in Malaysia
A facial template is personal data, and biometric data of this kind is sensitive. The PDPA 2010 framework gives you a clear set of obligations to build around.
Notice. Inform people that facial recognition is in use, in clear and visible terms, along with the purpose. Hidden deployment is both ethically and legally fraught.
Purpose limitation. Define the specific, narrow purpose for which you are using the technology, and do not repurpose the data for anything else without a fresh basis.
Proportionality. The intrusion has to be justified by the problem. Using facial recognition to address serious, repeat security incidents is one thing; using it to monitor an ordinary low-risk space is much harder to justify.
Watchlist governance. Control who can add a person to the watchlist, require a documented reason for each entry, and review the list regularly to remove people who no longer belong on it. An unmanaged watchlist is a liability.
Human review of matches. Treat every match as a prompt for a trained person to verify, never as a trigger for automated action against an individual.
Retention. Keep biometric data and match logs only as long as you genuinely need them, and delete on a defined schedule. The less you retain, the smaller your exposure.
Access control over the system itself. Restrict who can operate the recognition function, log their activity, and audit it. The people running the tool need oversight too.
What good governance looks like
- Written policy first. Document the purpose, scope, legal basis, and limits before the system goes live.
- Opt-in by design. Favour applications where subjects enrol and consent, such as access control, and treat watchlist use as the exception that requires the strongest justification.
- Defined watchlist criteria. Set clear rules for who may be added, by whom, and for how long, with a documented reason for each entry.
- Mandatory human review. No action on a match without confirmation by a trained operator.
- Visible notice. Tell people the technology is in use and why.
- Retention and deletion schedule. Set it, automate it, and audit it.
- Regular review. Reassess whether the deployment is still proportionate and necessary, and be willing to scale it back.
- Audit trail. Log who accessed the system, what they searched, and what was matched.
Where this is heading
The trajectory in Malaysia is towards facial recognition becoming more capable and more commonplace, but also more scrutinised. Expect tighter expectations around transparency, clearer norms about acceptable use, and growing pressure to demonstrate proportionality rather than simply asserting it.
The organisations that will be comfortable with their deployments in a few years' time are the ones treating facial recognition as a precise, policy-governed instrument today, applied to specific problems with human judgement in the loop. The organisations that treat it as an always-on dragnet are the ones most likely to face regulatory, legal, and reputational difficulty. Our advice is consistent: deploy it narrowly, govern it firmly, and review it honestly.
Frequently asked questions
Is facial recognition legal for private businesses in Malaysia?
It can be, provided you comply with the PDPA 2010. That means giving notice, having a defined and lawful purpose, keeping the processing proportionate to a genuine problem, limiting retention, and securing the data. Legality depends far more on how you deploy and govern the technology than on the technology itself.
Does ADA Mugshot track everyone who walks past a camera?
No. ADA Mugshot is designed for watchlist matching against a defined set of reference images, not for profiling the general public. Its legitimate purpose is to flag a possible sighting of a specific person of interest or to recognise an enrolled, consenting individual, after which a trained operator confirms the result.
How accurate is facial recognition?
Accuracy is conditional rather than absolute. It depends on camera quality, lighting, angle, and the quality of your reference images, and error rates can vary across different groups of people. For that reason you should test it under your own conditions and treat every match as a lead for human review, not as proof.
What happens if the system flags the wrong person?
This is exactly why a responsible deployment never acts on a match automatically. The system raises a possible match, and a trained operator reviews it before any action is taken. Combined with a tightly governed watchlist and clear policy, this human-in-the-loop approach is the main safeguard against the harm of a false match.
Facial recognition deserves neither blind enthusiasm nor blanket rejection. Handled as an opt-in, policy-governed tool with human review, it can address real security problems while respecting the people it monitors. If you are weighing whether and how it fits your environment, speak with G Five AI Security and we will help you scope a deployment that is proportionate, defensible, and built on the CCTV you already own.
