Face recognition by market
Every market Ayonix sells into asks the same two questions in a different legal vocabulary: may we hold this biometric data, and where must it physically sit. These six pages answer both for the United Kingdom, the United States, Japan, Russia, China and the United Arab Emirates, citing the instrument each requirement comes from.
Which market are you deploying in?
- United KingdomUK GDPR Article 9, a mandatory DPIA, and the ICO. No localisation requirement, but a Chapter V mechanism for any transfer.
- United StatesNo federal statute. Illinois BIPA sets the practical standard because it gives individuals a private right of action.
- JapanA face template is a personal identification code under the APPI, so it is personal information with or without a name beside it.
- RussiaArticle 18(5) of 152-FZ requires the authoritative database to be located in Russia. Biometric data needs written consent under Article 11.
- ChinaPIPL treats biometric data as sensitive personal information needing separate consent, and Article 26 limits public-place identification to public security.
- United Arab EmiratesWhich law applies depends on the site: the federal PDPL, the DIFC regime or ADGM, each with its own supervisor.
What is the same in every market?
The architecture question. Every regime above turns, sooner or later, on where the biometric templates physically are and who can reach them. Russia states it as a localisation rule, China as a condition on cross-border transfer, the United States as a retention and destruction duty the operator must be able to discharge, and the United Kingdom and the UAE as a transfer mechanism that has to be chosen and documented.
A deployment that keeps templates on the operator's own hardware answers all five versions of the question the same way, because there is nothing to transfer, nothing held by a vendor, and nothing outside the operator's own retention schedule. Ayonix supplies software and the ATLAS BOX appliance rather than operating a service that holds customer biometric data, which is what makes that available.
- Air-gapped: no network route out of the deployment at all.
- On-premise: the operator's own data centre, under the operator's own retention schedule.
- Edge: processing at or beside the camera, with only the result leaving the device.
- Cloud: available where it is wanted, and the option that makes transfer rules a live question.
What Ayonix does not claim in any market
- No headline accuracy figure. A number measured on someone else's cameras is not one a data controller can defend to a regulator.
- No certification of compliance. No certification makes a product compliant with any of these laws; compliance is a property of a deployment.
- No NIST certification, approval or endorsement. NIST evaluates and publishes measurements and does not endorse vendors; Ayonix technology has been evaluated, which is a checkable statement.
- No customer, office or deployment in a country where this site does not already record one.
This page describes what the named laws require, with each instrument cited so it can be checked. It is not legal advice, and it is not a statement that any particular deployment complies: that assessment belongs to your own counsel and your data protection authority.
Frequently asked questions
- Which countries does Ayonix sell into?
- Ayonix is headquartered in Tokyo and publishes a United States office contact. These market pages cover the United Kingdom, the United States, Japan, Russia, China and the United Arab Emirates — the regimes most often asked about — and describe what each requires rather than claiming a deployment in each.
- Which market has the strictest requirement on where data is held?
- Russia states it most directly: Article 18(5) of Federal Law 152-FZ requires the authoritative database of Russian citizens' personal data to be located in the Russian Federation. China imposes localisation on critical information infrastructure operators and handlers above set thresholds.
- Does Ayonix hold customers' biometric data?
- No. Ayonix supplies software and the ATLAS BOX appliance. The template database belongs to the operator and sits on the operator's hardware, which is why the same architecture satisfies the localisation, transfer and retention rules across all six markets.
- Is this page legal advice?
- No. It describes what the named laws require, citing each instrument so a reader can check it, and it is not a statement that any particular deployment complies. That assessment belongs to your own counsel and your data protection authority.
- Are there Russian or Chinese versions of this site?
- Not yet. The Russia and China pages are English and Japanese documents about Russian and Chinese law, which is a different thing from a Russian or Chinese page. The site declares hreflang only for the languages it actually publishes, so it never points a reader at a translation that does not exist.