Sector wise readiness
Energy and smart metering: the privacy risk is the sampling rate
- Is a smart meter reading personal data?
- At the old monthly resolution it was close to a number on a bill. At smart meter resolution it shows when a household wakes, sleeps, cooks, travels and goes on holiday, and can suggest how many people live there. The privacy risk is created by the sampling rate.
- Who this affects
- Utilities, metering operators and energy retailers.
- What to do about it
- Collect and keep the minimum resolution the function actually needs.
A misconception I keep seeing when utilities and metering operators read DPDP checklists: "it is a meter reading, it is a number on a bill."
At the old monthly resolution, that was fair. At smart meter resolution, it is not. High frequency consumption data shows when a household wakes, sleeps, cooks, travels and goes on holiday. It can suggest how many people live there and whether the house is empty right now.
The auditor's red flag for this sector says it plainly: high resolution consumption data is privacy revealing, so collect and keep the minimum. The privacy risk here is not created by a database. It is created by the sampling rate.
A sector map is a superset, not a launch checklist.
What applies from the start, whatever your size
- ✅ Notice
- ✅ Consent or a lawful basis for every purpose
- ✅ Security safeguards
- ✅ Rights handling
- ✅ Grievance mechanism
- ✅ Processor contracts
- ✅ Breach response
What this sector carries from day one
- ✅ A clear basis and real minimisation for consumption data. Ask what resolution billing actually requires. If fifteen minute intervals are not needed to raise an invoice, collecting them needs its own justification.
- ✅ Meter to grid security. Secure the meter to grid link and the billing data behind it. This is infrastructure and household data at once.
- ✅ Retention discipline. Erase when the billing purpose is served. A decade of household consumption history serves no billing purpose.
What may not apply yet
- ❌ SDF obligations. Large utilities and metering operators are plausible candidates to assess, but Significant Data Fiduciary status comes only on Government notification, not from connection count.
- ❌ A mandatory Data Protection Officer, annual DPIAs and independent audits. These attach to SDF status once notified.
The better question
The better question is not "is meter data personal?"
It is "at the resolution we collect, what could someone infer about a household, and do we need that resolution at all?"
Law creates obligations. Scale and risk influence implementation. But minimisation is a design choice made at the meter. It applies from your first connection.
If you run a utility, does your billing genuinely need the resolution you collect?