Auror and Local Business Crime Partnerships
Risks, data protection issues and a roadmap to a sector code
Summary
Auror risks drawing large retailers' crime intelligence away from local partnerships. Partnership managers say this is already happening: one chain now tells its stores to report only through Auror, and police recorded thefts are falling where theft is not. Some stores are also reported to be copying partnership DISC records into Auror without consent. Both problems can be fixed if business crime reduction partnerships (BCRPs) act together and treat Auror and the chains as partners, not rivals.
Auror links a chain's own stores nationally and reports to police from head office. BCRPs link different businesses in one town through platforms such as DISC and SentrySIS. The prolific local offender who steals from several chains falls into the gap between the two.
This report sets out a ten-point plan BCRPs can adopt now. Each point is written so it can later become a clause in a formal retail loss prevention sector code of conduct approved by the Information Commissioner's Office (ICO). It ends with a roadmap for engaging retailers, Auror, partnership platform providers, police, the ICO and licensing authorities.
Two models, converging
Both models began as local answers to shop theft and Auror is now moving onto DISC's established ground. BCRPs grew out of town radio schemes. Auror began with small shops in one Auckland suburb before scaling to international chains and police forces.
| Year | Auror, the ORCAs and national chains | DISC and UK BCRPs |
|---|---|---|
| 1988 | Stoke launches the UK's first BCRP, with the first retail radio link (source) | |
| 1999 | Littoralis Limited, later DISC's developer, is incorporated (source) | |
| 2010 | Littoralis launches BCRP Intranet, an online system for partnerships first developed in 2008 (source) | |
| 2012 | Auror founded in New Zealand, initially targeting small retailers in Newmarket, Auckland (source) | |
| 2014 | Partnership with New Zealand Police, later rolled out force-wide (source) | System rewritten and relaunched as DISC (Database and Intranet for Safer Communities) (source) |
| 2016 | DISC smartphone app launched for iOS and Android (source); DISC then covered more than 250 towns and over 25,000 businesses (source) | |
| 2018–19 | National Business Crime Centre publishes the BCRP National Standards, updated October 2019 (source) | |
| 2020–21 | US Organised Retail Crime Association (ORCA) leaders jointly ask for better data-sharing (2020); Auror responds with a free platform: four state associations signed by December 2020, 15 by the end of 2021 (source) | |
| 2022 | UK launch at Retail Risk London, May 2022 (source) | |
| 2023 | Pegasus: 13 large retailers fund a retail crime team inside Opal, the national police intelligence unit (source) | DISC in use in over 550 towns and city centres (source) |
| 2024 | Devon and Cornwall becomes the first force in the country to take crime reports directly from Auror (source) | |
| 2026 | Rollout across London (May); live facial recognition launched in UK stores (July) (source) | ICO guidance names local BCRPs as the easiest route for sharing between businesses (July) (source) |
The convergence shows in what each now offers. DISC connects retailers at a hyper-local level, and partnerships across areas through cross-DISC offender searches, whilst SentrySIS runs county-wide schemes and the national Retailers Against Crime network. Auror lets chains opt in to sharing with other retailers (although this does not seem to be widely recognised), and sells a shopping-centre product where a non-retailer coordinates tenants, guards and police: in effect, a BCRP's role.
In the US, the ORCAs, the state associations of retailers and police that most resemble BCRPs, jointly asked for better data-sharing in 2020. Auror answered with a free platform and now partners with all 28. We found no equivalent offer to UK BCRPs. Cross-chain intelligence here flows nationally through Pegasus and Opal instead, leaving local partnerships largely outside both networks.
That gap is not technical. The ORCA version of Auror in America runs as an open newsfeed: members see incidents across the network and filter by county, state or nation, while each ORCA vets who can post and view (source). No UK partnership body has yet made the collective request the ORCAs made, although Hastings BCRP has reached out with a request for an ORCA-style demo, but no response has been received.
How Auror threatens local crime reduction
The risk is not the software but where it sends the chains' intelligence and reports: up to head office and national policing, away from the town.
| Local BCRP platforms (DISC, SentrySIS) | Auror | |
|---|---|---|
| What it links | Different businesses in one area | One chain's stores nationally; other chains only by opt-in (source) |
| Main users | Independents, local branches of chains, pubs, BIDs | Large retailers and police forces (source) |
| Data controller | The BCRP (source) | Each retailer, with Auror acting as its agent |
| Route to police | Local, under the BCRP's information sharing agreement | Formal reports emailed to a force inbox with evidence attached; officers can also log in to view retailer intelligence |
| Cost to a small business | Often PCC or council funded; DISC alone is £242 + VAT a year in Eastbourne (source) | Subscription (eenterprise level); no UK small-business tier advertised (source) |
The wrong axis for local offending. Auror's own figures say the top 10% of offenders cause almost 70% of UK retail crime (source). In a town, many of them steal from several chains. Retailers cannot see each other's Auror data by default, so the cross-chain local picture still depends on BCRPs.
Reports filtered at head office. A formal crime report is an extra step the retailer chooses. It reaches a force inbox as an email with images, statements and CCTV attached, and its thresholds aim at court-standard evidence at first contact. Devon and Cornwall reports an 8.9% higher charge rate, but on a filtered set, and rates the practice "untested" (source). Incidents not formally reported stay as intelligence. Officers see them only where their force has Auror's intelligence view, and they never become recorded crimes.
Local participation drains away. Branch staff told to record in Auror may stop posting to the partnership platform, using the radio and serving exclusion notices. BCRP funding from members, BIDs and PCCs depends on visible participation.
Police attention moves up a level. Pegasus funds national analysis of travelling gangs. Local neighbourhood teams still need BCRP intelligence, including exclusion breaches used as evidence for criminal behaviour orders (source).
One claim still needs testing with retailers: that stores are withholding reports until a case is trial-ready. No published instruction was found, and neither the thresholds nor who presses send (shop floor or a central loss-prevention team) are public.
The licensing argument is strong in terms of what the impact may be on retailers selling products such as alcohol and knives. The licensing objectives bind the authority, not the licence holder, so exposure comes through a condition requiring scheme membership, as some licences have (example), or through a licence review. One council business crime officer maps internal-only reporting against all four objectives, including youths stealing alcohol under the protection of children from harm. That officer is prepared to gather evidence and seek reviews of affected stores.
The same officer would consider community protection warnings and notices where knife thefts go unreported. A notice can be issued to a business, but only after a written warning and where its conduct is unreasonable and persistently harms local quality of life (source). Home Office summits pressed retailers on knife display and sales in October 2026 (source).
Why Auror sells in the boardroom, and what the high street loses
Auror gives a chain's board a national pipeline for intelligence and evidence. What the high street can lose is the shared, real-time picture of its own town.
Auror's genuine additions over partnership platforms are hardware links (CCTV, body-worn cameras, number-plate and facial recognition, trolley locks), AI-suggested linking, head-office analytics and debt recovery (source). Offender galleries, alerts and direct police reporting are already offered by DISC and SentrySIS. Points marked "likely" below are this report's assumptions, not published evidence.
| Selling point | What the board sees | What the high street loses |
|---|---|---|
| One national system | Consistent data across every store, controlled by the chain | Branch staff record after the event and someone else decides whether to report; feedback to the store is likely thin |
| Focus on prolific offenders | The top 10% of offenders cause almost 70% of UK retail crime (source) | The same offenders steal from independents; the chain sees only its own incidents unless it opts in, so the town picture still depends on the partnership |
| Police results | 8.9% higher charge rate in Devon and Cornwall; 29.4% positive outcomes in the Met (source) | Both figures come from reports that cleared a quality bar; an independent reporting online waits far longer to be recorded, 53 hours against 6 in Devon and Cornwall |
| Facial and number-plate recognition | Known offenders flagged before they enter (source) | Each watchlist belongs to one retailer, so an offender flagged at the chain is not flagged next door and is likely to move there; most high-street branches have no private car park |
| Insights and return on investment | Loss tied to margins; a US grocer cites a 346% return (source) | Dashboards serve head office; branches and neighbours likely see little |
| Data control | The chain controls its data; Auror only processes it | The chain stops feeding the shared gallery and exclusion scheme, thinning the picture for everyone |
| Debt and civil recovery | Lost value recovered by automated texts, letters and a payment page (source) | No evidence yet of UK use; it would need careful handling here |
| Cost | One enterprise contract | No affordable UK route for independents; Hertfordshire's PCC funds a different system, ShopSafe, for them (source) |
The staff benefits can be real. Home Bargains credits Auror and facial recognition with a 60% year-on-year fall in violent and aggressive incidents against colleagues (source). The case for BCRPs is not that Auror fails, but that it serves the chain's network rather than the town's.
What partnership managers are seeing
Partnership managers and police in one county say the shift is already under way.
Searching the partnership, not feeding it. One national convenience chain has told every store in a region to report incidents only through Auror. Staff may still use the partnership DISC platform to identify offenders, but may not submit reports or intelligence to it. Managers say their joint operations with police depend on that local reporting.
"It goes to the police." It does not. Store staff, and in one case an area security manager, believed anything logged on Auror is sent to police and recorded as a crime. In that force it is not: police can view entries and pull evidence, but nothing is crimed. Managers are correcting this store by store, and ask whether Auror should explain to users what happens to an entry.
Theft vanishes from the figures. At one department store branch, known and excluded offenders steal daily, yet police call records show a sharp fall: calls about street drinkers outside, no thefts. A scheme manager warned this returns reporting to how it was about eight years ago, when head offices were expected to report and did not. It would "drive business crime to an area where it can't be measured", and a false downward trend could cut funding and resources.
Intelligence that misses the local force. Where a chain does identify a prolific offender, managers say it is often not passed to police, or goes to a force elsewhere. Local officers then cannot act when the offender is in front of them.
Organised groups are not the town's main problem. Managers ask why chains are building their own organised-crime picture when police and national units already do this across retailers. One city partnership estimates organised groups cause under 10% of its problems; they matter more at retail parks and in towns near motorways. As one manager put it: "A town centre made safer by dealing with persistent offenders delivers more value to local businesses than a retailer identifying an OCG that exists only within its own corporate reporting structure."
Little leverage from above. A PCC's office says it has little influence over national retailers' commercial decisions. Police say they cannot tell a business how to report, except where licensing law applies. The office's advice is to keep encouraging local reporting through the partnership platform, since chains that leave it lose the local picture too.
Why DISC data in Auror is a problem
Copying DISC records into Auror moves them out of the BCRP's control, beyond the purposes members agreed to, and possibly into criminal territory.
A new controller without consent. The BCRP is the registered controller of DISC data, usually with a police information sharing agreement. In Auror, each retailer controls what it enters and Auror acts as its agent (source). A copied record becomes the chain's data, taken without the BCRP's consent.
Wider disclosure than members agreed. Retailers using Auror elect to make event information available to police. A local exclusion record can then be seen across the chain's national network and by police forces using the platform.
Retention and accuracy break. Retailers set their own retention periods in Auror. A DISC exclusion that expires, is appealed or is corrected stays live in the copy. Records of children and of non-criminal anti-social behaviour carry restrictions the copy will not follow.
A possible offence. Section 170 of the Data Protection Act 2018 makes it an offence to knowingly or recklessly obtain or disclose personal data without the controller's consent, or to keep it afterwards (source). Defences exist, including a reasonable belief the controller would have consented. This is leverage, not a certain prosecution.
Against the regulator's model. The ICO's 2026 guidance says sharing with other businesses is easiest through a BCRP, under a data sharing agreement with defined purposes and clear roles (source). Each recipient also needs its own impact assessment and appropriate policy document for criminal offence data.
Enforcement history points the same way. The ICO found Facewatch's shared watchlist failed to balance subscribers' interests against people's rights, then closed the case once it changed (source). It prosecuted the owner of an unregistered blacklist used by over 40 construction firms (source).
The risk is live. One chain now tells staff to identify offenders on the partnership platform but record incidents only in Auror. If staff then name that offender in Auror, partnership data has passed into a system outside the partnership's agreement.
The same applies to records held on SentrySIS or any other partnership platform. The legal exposure sits with store staff and their employer. The reputational damage, if a wrongly identified person complains, lands on the BCRP as the source of the record.
Ten-point plan
BCRPs can adopt these ten points now. Each one trials a rule that a sector code of conduct under Article 40 of the UK GDPR would later make binding on signatories.
| # | What BCRPs do now | Future code clause |
|---|---|---|
| 1 | Restate the rules. Tell all members in writing that partnership records, on DISC or any other platform, may not be copied elsewhere without the BCRP's written consent. Brief store staff that an Auror entry is not a crime report unless formally sent to police. | Onward sharing |
| 2 | Amnesty and audit. Ask Auror-using members whether DISC data has gone into Auror; delete it or cover it with an agreement, without penalty. | Breach handling |
| 3 | One standard agreement. Publish a BCRP–retailer data sharing agreement built on the checklist in the ICO's statutory Data Sharing Code. | Model agreement |
| 4 | A local core dataset. Agree the minimum that may flow either way: prolific local offenders, live exclusion notices, vehicles of interest. | Data minimisation |
| 5 | Shared retention. Each shared record carries its partnership expiry; expiries, appeals and corrections pass to the copy; no children's records without case-by-case approval. | Retention, accuracy, children |
| 6 | Local police visibility. Ask each force three things: does it have Auror's intelligence view, does it take direct reports and into which inbox, and what thresholds apply. Ask how many Auror reports reached the force and with what outcomes. Agree that neighbourhood teams see events in BCRP areas. | Police sharing |
| 7 | A reporting floor. Chains agree that every theft in a BCRP area is formally reported, so it is recorded as a crime even without a trial-ready file, and is shared locally too. Since the Crime and Policing Act 2026 removed the £200 summary-only rule, every shop theft can be tried in either court. | Reporting standards |
| 8 | Joint offender management. BCRP-led cross-chain lists of prolific offenders feed criminal behaviour order applications and referrals to Opal, which takes referrals from retailers of any size (source). | Offender management |
| 9 | A licensing link. Ask licensing authorities to recognise active BCRP participation in licensing policy and, where justified, in premises licence conditions. Where alcohol thefts go unreported, ask them to consider reviews. | Licensed premises |
| 10 | Accreditation, then a code. Build points 1–9 into BCRP National Standards accreditation; the National Association of Business Crime Partnerships (NABCP) drafts the Article 40 code. | Governance and monitoring |
An approved code binds signatories and needs an independent monitoring body. The ICO approved its first one, for private investigators, only in November 2024 (source), so each point should be worth adopting on its own merits.
Engagement roadmap
Every party gains something concrete. Chains get the cross-chain local picture Auror does not give them, Auror gets a lawful local data route, police get better local intelligence, and BCRPs keep their role.
Devon and Cornwall already shows the two can coexist. The force pioneered direct reporting from Auror for large retailers (source), and its county-wide partnership runs on SentrySIS with its own direct-to-police reporting (source). SentrySIS also offers an interface for exchanging incident data with other systems (source).
Engagement has started. Police and the PCC's office in one county have met Auror, and police suggest partnership managers approach Auror together through the NABCP. At least one chain moving to Auror still supports partnership membership and platform access, and its central hub may become a channel for local intelligence.
Nationally, police say the Digital Public Contact programme, run by the National Police Chiefs' Council (source), is developing a route for platforms such as Auror and SentrySIS to report directly to police with evidence. Police also say Auror offers every force free access to its platform, while only a few take direct reports.
The proposed roadmap runs in four phases over about two years. Contain (months 0–3) covers points 1, 2 and 6. Agree (months 3–6) covers points 3 to 5. Pilot (months 6–12) tests points 7 to 9 in one Sussex partnership. Codify (months 12–24) delivers point 10.
Gates between phases: no new DISC data enters Auror; one chain signs the standard agreement; the pilot is evaluated; the ICO approves the code.
| Party | What we ask | What they gain |
|---|---|---|
| National retailers, through the British Retail Consortium | Sign the standard agreement; keep the local reporting floor; keep contributing to partnership platforms, not only searching them; stop copying partnership data | Lawful access to the cross-chain local picture; less legal exposure for staff |
| Auror UK | A governed route for BCRP data, either a BCRP account under the BCRP's control or a link with partnership platforms through Auror's open API | A UK partner network like the US ORCAs; a stronger compliance story |
| Littoralis (DISC), SentrySIS and other platform providers | Export controls, audit logs and an interface for governed sharing | Partnership platforms stay the local hub, integrated rather than displaced |
| Police forces and the National Business Crime Centre | Extend Auror access to neighbourhood teams; publish how many Auror reports reach the force and their outcomes; use BCRP intelligence in local tasking | Earlier, better-quality local intelligence |
| National Police Chiefs' Council, Digital Public Contact programme | Open the planned platform reporting route to partnership platforms such as DISC, not only Auror and SentrySIS | One standard route for evidence from every platform |
| Sussex Police and Crime Commissioner, national lead for business and retail crime (source) | Back the pilot; press the case for local reporting nationally | A local delivery arm for the national Pegasus work she convened |
| ICO | A step-by-step retail crime guide like its child safeguarding guide; early comment on the draft code | Fewer complaints; a governed sector |
| Licensing authorities | Recognise BCRP participation in licensing policy; consider reviews where alcohol thefts go unreported | Evidence for reviews and conditions |
| NABCP | Own the code and arrange a monitoring body | A national role for its members |
Sources
College of Policing – Auror direct reporting, Devon and Cornwall
ICO – Using personal information to protect your business from crime (2026)
ICO – 10 step guide to sharing information to safeguard children
Partnership and police correspondence, October 2026 (private; anonymised)
GOV.UK – Retailers challenged to strengthen action on marketing of knives (2026)
Anti-social Behaviour, Crime and Policing Act 2014, section 43
