GDPR CCTV signage and pictogram requirements

The mandatory first-level sign content

• Pictogram — the universal CCTV camera icon, large enough to be read at 5 m approach distance.
• Controller identity — "the legal name of the operator (company, household, public body). "Owner" alone is not enough."
• Contact — at minimum an email address; phone or postal address are best practice.
• Purpose — short statement of the security purpose (e.g. "property protection", "deterrence of theft").
• Lawful basis — typically "Article 6(1)(f) GDPR — legitimate interest"; in workplace contexts add the relevant labour-law reference.
• Retention period — in days, e.g. "footage retained for 30 days".
• Rights notice — a one-line statement that subjects can exercise GDPR rights, with the link or contact to do so.
• DPO contact — required for organisations that have appointed one; optional for residential and small-business operators.
• Reference to full privacy notice — URL or QR code pointing to the second-level notice.

Country-specific add-ons

Poland (RODO + UODO guidance). The pictogram must include the controller's full legal name and address, retention period in days, and a reference to the GDPR rights catalogue. UODO has fined operators for missing the controller's address and for retention statements that refer only to "the period necessary".

Germany (DSGVO + state DPA guidance). Each state DPA publishes its own template; the federal-level minimum is controller, contact, purpose, lawful basis, retention, rights, DPO. Bayern and Baden-Württemberg DPAs have been particularly aggressive about retention specificity — "30 days" is acceptable, "as long as necessary" is not.

Italy (Garante template). Garante publishes a binding pictogram + second-level template. Workplace CCTV signage must additionally reference the trade-union agreement or Labour Inspectorate authorisation under Article 4 of the workers' statute.

Spain (AEPD template). AEPD provides a downloadable pictogram and a model second-level notice. Both are practically mandatory; deviation needs the controller to demonstrate equivalent or better information delivery.

UK (ICO Employment Practices Code + Surveillance Camera Commissioner code of practice). ICO does not publish a binding sign template but its Employment Practices Code is treated as authoritative. The Surveillance Camera Commissioner code of practice adds operator-good-practice points (signage visible from approach, English language plus other relevant languages, regularly inspected for legibility).

Where to put the signs

At every entry point to the monitored area, before a visitor enters the camera FOV. For a single-entrance shop, one sign at the door. For a parking lot with three vehicle entries plus a pedestrian gate, four signs minimum. For a multi-storey office, signs on every floor at the lift and stair entrances.

The sign must be at natural eye level (1.5–2.0 m) and not obscured by foliage, shelving, parked vehicles or seasonal decorations. DPAs across the EU consistently fine for signs technically present but practically invisible.

For drive-through retail and parking, mount the first sign at the entry barrier where vehicles pause, second sign at the parking-bay row entry. A driver must have read the sign before being captured by the camera.

Maintenance — the silent failure mode

Outdoor signs degrade. UV bleaches the pictogram, rain washes ink, vandalism removes them. Inspect signs quarterly, photograph each one, log the inspection. A sign that was compliant at install but illegible at the time of complaint is treated as no sign at all — Garante, UODO and AEPD have all fined for "compliant at install, degraded at audit" cases.