Data protection

GDPR and CCTV: what the rules ask of a camera system

The GDPR applies to cameras that record people who can be identified. The European Data Protection Board's video guidelines explain what that means for a CCTV system, and the UK applies the same principles through the UK GDPR and the Data Protection Act 2018.

Six things the GDPR asks of a CCTV system

A lawful basis

For a business this is usually legitimate interest (Article 6(1)(f)). Protecting property against burglary, theft or vandalism can be one, given a real and hazardous situation (EDPB, para. 19), weighed against the privacy of the people filmed.

Only the area you need

Data minimisation (Article 5(1)(c)) means cameras cover what the purpose needs, not the street or the neighbour's garden. Planning each field of view before installation is the cheapest way to get this right.

A warning sign

Before people enter the monitored area, at about eye level: the purpose, who runs the system, the rights of the people filmed, the DPO's contact if there is one, and where to find the full notice (paras. 113-114). The full notice must be easy to reach, for example by QR code or web address (para. 117).

A short retention period

Keep footage only as long as necessary. In most cases it should be erased, ideally automatically, after a few days, and the longer the period, especially beyond 72 hours, the more it has to be justified (para. 121). Some countries set their own limits.

A DPIA where required

A data protection impact assessment is required for systematic monitoring of a publicly accessible area on a large scale (Article 35(3)(c)). The EDPB expects many video systems to need one and points to each supervisory authority's list (paras. 136-137).

Answers to access requests

People filmed can ask for their footage (Article 15). Other identifiable people in it may need to be masked or blurred before it is handed over (paras. 92-94).

Cameras at home

Cameras inside your own home can fall under the household exemption, which the EDPB says must be read narrowly. Whether it applies depends on the relationship with the people filmed, the scale of the surveillance and its impact on them (paras. 12-13).

A camera that records constantly and covers even part of a public space, such as the street or the pavement, is not purely domestic and falls under the GDPR. The Court of Justice decided this in the Ryneš case (C-212/13).

Designing a GDPR-friendly CCTV layout

The EDPB asks that people can estimate which area a camera captures (para. 113). The layout decides that before a single camera is bought.

See every camera's coverage on the real site map, and turn or move the ones that reach the street or a neighbour's property.
Walls and buildings clip each view, and the 3D view shows exactly what each camera sees, which helps describe the monitored area on the sign and in the DPIA.
The PDF report records camera positions and fields of view for the DPIA file.
Set retention to the shortest period that serves the purpose and size the recorder for it with the storage calculator. The design check flags retention that is out of line with regional guidance, for example in Italy and the UK.

GDPR and CCTV questions

Does GDPR apply to CCTV?

Yes, whenever cameras record people who can be identified. Cameras inside a private home can fall under the household exemption; a business's cameras, and any camera that records part of a public space, are covered.

Is a CCTV sign required under GDPR?

Yes. People must be told before they enter the monitored area. The EDPB describes a warning sign at about eye level that gives the purpose, who runs the system, the rights of the people filmed and where to find the full notice.

How long can CCTV footage be kept under GDPR?

There is no single EU-wide number: keep it only as long as necessary. The EDPB says damage is usually noticed within a day or two, that footage should in most cases be erased after a few days, and that periods beyond 72 hours need more justification. National rules can set specific limits.

Do I need a DPIA for CCTV?

Yes if the system systematically monitors a publicly accessible area on a large scale (Article 35(3)(c)). Many other systems need one too, so check your supervisory authority's list.

Can someone ask for a copy of CCTV footage?

Yes, under the right of access (Article 15). Where handing over the footage would affect other people in it, mask or blur them first.

What about CCTV and the Data Protection Act in the UK?

The UK applies the same principles through the UK GDPR and the Data Protection Act 2018, and the ICO publishes guidance on video surveillance, including CCTV.

Sources

This page explains the rules in general terms; it is not legal advice for a specific site.