A camera over the entrance, a view of the warehouse, monitoring of the checkout — for many companies, video surveillance is a natural building block of their security. But as soon as a camera captures people, you are processing personal data, and that means the General Data Protection Regulation (GDPR) applies. Anyone who installs cameras carelessly risks fines, warnings and disputes with employees or customers. The good news: GDPR-compliant video surveillance is perfectly achievable with clear rules — you just have to know them and document everything properly.
This practical guide summarises what small and medium-sized businesses should keep in mind: when video surveillance is permitted at all, what the GDPR specifically requires, which special rules apply in the workplace and what obligations exist regarding warning signs, storage period and access. At the end, we also take a look at the technical implementation — because data protection does not stop at the sign on the door, but extends all the way into the configuration of your security camera.
When is video surveillance permitted? (legitimate interest)
Every processing of personal data requires a legal basis. For video surveillance in the non-public area of a company, you generally rely on what is known as legitimate interest under Article 6(1)(f) GDPR. This means: you may film if you are pursuing a concrete, comprehensible interest and this outweighs the legitimate interests of the people being filmed.
Typical permissible purposes include, for example:
- Protection against burglary, theft and vandalism
- Securing goods, machinery and business assets
- Upholding the right of domicile and protecting employees and customers
- Investigating specific criminal offences or recurring incidents
What matters is proportionality. Before any installation, you should carry out and document a balancing of interests: Is there a milder means that would be just as effective — such as better lighting, a fence or an alarm system? Is only the necessary area actually being captured? Areas where people expect a high degree of privacy — toilets, changing rooms, break and staff rooms — are fundamentally off-limits. Public footpaths or neighbouring properties may not be filmed either; here, precise camera alignment or the digital masking of individual image areas can help.
What does the GDPR specifically say?
The GDPR sets out several principles that apply to all video surveillance. They are not an end in themselves, but form the common thread for a legally sound solution:
- Purpose limitation: The recordings may only be used for the defined purpose — anyone filming to prevent theft may not use it to monitor work performance.
- Data minimisation: Only what is necessary is captured — both spatially (image section) and temporally (recording times).
- Transparency: Before entering the monitored area, data subjects must be able to recognise that, and by whom, they are being filmed.
- Storage limitation: Recordings are only kept for as long as the purpose strictly requires.
- Integrity and confidentiality: The data must be protected against unauthorised access through technical and organisational measures.
In addition, there are the rights of the data subjects: they can request information on whether and which recordings of them exist, and under certain circumstances demand their deletion. In the case of extensive or systematic surveillance — for example of heavily frequented areas — a data protection impact assessment under Article 35 GDPR may also be required. You should also record your processing activity in the record of processing activities.
Note: This article provides general guidance and does not replace legal advice. Whether your specific surveillance situation is permissible depends on the individual case — when in doubt, have the balancing of interests reviewed by a data protection officer or specialist lawyer.
Surveillance in the workplace — special rules
As soon as the camera captures your own staff, stricter standards apply. Comprehensive, gap-free surveillance of employees in the workplace is impermissible according to established case law, because it creates constant surveillance pressure and severely infringes the right to privacy. Pure performance or behaviour monitoring by camera is therefore clearly prohibited.
If an area is monitored in which employees also work — such as a warehouse, a sales area or a goods receipt — the security purpose must clearly take precedence and the measure must be tightly limited in terms of time and space. Important: if a works council exists, it has a right of co-determination regarding the introduction and use of technical monitoring equipment. You should therefore never install a camera system on your own, but coordinate it early with the committee and regulate it in a works agreement.
Covert video surveillance of employees is only conceivable in narrowly defined exceptional cases — for example, in the event of a concrete, documented suspicion of a serious criminal offence, when no milder means are available any longer. This is legally sensitive terrain that quickly turns into a costly wrong decision without expert guidance.
Obligations: warning signs, storage period, access
Three obligations come up most frequently in practice — and this is precisely where most mistakes happen.
Warning signs: Before entering the monitored area, data subjects must clearly recognise that filming is taking place. A pictogram alone is not enough. The sign should contain the most important first-tier information: that video surveillance is taking place, who the controller is (name and contact details), the purpose of the surveillance, the legal basis, as well as a reference to where the detailed data protection information can be viewed. You should keep the complete information under Article 13 GDPR available at an easily accessible location.
Storage period: Recordings should only be stored for as short a time as possible. A storage period of a maximum of 72 hours has established itself as a practical guideline; in many cases, even 48 hours is sufficient. After that, the data is automatically overwritten. Longer retention is only permissible if there is a concrete reason — such as a documented incident whose investigation is still ongoing. Define the storage period in writing and ensure automatic deletion technically.
Access: Only a clearly designated, ideally small group of people may access the footage. Every access should be logged, the access protected by secure passwords and roles, and disclosure to third parties — such as the police — should only take place within the legally permissible framework. Regulate these points in an internal policy so that, in an emergency, it is clear who is allowed to do what.
Technical Implementation & Data Security
The best legal preparation is of little use if the technology becomes the weak point. Unprotected cameras are among the most popular entry points for attackers — a security camera with a default password and open internet access is a gift for any intruder. GDPR-compliant video surveillance therefore always means: factor in technical data security from the very start.
In practice, when setting things up we pay attention to the following, among other things:
- Encrypted transmission and storage of the recordings
- Individual, strong passwords instead of factory settings
- A camera network separated from the office network (segmentation)
- Regular Firmware updates against known security vulnerabilities
- No unprotected remote access from the open internet
- Automatic deletion routines in line with the defined storage period
A professionally planned video surveillance and security camera solution combines both worlds: legally sound design and technically properly secured operation. This is exactly where we come in — from selecting the right cameras and the data-minimising alignment to encrypted, automatically deleted storage. How closely camera security is connected to the rest of your IT is also shown in our articles on cyberattacks on SMBs and on the firewall for small businesses.
Conclusion
GDPR-compliant video surveillance is no magic, but it does require care. Anyone who properly justifies a legitimate interest, maintains proportionality, informs transparently, observes the stricter rules in the workplace and consistently regulates warning signs, storage period and access rights creates a system that provides security while standing on firm legal ground at the same time. Equally important is technical protection: only a camera that does not itself become a risk truly protects your company.
Would you like to plan a camera solution in Wolfsburg or the Lower Saxony region, or have an existing system checked for GDPR compliance? Then get in touch with us — we combine legally sound design with solid technology and accompany you personally from the first idea to ongoing operation.