CCTV and privacy: what does the GDPR say?

Camera surveillance is an effective security tool, but it collects personal data. That brings it under the GDPR. Ignoring this risks fines and reputational damage. Fortunately, correct surveillance is entirely manageable.

The basic principles

• A legitimate interest and a clear, predefined purpose.
• Visible signage so people know they're being filmed.
• A limited, documented retention period.
• No cameras pointed at places with a high expectation of privacy.

Don't film more than needed

The principle of data minimisation applies here too: only film what's necessary for your purpose. A camera at the till needs a different range than one over a car park.

Manage with care

Footage is sensitive. Decide who has access, record when footage is reviewed, and ensure it's stored securely and deleted in good time.

Unsure whether your surveillance is compliant? Request advice with no obligation.