Conditions for CCTV monitoring in your business

Do you want to use security cameras in your business? For example, to protect your staff, customers, or property? With CCTV or security cameras you violate your employees’ and customers’ privacy. You may only install cameras if you meet the requirements set out in the General Data Protection Regulation (GDPR).

Conditions for CCTV monitoring

Before you start with CCTV monitoring, you must meet the requirements:

• You must have a legal basis to use a camera. Often this is a legitimate interest. For example, to prevent theft, or to protect your employees or customers.
• You must be able to demonstrate it is necessary to use video surveillance. You must make sure you cannot achieve your purpose in a way that has less impact on the privacy of your employees or customers.
• Is there a high privacy risk to the people you are filming? Then you must perform a data protection impact assessment (DPIA). A DPIA is always mandatory if you use camera surveillance on a large scale, or over a longer period of time, or permanently.
• You take your employees’ and customers’ privacy rights into account. You must clearly indicate that CCTV cameras are in use and for what purpose, for example with prominently placed signs or stickers. You must include the purposes in your privacy policy.
• You cannot keep the camera images any longer than necessary. Did you record an incident? Then you can keep the recording until the incident is solved.

Use of cameras in the workspace

Do you want to install security cameras in your business and will your employees be seen on them? For example, because you are filming the cash registers in your shop? Then you must comply with the rules for CCTV monitoring. You must ensure that the impact on your employees' privacy is as small as possible. For example, you may not install cameras in your staff's toilets or changing rooms.

You may not use the camera images to spy on your employees or to assess employee performance.

If your company has a works council or staff representation, you must discuss your plans to use cameras with them first. The works council or staff representation must agree to camera surveillance. It must be clear to your employees that cameras are in place, for example by putting up warning signs.

Filming customers in your company

Do you want to install security cameras in your business and will your customers or visitors be seen on them? For example, in your shop, restaurant, or sports club? Then you must comply with the rules for CCTV monitoring. You must ensure that you protect the privacy of your customers as much as possible. For example, you may not put cameras in toilets, changing rooms, or fitting rooms.

Securing your business premisses wit a camera

You can use a camera or doorbell camera to secure your business premises. You are only allowed to film your own premises and grounds. You may not film public roads, public car parks, or your neighbours’ properties. You must inform people who enter your property that you use security cameras and they may be filmed.

Do you have to film a section of public road, because there is no other option, for example because the front door of your building is directly adjacent to the public road? Then you must ensure you infringe the privacy of passers-by as little as possible, for example by blurring their faces.

You are allowed to film a part of your neighbour’s property or public space if you have a valid reason for it, such as many burglaries in your neighbourhood.

Facial recognition

Do you want to use cameras with facial recognition? This is almost always prohibited. However, there are some legal exceptions, for example, when the person who is filmed has explicitly given their consent, or when facial recognition is truly necessary for security purposes.

Use of a hidden camera

You may only use of a hidden camera temporarily and under strict conditions. For example, when there is a clear suspicion of theft or fraud by an employee, and you have difficulty to put a stop to the theft or fraud. You must always carry out a DPIA before you are permitted to use a hidden camera.

Monitoring employees

Do you want to monitor your employees? For example, with a camera, tracking software, or by monitoring their business phone use? You must take your employees' privacy into account. You must comply with the conditions for monitoring employees.