CCTV Footage And Data Protection Laws: Q&As

Q: What are compliance obligations under GDPR if you operate CCTV surveillance?

A: The data controller must consider the following:

• Data subjects should be informed about the purpose of processing according to Article 12 of the General Data Protection Regulation (Regulation 2016/679) ("GDPR") and therefore made aware that video surveillance is in operation. For CCTV recordings, this can be achieved by a combination of methods, including, warning signs containing the most important information, such as identity of controller, purpose of processing, and reference to an existing privacy notice for CCTV Footage.
• The data controller must document all purposes of processing of that video surveillance system according to Article 5(1)(b) of the GDPR, such as the protection of private property and assets.