CCTV footage of identifiable people is personal data, so running cameras in your shop, office or premises is regulated processing under the Law on Personal Data Protection and its dedicated rulebook. You cannot simply install cameras — you must document why and how, tell people they are being filmed, and delete recordings on time. Here is what a compliant setup looks like.
Adopt an act on video surveillance
The controller must adopt a formal internal act on the manner of performing video surveillance. It sets out the legal basis, the purpose(s) of the surveillance, the categories of personal data captured, a description of the surveillance system, the retention period, the notice to individuals, a privacy statement, the technical specification of the equipment (number of cameras, resolution, workstations that access the system), and a plan showing where the system is installed. In short, the act is the documented justification and design of your CCTV.
Post a visible notice
You must display, in a visible and clear place, a notice informing people that video surveillance is being carried out. This is a hard requirement — people must know they are being filmed before they enter the monitored area. The rulebook provides a template for this notice, and it forms part of your video surveillance act, together with a privacy statement explaining how individuals can exercise their rights.
Keep footage no longer than 30 days
Recordings are kept only as long as needed to fulfil their purpose, and in principle no longer than 30 days, after which they are automatically deleted from the storage medium. Longer retention is allowed only where another law requires it, or where it is genuinely necessary for the controller's legitimate interest in pursuing a legal procedure — in which case you must set internal rules for how such footage is stored and deleted. Keep an access log recording who received a copy of any footage and when.
Not sure how this applies to you?
Get a clear answer from a verified expert.
Respect people's rights
Individuals captured by your cameras keep their data-protection rights — including the right to be informed and, subject to conditions, to access footage of themselves. Your video surveillance act must describe how people can exercise these rights, and you must define the technical specification of the equipment used. Getting the paperwork right is what turns a set of cameras into lawful surveillance.
