Security cameras have become ordinary equipment in cafes, clinics, shops, and small offices. Installing them is lawful and often genuinely necessary.
What is rarely appreciated: the moment a camera records someone's face, you are collecting personal data, and since Law No. 27 of 2022 came into force, that carries obligations.
The good news is that meeting them is not complicated. Most of it simply asks for clarity.
Why footage counts as personal data
Personal data is data that can identify someone, either on its own or combined with other data. A face meets that directly.
That means, as a business owner with cameras installed, you act as the data controller, the party deciding the purpose and means of processing. That role carries four basic obligations: have a lawful reason, give notice, keep it secure, and do not keep it longer than needed.
Note. This is an educational summary, not legal advice. How it applies to a particular situation depends on many things that cannot be assessed from a distance. For business decisions, consult a competent legal adviser.
Three things that make the difference
| Aspect | Reasonable | Causes problems |
|---|---|---|
| Purpose | Security of assets and people | Covertly monitoring staff |
| Area | Entrance, till, storeroom | Toilets, changing rooms, prayer rooms |
| Notice | Sign visible before entry | Hidden cameras |
| Retention | Around 30 days | Kept indefinitely |
| Access to footage | Limited and logged | Anyone can open it |
The last row is the most overlooked. Footage that anyone can open from their own phone is a leak waiting to happen.
Areas that must not be recorded
Some places carry a high expectation of privacy, and installing a camera there is problematic regardless of the reason:
- Toilets and bathrooms
- Changing rooms
- Prayer rooms
- Staff rest areas
- Examination rooms in a clinic
Pay attention to where outdoor cameras point, too. A camera installed to watch the shop door that also records inside a neighbour's house creates a different problem, and it is a frequent source of disputes between neighbours.
Giving notice properly
An adequate notice sign carries three things:
- That this area is monitored by camera.
- Who installed it: your business name.
- Where to ask: a contactable number or address.
Place it before someone enters the monitored area, not inside it. A notice only visible after someone has already been recorded loses most of its meaning.
For employees, the notice should be more detailed and given in writing: where the cameras are, what they are for, who can view the footage, and how long it is kept.
Retention and security
Keep footage only as long as genuinely needed. For business security, thirty days is generally adequate, long enough to notice an incident and retrieve it.
Keeping it longer adds risk without adding benefit. A recorder that overwrites old footage automatically actually helps you meet this principle without having to remember.
For security, four basic steps:
- Change the factory passwords on the recorder and the cameras. The default combinations for each brand circulate openly.
- Do not open the recorder's ports to the internet without careful thought, the risks are covered in the guide to port forwarding.
- Put the cameras on a network separate from the till and work computers, guide to separating networks.
- Limit who has access, and revoke it when someone leaves.
Security considerations for camera hardware more generally are covered in the guide to smart device security.
Rights of people recorded
Someone who has been recorded is a data subject, and holds rights you need an answer ready for:
| Right | What you need in place |
|---|---|
| To know recording is happening | A notice sign |
| To access footage of themselves | A request procedure, other faces obscured |
| To object | A channel for raising it |
| To request deletion | A case-by-case assessment |
Access requests cause the most confusion, because one recording usually contains many people. Meeting one person's right must not breach another's privacy, which is why obscuring third-party faces has become the usual middle ground.
What you can do this week
- Check where each camera points. Make sure none covers a high-privacy area or a neighbour's property.
- Put a notice sign at every entrance.
- Set the recorder's retention to thirty days.
- Change the recorder and camera passwords from their defaults.
- Note down who has access, and revoke anyone who no longer needs it.
All five can be finished in one afternoon, and they close off most of the risk that otherwise only becomes apparent too late.
Frequently asked questions
Is a CCTV notice sign required?
The transparency principle in the PDP Law requires people to know their data is being collected. A visible sign placed before someone enters the monitored area is the simplest way to meet that, and putting one up costs far less than dealing with an objection.
How long should CCTV footage be kept?
Only as long as genuinely needed for its purpose, generally thirty days for business security. Keeping it longer without reason adds risk without adding benefit, and runs against the storage limitation principle.
Can CCTV record audio?
Recording conversations adds a far greater layer of risk than images alone, because the content of speech is more sensitive. For business security, audio recording is rarely genuinely necessary and is better switched off.
Can an employee request footage of themselves?
As a data subject, a person has the right to access their personal data. For CCTV, meeting that is complicated because one recording usually contains many people. The usual approach is to provide limited access with other faces obscured.
