When GDPR applies
The GDPR applies to video devices where the footage makes people identifiable, directly or indirectly. The EDPB's Guidelines 3/2019 on processing personal data through video devices cover this across all uses of video, not only surveillance. The final text is version 2.0, adopted on 29 January 2020. Cite that version, because earlier drafts differ.
Privacy by design in the camera layout
Data protection by design means choosing a camera layout and settings that collect only what the purpose needs:
- Field of view. Aim cameras at the area the purpose requires. Avoid public pavements, neighbouring windows and staff break areas unless there is a defined reason.
- Masking. Use privacy masking or scrambling for parts of the image that are not relevant to the purpose. The guidelines point to privacy-enhancing technologies of this kind.
- Resolution and coverage. Set resolution to the detection or recognition task the camera serves, not to the maximum the camera supports.
Storage, transmission and access
The controller must protect the camera system and the data at every stage: storage, transmission and processing, using a combination of organisational and technical measures. For ELV design, that means:
- Encrypted transmission between cameras, recorders and the VMS, and encrypted storage where the platform supports it.
- Role-based access to live and recorded video, with logs of who viewed or exported footage.
- Retention periods set in the design and enforced by the recorder, with a documented reason for each period.
- Controlled remote access, no default passwords, and a plan for firmware updates.
Analytics and purpose limits
The guidelines warn that footage can be reused for purposes people would not expect, and that analytics can turn ordinary cameras into "smart" cameras with much higher privacy risk. Before adding video analytics, face recognition or people counting, confirm the lawful basis and whether a data protection impact assessment is needed. Article 35 GDPR requires a DPIA where processing is likely to result in high risk, which can include large-scale systematic monitoring of publicly accessible areas. Check the DPIA section of the guidelines and your national supervisory authority's guidance.
Signage and transparency
Where possible, place signs so that people see them before they enter the monitored area. Signs should identify the controller and give a contact for more information. Treat signage as a design item: show sign positions on the drawings and the wording in the specification.
Design checklist
- Define the purpose of each camera before choosing its location.
- Show fields of view and masking zones on the CCTV drawings.
- Set retention periods per camera group and record the justification.
- Specify role-based VMS access, logging and encrypted transport.
- Add signage positions and wording to the design deliverables.
- Flag any analytics or biometric function for DPIA review before it is specified.
We apply these principles within the CCTV scope. Legal compliance rests with the controller and its data protection adviser.