If your cameras record people, you are processing personal data, and the General Data Protection Regulation (GDPR) applies to you. That does not make CCTV difficult to use. It means you need a reason for it, you need to be open about it, and you need to look after the footage. This guide follows the Data Protection Commission's guidance on CCTV. It is general information, not legal advice.

1. Be clear about why you have cameras

Before installing a system, write down what it is for: usually the security of the premises and the safety of staff and visitors. Every camera should serve that purpose. A camera on the back gate serves a security purpose. A camera pointed at a neighbour's garden, a public footpath or the staff canteen is much harder to justify.

If you later want to use the footage for something else, such as checking when staff arrive, that is a new purpose and it needs its own justification.

2. Put up signs

People must know they are being recorded before they walk into view. The Data Protection Commission expects easily read, well-lit signs in prominent positions, and a sign at each entrance will normally do. The sign should say:

  • that CCTV is in operation;
  • why (for example, "for the security of the premises and the safety of staff and visitors");
  • who operates it, with contact details.

3. Write a short CCTV policy

A one or two page policy is enough for most businesses. It should cover the purpose of the system, where the cameras are, who can view footage, how long it is kept, how it is secured and how somebody can request a copy. Bring it to the attention of your staff.

4. Decide how long to keep footage

The law does not set a number of days. You must be able to justify the period you choose. The Commission's guidance says that for a normal security system it would be difficult to justify keeping footage for longer than one month, and most recorders can be set to overwrite after 30 days or less.

Footage of a particular incident can be kept for longer while it is being investigated or used in a claim. Save it separately and store it securely.

5. Take care with staff

Monitoring employees with cameras is intrusive and is one of the most common sources of complaints. As a rule:

  • tell staff clearly that cameras are in use, where they are and why;
  • do not record toilets, changing rooms or break areas;
  • do not use security footage for routine checks on attendance or performance;
  • hidden cameras are generally unlawful, and are only permitted in exceptional, short-term circumstances such as the investigation of a criminal offence.

6. Know how to handle an access request

Anybody who has been recorded can ask for a copy of the footage of themselves. You normally have one month to respond. Once a request arrives, do not delete the footage, even if your usual retention period is about to expire. If other people appear in the clip, consider blurring them or providing stills.

7. Giving footage to the Gardaí

You may give footage to An Garda Síochána for the investigation of a crime. The Commission's guidance is to ask for the request in writing, stating that it relates to a criminal investigation. In an emergency a verbal request can be acted on and followed up in writing. Keep a record of what you handed over, to whom and when.

8. If a security company monitors your cameras

When an outside company views or stores your footage, it is acting as your data processor, and GDPR requires a written contract between you. It should set out what the company may do with the footage, how it is kept secure and how long it is retained. Check also that the company holds the right PSA licence: installing CCTV and monitoring CCTV are separate licence categories.

A ten-minute CCTV check

  • Can you say in one sentence what the system is for?
  • Is there a sign at every entrance with your name and contact details?
  • Does any camera cover a place where people expect privacy?
  • What is the recorder's retention period set to?
  • Who has the password, and is remote viewing secured?
  • Do staff know about the cameras and the policy?
  • Would you know what to do if a customer asked for footage tomorrow?

We design, install and maintain CCTV systems with these rules in mind. If you are planning a new system or are unsure about an existing one, get in touch.