Installing video surveillance in a GDPR-compliant way — a practical guide

“Am I actually allowed to film my own property?” — the most common question when we talk about video surveillance. The short answer: Yes, you are. But not everything, and not everywhere. Whoever respects a few basic rules ends up with an effective and at the same time legally sound installation.

What you may and may not film

You may:

• Film your own property, including driveway, garden and entrance.
• Watch the direct access to doors and windows.
• Watch interior rooms, as long as no employees or tenants are recorded continuously.

You may not (or only with restrictions):

• Film pavements, roads or neighbouring properties — not even “accidentally caught on camera”.
• Capture the entrance areas of neighbours.
• Store recordings indefinitely without cause (default: delete every 48–72 hours).

GDPR obligations in short

If you operate video surveillance, you are the data controller under data protection law. This brings three essential obligations:

1. Record of processing activities. You must document what you film, why, how long you store recordings and who has access. We provide a template right away.

2. Information signage. A sign informing about the surveillance has to be visible within the camera area (Art. 13 GDPR). We bring the signs along to the installation — including a QR code linking to the privacy notice.

3. Retention policy. Recordings must be automatically deleted after a short period. Our default setup deletes after 72 hours — except for documented incidents.

What we check at every installation

• Camera angles: we align cameras so that no public areas are captured. If unavoidable, we mask the relevant zones directly on the sensor.
• Storage: locally on an NVR or encrypted in a GDPR-compliant cloud. No streaming to servers in the US.
• Access permissions: who is allowed to look is defined in advance and configured technically in the system.
• Audio: disabled by default, because audio recordings are legally more sensitive than video alone.

Three mistakes we often see

1. Camera over the driveway — with the pavement in view. Common but not permitted. Fix: reset the field of view or digitally mask it.
2. Recordings are kept forever. A hard drive that is never cleared is GDPR-relevant. Fix: automatic retention policy.
3. No information signage. Sounds trivial, but it is mandatory. Fix: visible signs with the minimum required information.

When we advise against video surveillance

Sometimes we actively advise against a video installation — for example when the local situation does not allow a legally compliant install (e.g. tight property borders with unavoidable view of a neighbour). In those cases other measures are often more effective: mechanical protection, motion detectors coupled with lighting, an alarm system.

Talk to us about your project — we will assess on site what is reasonable and permitted.