Drafting camera surveillance regulations: this is what belongs in them

Drafting camera surveillance regulations begins with substantiating the legal basis: why the cameras are installed and why this is permitted under the GDPR. You establish the purpose and the legitimate interest (Art. 6 para. 1 sub f GDPR), demonstrate the necessity and proportionality, and describe the retention period, access to the footage, and the manner in which you inform the data subjects. If the surveillance is aimed at personnel, a process involving the Works Council is also required (Art. 27 para. 1 sub l WOR). Good regulations are concrete and verifiable, not generic text that could apply to anything.

The short answer

• Describe the purpose and legitimate interest of the camera surveillance (Art. 6 para. 1 sub f GDPR).
• Substantiate the necessity, proportionality, and subsidiarity with concrete evidence.
• Document the placement: which cameras, which zones, and what is explicitly not captured.
• Regulate the retention period: guideline of four weeks, longer only in the event of a specific incident.
• Regulate the duty to provide information via signs and a privacy statement (Art. 13 GDPR).
• Involve the Works Council in the supervision of personnel (Art. 27, paragraph 1, sub l of the Works Councils Act).

Drafting camera surveillance regulations: start with the goal

The basis of any regulation is the question of why the cameras are installed. Formulate the purpose concretely: preventing theft in the warehouse, ensuring the safety of staff at the counter, or protecting property outside opening hours. Link that purpose to a legitimate interest under Art. 6(1)(f) GDPR. A vague purpose such as general safety is too broad; the regulation must demonstrate which specific risk is being covered.

Next, work out the three tests required by law. Necessity demonstrates that camera surveillance actually contributes to the objective. Subsidiarity shows that there is no less intrusive means, such as better locks, lighting, or an alarm. Proportionality weighs your interest against the privacy of employees and visitors. Document this balancing act explicitly, because it is precisely this element that makes the difference between regulations that hold up and text that proves insufficient in the event of a complaint.

Placement, retention period and access

Describe specifically where the cameras are installed and what they are aimed at. Equally important is what you exclude: toilets, changing rooms, and canteens are, in principle, prohibited zones because the invasion of privacy there is too great. Aim cameras as much as possible at the zone to be protected and not at the public road. This demarcation supports the proportionality you substantiated earlier.

Next, establish the retention period. The guideline from the Dutch Data Protection Authority is a maximum of four weeks; only in the event of a specific incident may the relevant recording be retained longer until the matter has been resolved. Also regulate who is allowed to view the footage, under what conditions this occurs, and how the footage is secured against unauthorized access. Additionally, include how you handle a request for access from someone appearing in the footage, as this is also a right under the GDPR.

Visibility and hidden cameras

In principle, camera surveillance may not be covert. Stipulate in the regulations how you inform data subjects: with visible signs or stickers at the entrance and a reference to the privacy statement, in line with the duty to inform under Art. 13 GDPR. Anyone entering the premises must know that cameras are installed, for what purpose, and who the controller is. Include where to find the full information, for example on the website or at the reception.

If you wish to keep the door open for temporary covert camera surveillance in the event of concrete suspicion, explicitly state that hidden cameras may be deployed under strict conditions. Only then is it defensible in retrospect that the surveillance was known. Covert filming without this mention and without concrete grounds is not permitted and can even be problematic under criminal law.

The Works Council and the implementation

If the supervision is partly aimed at the behavior or performance of personnel, it constitutes a personnel monitoring system, and the Works Council has the right of consent regarding its introduction, modification, or withdrawal (Article 27, paragraph 1, sub l of the Works Councils Act). Include in the regulations that consent has been obtained and involve the Council in a timely manner, as a decision without consent is voidable. Even without a Works Council, it is advisable to inform the staff in advance, because supervision in the workplace affects the employment relationship.

An SME automotive company wants to install cameras at the workshop and parts storage following repeated disappearances. When drafting the regulations, the company substantiates the disappearances as a legitimate interest, directs the cameras solely at the storage area and not at the canteen, sets the retention period at four weeks, and requests the Works Council's consent. Because these choices are stated in the regulations beforehand, the implementation proceeds without objections and the surveillance is immediately lawful.

Honest recommendation

For a simple situation, you do not need a lawyer. If you install a single camera at your own entrance, aimed at access rather than staff, and inform visitors with a sign and a brief privacy statement, a concise set of regulations will suffice. However, as soon as surveillance is also directed at employees, involves multiple cameras, touches upon sensitive zones, or the Works Council comes into view, the regulations become the deciding factor in lawfulness. In that case, have them drafted or reviewed by someone familiar with the GDPR balancing act, retention periods, and the right of consent.

Want to read more? View the camera surveillance regulations on our contracts page, first take your time to read what camera surveillance regulations are , and see what it costs to camera surveillance regulations drawn up .

Frequently Asked Questions