GDPR CCTV Compliance Kit
Generate CCTV warning signs, a privacy notice, a retention policy, a legitimate-interests assessment, a DPIA screening and a technical checklist.
How to use this tool
Describe your site, purposes, retention and who can access the footage. The kit generates the documents most CCTV operators need under the GDPR: first-layer sign text, a full privacy notice (Article 13), a retention and access policy, a legitimate interests assessment, a DPIA screening result and a technical security checklist. It also flags risky choices such as audio recording, long retention or monitoring public areas. Documents are generated from templates in your browser, so nothing is invented and nothing is uploaded. National rules on signage, audio and employee monitoring differ, so have the output reviewed locally.
Worked example
A warehouse with 12 cameras, 7-day retention, an installer with remote access and staff in view gets a sign, a notice naming the installer as processor, a warning that retention over 72 hours needs written justification, and a DPIA screening that recommends doing a full DPIA.
Frequently asked questions
How long can I keep CCTV footage under the GDPR?
The GDPR sets no fixed number; storage limitation (Article 5(1)(e)) applies. EDPB Guidelines 3/2019 say footage should in most cases be erased, ideally automatically, after a few days, and that the longer the retention, especially beyond 72 hours, the stronger the justification must be. Some national authorities and courts set their own expectations, so check yours.
Do I need a CCTV warning sign?
You must inform people (Articles 12-14). The EDPB recommends a layered approach: a sign at the entrance to the monitored area with the most important information (controller, purposes, retention, rights, contact) and the full notice available elsewhere, for example at reception or online.
Do I need a DPIA for CCTV?
A DPIA is required where processing is likely to result in a high risk, and Article 35(3)(c) specifically requires one for systematic monitoring of a publicly accessible area on a large scale. Many small installations do not need one, but national supervisory authorities publish lists, so check yours.
Can I record audio with my cameras?
Audio is considerably more intrusive and is restricted or unlawful in many Member States. Do not enable it unless you have a specific, documented justification and have checked national law.
Can I film my employees?
Sometimes, with a clear justification, proportionality, proper information and, in some countries, involvement of employee representatives. Cameras aimed at workstations or break rooms are especially hard to justify.