GDPR Video Surveillance Guide for Non-EU Companies
GDPR compliance for video surveillance systems operated by non-EU companies. CCTV, smart cameras, biometric data, and EU Representative requirements.
Video surveillance capturing EU individuals — whether for physical security, retail analytics, traffic monitoring, or smart building management — processes personal data under GDPR. For non-EU companies operating surveillance systems that capture EU residents, Article 27 applies.
Video Data = Personal Data
The European Data Protection Board (EDPB) has confirmed that video footage of identifiable individuals constitutes personal data under Article 4(1). If the camera captures individuals in the EU, the recording is personal data processing, regardless of where the camera owner is established.
Biometric Data (Article 9)
If your surveillance system includes facial recognition or gait analysis, you are processing special category data under Article 9 — biometric data for the purpose of uniquely identifying a natural person. This requires explicit consent or one of the specific Article 9 derogations, plus a Data Protection Impact Assessment (DPIA).
Signage and Transparency
Article 13 requires you to inform individuals that they are being recorded, by whom, for what purpose, and how long footage is retained. Signage alone is insufficient — a Privacy Policy addendum or CCTV notice must include: controller identity, EU Representative contact, processing purpose, legal basis, retention period, and data subject rights.
Retention of Footage
Most EU DPAs recommend video retention of 24-72 hours for general surveillance, 30 days for incident investigation (if an incident occurred), and up to 90 days for law enforcement purposes. Any retention beyond necessity violates the data minimization principle (Article 5(1)(c)).
Smart Home Cameras
Non-EU smart camera manufacturers (Ring, Arlo, Eufy, Google Nest) that process footage of EU residents must comply with GDPR. The manufacturer is a data controller for the video processing, and Article 27 requires an EU Representative.
Compliance Steps
- Conduct a DPIA for all surveillance systems capturing EU individuals
- Appoint an EU Representative if not already in place
- Update signage and Privacy Policy with processing details and EU Rep contact
- Implement retention schedules (24-72h default, purge older footage)
- If using facial recognition, establish explicit consent mechanism
Ready to get compliant?
€490/year. 15-minute setup. Active next business day.