CCTV in an Irish shop, salon, clinic or office: before the cameras go up, and after

Footage in which a person can be identified is personal data. The business that installs the cameras is responsible for it under data protection law (the data controller). The Data Protection Commission's CCTV guidance for controllers, last updated in November 2023, is the document to work from.

Each reason for the cameras must be specified, explicit and legitimate (Article 5(1)(b) of the GDPR). The DPC says footage should not be collected on a just-in-case basis. Its examples of reasons are securing the premises, preventing and detecting crime, and health and safety at work.

Consent is unlikely to work, the DPC says, because freely given consent from everybody recorded would be very difficult to get. The legal ground is often the business's legitimate interests (Article 6(1)(f)). You must be able to show three things: the cameras serve your interests, they are necessary for the purpose, and they do not affect the people recorded disproportionately.

Necessary means more than helpful. The DPC asks whether something that collects no personal data would do, such as supervision, security staff, fencing or alarms. Whether the cameras are proportionate depends on the area covered, the number of cameras, how much of the staff's working day is recorded, and whether they catch public space or young or vulnerable people. Cameras for health and safety need evidence of problems that arose before they went in. The European Data Protection Board (EDPB) adds that the interest must be real and present, and advises logging incidents and reviewing the need for the cameras from time to time.

The DPC's guidance works through a convenience shop hit by robberies and shoplifting. It has cameras on the shop floor where shoplifting happened and on the till, one outside camera on the door aimed away from the street, and none where staff take breaks. The DPC says that set-up likely presents no high risk and needs no in-depth assessment. The reasons should still be written down: what is collected, how it is secured, how long it is kept and why.

In a 2023 case study, an employee of a beauty business complained that cameras had gone in without their knowledge and might record sound. The supplier confirmed they could not record sound. The business said the cameras had been in place for three years and the employee had given staff training on them. It had installed them after thefts and to protect staff working alone. The DPC said it could not rely on vital interests, a legal ground only for protecting a person's life or against a serious threat to them. On legitimate interests, the business said it had weighed its needs against the privacy of the people recorded before installation (a balancing test), kept footage for 20 days and controlled who could see it. The DPC found a valid lawful basis under Article 6(1)(f).

The DPC says to focus cameras where possible on areas of particular risk, such as cash points, and to avoid break rooms, changing rooms and toilets, where cameras are hardest to justify. In a clothes shop's changing rooms or a restaurant's toilet cubicles, CCTV will likely break the GDPR in nearly all circumstances. Outside, aim at your own property and mask the street and the neighbours, as a farm in a 2025 DPC case study did with privacy zones after a complaint.

The DPC's CCTV guidance does not deal with sound. The EDPB says functions that are not necessary, audio recording among them, must be switched off, and the DPC's dash cam guidance says audio inside a vehicle would need a very strong justification.

Hidden cameras are generally unlawful. The DPC says hidden (covert) recording is normally permitted only in exceptional cases, decided one at a time, to prevent, detect or investigate offences. It must follow a written policy, with the aim of involving An Garda Síochána or bringing proceedings. It must be focused and short, with a data protection impact assessment (DPIA) done first, and it must stop if it finds nothing within a reasonable period. Facial recognition is biometric processing, which the DPC treats as sensitive data with extra protection (special category data under Article 9).

A camera collects personal data as somebody walks in, so you must tell people about it (Article 13 of the GDPR). The DPC says easily read, well-lit signs at every entrance will normally do. They should give the purpose of the cameras and the business's identity and contact details. The rest must be easy to find, including how the footage is secured and the details of any data protection officer (whether you need one).

The EDPB calls this a layered approach. The sign goes at about eye level, before people reach the area recorded. The full notice goes at reception, the till or on a poster, ideally online too, where people can read it without walking in front of the cameras.

Staff should be told clearly that monitoring is taking place, where it happens and why. In a 2024 case study, a medical practice reviewed waiting-room footage to check waiting times. During that review, an employee learned they had been recorded throughout their employment. One small sign on the door did not say the cameras recorded inside, and the practice's policy was older than the GDPR. The DPC found no valid lawful basis for that monitoring, and found that the practice had failed to meet Article 13.

The law sets no period. The DPC says you must be able to justify a defined retention period, and may not keep footage just in case.

The DPC's one figure comes from injury claims. Section 8 of the Civil Liability and Courts Act 2004 expects a letter of claim within one month of the date of the cause of action. For that reason, the DPC says 30 days may be deemed reasonable, proportionate and balanced for footage kept to defend a potential personal injury action. For a normal security system, it says, keeping footage beyond one month would be difficult to justify.

That month is not a default setting. The same page says the period should be the shortest necessary, while allowing time to review footage. It also says to check a recorder's default setting against your own assessment. The EDPB says footage should in most cases be erased after a few days, ideally automatically. The longer the period, especially beyond 72 hours, the more argument it needs.

Footage of a specific incident, such as a break-in or an accident at work, may justify a longer period, kept apart and secure.

The DPC's examples of security measures are restricted access, encryption and passwords on the devices storing footage, no shared passwords, secure storage, and a reviewed access log. The DPC says that watching footage remotely instead of supervising in person is unlikely to be justifiable.

An installer or security company that runs the system for you may be a processor, meaning a business that handles personal data on your behalf. A supplier that stores your footage for you is one too (Article 4(2) and (8)). You need a written contract with it (Article 28). Under that contract the processor acts only on your documented instructions, keeps the footage secure, helps you answer requests, and deletes or returns the footage when the service ends. If footage goes outside the EU, the notice must say so, and the transfer must meet the GDPR's transfer rules in Chapter V (transfers to the US).

The DPC recommends giving footage to An Garda Síochána only on a formal written request saying that a criminal matter is under investigation. In an urgent case, a verbal request will do if it is followed up in writing. The DPC also recommends recording every request. Handing footage over is lawful where it is necessary and proportionate for preventing, detecting, investigating or prosecuting criminal offences (section 41(b) of the Data Protection Act 2018).

A solicitor may write for somebody in the footage, with proof that the person authorised them. That is the person's own access request: answer it within the one month set out below. An insurer, a solicitor or another business asking for its own purposes is different. Give them footage only after you weigh up that disclosure, as you weighed up the cameras. The DPC says a third party's legitimate interests may allow you to disclose footage, but do not oblige you to. Its dash cam guidance says no Irish law lets third parties obtain dash cam footage from the business holding it, though court orders to hand over documents (discovery orders) may apply in some cases.

A stolen recorder, or footage reached by somebody who should not have had access, will usually be a personal data breach (Article 4(12)). Article 33 decides whether you must tell the DPC, and the 72-hour rules cover when and how.

The DPC calls a written CCTV policy best practice. It should suit the size of the system, and employees should be made aware of it. In its 2025 farm case study, the DPC names a comprehensive policy alongside the lawful basis. Your record of processing, the written list of how you use personal data, should include the CCTV and the assessment behind it (who keeps one). Drawing on the DPC and the EDPB, the policy should cover:

Before you use footage for a new purpose, check that the new use fits with the original one (a compatibility test under Article 6(4)). The test is not needed where the new use rests on the person's consent or on a law such as section 41. Tell people about a new purpose before it starts (Article 13(3)).

The DPC says CCTV justified for security or health and safety should not be used to monitor staff attendance or performance. Footage may be used to investigate an allegation of gross misconduct or another disciplinary matter, strictly case by case, where the employer can show that is necessary, and that its access to the footage is proportionate and limited to that matter.

The DPC's 2025 annual report describes a reprimand to the Irish Prison Service. It had used its cameras to monitor an employee's movements in a disciplinary matter the employee had already admitted. It could not show why that was necessary or proportionate, how it fitted its own CCTV policy, or an appropriate lawful basis.

In Kaminski v Ballymaguire Foods (Circuit Court, 11 July 2023), a food business showed CCTV clips about food safety to managers and supervisors. One clip showed a supervisor who could be identified. The court found a lack of clarity in the four documents describing the business's CCTV, of which only the 2018 policy mentioned training. No legal basis had been pleaded and no legitimate interest assessment had been done. The court awarded the supervisor €2,000 for non-material damage, meaning harm that is not financial, under section 117 of the Data Protection Act 2018.

Posting footage of a suspected shoplifter online is a new use too. In its householder guidance the DPC advises against publishing such footage, because a lawful basis is unlikely, and suggests contacting An Garda Síochána.

Anybody who can be identified in the footage, staff or customer, has the right to see it (the right of access under Article 15). You must answer without undue delay, and at the latest one month from receiving the request (Article 12(3)). For complex or numerous requests, you can extend that by two further months if you tell the person within the first month, with reasons. The first copy is free.

You may ask for a reasonable indication of the date and time. In a 2025 case study, the DPC could not continue a complaint from a requester who would not give them. If the footage was deleted under your retention period before the request arrived, say it no longer exists.

The response is normally a copy of the video, with the legal basis, the purpose and anybody the footage was given to. Send still images only where the footage cannot be copied or in other exceptional cases, and cover the whole time the person appears. Weigh other people in the footage case by case (Article 15(4)). You can blur them (pixelate) or ask for their consent, but the DPC says the weighing should not end in simply refusing.

In a 2025 case study an organisation refused a request and told the DPC the footage had gone to An Garda Síochána, where the requester could get it. The DPC instructed it to respond. Sending a person elsewhere, it said, does not remove the responsibilities of an organisation that is still the controller. To withhold footage, name the exemption, explain why it applies and show that relying on it is necessary and proportionate. The access request guide covers the exemptions.

Where the cameras rest on legitimate interests, anybody recorded may also object, on grounds relating to their own situation (Article 21(1)). You must then stop processing their footage, unless you can show compelling legitimate grounds that override their interests, or you need it for legal claims. They may also ask you to delete it (erasure, under Article 17). In the EDPB's example, a passer-by at a shop door whose footage shows no vandalism must have it erased. Both kinds of request run on the same one-month clock (Article 12(3)).

The GDPR requires a DPIA for systematic monitoring of a publicly accessible area on a large scale (Article 35(3)(c)). The DPC's own list of processing that may need one (its Article 35(4) list) adds systematically monitoring, tracking or observing people's location or behaviour, where a documented screening indicates a likely high risk. The DPC says a business must assess, decide and write down whether a DPIA is needed, and advises doing one where there is a doubt.

The CCTV guidance scales the answer to the set-up. The convenience shop needs no in-depth assessment. A university campus with cameras throughout, on grounds the public uses, needs a full DPIA. Hidden cameras should have one first. For cameras in or near toilets and changing areas, the guidance strongly recommends a DPIA or a legitimate interest assessment. In the same passage it says a DPIA will be required where CCTV is used in areas frequented by children, its example being a school's toilets.

The EDPB says it is reasonable to assume that many cases of video surveillance will require a DPIA. The DPC's high-risk factors include monitoring people who may not be aware of it, and monitoring vulnerable people, a group likely to include employees. The Irish DPIA list covers the rest, and the DPIA check screens the wider business.

The GDPR does not cover purely personal or household activity with no connection to a professional or commercial activity (the household exemption, Article 2(2)(c) and Recital 18). The DPC's domestic CCTV guidance, updated in May 2026, points fixed cameras and smart doorbells in a business, commercial or workplace setting to its guidance for businesses (controllers). Its dash cam guidance says the exemption does not apply in any event to commercial use, such as taxis, buses or delivery companies. For those it asks for a visible sign or sticker on or in the vehicle, a policy, and a copy of the footage for anybody who asks, within one month.

None of these is required:

The European Commission's Digital Omnibus proposal of 19 November 2025 would replace national DPIA lists with one EU list. The DPC's list stays valid until the EU list is adopted. On 16 October 2026 the European Parliament's file showed the proposal awaiting a committee decision. It is not law.