TL;DR: Companies filming in France need a complete warning sign that meets CNIL guidance, retention of one month at most, and access request answers that do not expose third parties. Cameras covering areas open to the public also need an authorization from the prefect. The Samaritaine department store paid €100,000 over hidden cameras. This guide is for DPOs, compliance and IT teams. Gallio PRO automatically blurs faces and license plates. Check your setup with the CCTV compliance check : nine questions, your result on the page, no email needed.
This article describes the situation in France. It is written for companies headquartered elsewhere that run stores, warehouses, offices or sites in France, and for their data protection teams.
The GDPR applies across the EU, but France adds its own layer: the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL), the Internal Security Code (Code de la sécurité intérieure, CSI) and the Labour Code (Code du travail). The French terms appear in brackets so you can match them to local documents and advisers.
The CNIL declaration for video surveillance was abolished on 25 May 2018, but in return you must be able to demonstrate compliance at any time (Art. 5(2) GDPR). We explain what exactly replaced it in our guide CNIL CCTV Declaration in France: Abolished in 2018, Here Is What Replaced It.
In France, the decisive question is whether a camera films a place open to the public.
Areas open to the public (entrances, sales floors, checkouts): this is "vidéoprotection". The system must be authorized by the prefect of the département under Articles L251-1 et seq. of the Internal Security Code. The GDPR applies in parallel.
Areas not open to the public (storerooms, offices, staff-only spaces): this is "vidéosurveillance". No prefectoral authorization is needed, but the GDPR applies in full: record, information, data minimization, DPO.
When employees are filmed, the French Labour Code adds three rules:
The CNIL states that cameras must not be used to check whether staff do their job properly, and must not film inside fitting rooms or toilets.
The sign must be visible before a person enters the recorded area. According to the CNIL, it must show:
Other information required by Art. 13 GDPR, such as the legal basis or recipients, can be given in a second layer: a notice at reception, a web page or a QR code on the sign. A generic "Smile, you're on camera" sign is not enough.
Anyone who has been filmed can ask to see the footage that concerns them. For vidéoprotection, Article L253-5 of the Internal Security Code states that "this access is of right". The GDPR sets a one-month deadline, extendable by two months for complex requests (Art. 12(3)).
The problem is everyone else in the frame. Customers, employees, passers-by: almost every sequence shows them.
Article L253-5 allows access to be refused on grounds relating to the rights of third parties. Art. 15(4) GDPR provides that the copy must not adversely affect the rights of others. The European Data Protection Board (EDPB) Guidelines 3/2019 point to the practical route: mask or blur third parties instead of refusing the request.
Blurring third parties lets you grant the request without creating a new problem. A blanket refusal based on the presence of third parties is hard to defend when blurring was possible.
For vidéoprotection, Article L252-5 of the Internal Security Code sets the rule: outside an investigation or court proceedings, footage is destroyed within the period set by the prefectoral authorization, which cannot exceed one month.
The CNIL adds two points. The retention period must not be set by storage capacity alone. And a few days are generally enough to check an incident.
If proceedings are started, the relevant footage is extracted and kept for the duration of the proceedings. The extraction must be logged
.
On 18 September 2025, the CNIL's restricted committee fined SAMARITAINE SAS, the company that runs the Paris department store, €100,000 ( source: CNIL).
In August 2023, after a rise in goods theft, the company had installed cameras in two storerooms. They looked like smoke detectors and could record sound. Employees discovered them, and they were removed in September 2023. A press article followed by a complaint triggered the CNIL investigation.
The CNIL found three breaches:
What the case shows:
Breaches of GDPR principles fall under Art. 83(5): up to €20 million or 4% of worldwide annual turnover. Under French criminal law, Article 226-1 of the Penal Code (Code pénal) punishes capturing a person's image in a private place without consent with up to one year in prison and a €45,000 fine.
Gallio PRO runs as an application on Windows and macOS. For enterprise environments, an on-premise command line version is available for Linux. Footage does not have to be sent to an external cloud service. For high volumes of requests, see also our article on access requests in retail and shopping malls .
Check | Legal basis | Done? |
Prefectoral authorization for cameras filming areas open to the public | CSI, Art. L251-1 et seq. | ☐ |
Complete sign before every recorded area | Art. 13 GDPR | ☐ |
Works council consulted and employees informed individually | Labour Code, Art. L2312-38 and L1222-4 | ☐ |
Entry in the record and DPIA where required | Art. 30 and 35 GDPR | ☐ |
DPO involved before installation | Art. 38(1) GDPR | ☐ |
Retention of one month at most, set by actual need | CSI, Art. L252-5 | ☐ |
Access request process with a one-month deadline | Art. 12 and 15 GDPR, CSI Art. L253-5 | ☐ |
A tool to blur third parties before disclosure | Art. 15(4) GDPR | ☐ |
No sound recording, no cameras in toilets or fitting rooms | Art. 5(1)(c) GDPR | ☐ |
No, the declaration was abolished on 25 May 2018, when the GDPR took effect. What you need instead is explained in our guide CNIL CCTV Declaration in France: Abolished in 2018, Here Is What Replaced It.
Yes. People must be informed before they enter the recorded area. A pictogram alone is not enough: the sign must state the purposes, the retention period, the contact for the controller or DPO, data protection rights and the right to complain to the CNIL.
Yes for areas open to the public, such as the sales floor or checkouts: the authorization is issued by the prefect. No for storerooms and offices, but the GDPR applies.
One month at most for vidéoprotection (Article L252-5 of the Internal Security Code). The CNIL notes that a few days are generally enough. Footage linked to proceedings can be kept for their duration.
Only in exceptional circumstances, temporarily and after a documented analysis. The Samaritaine was fined €100,000 for not meeting these conditions.
Refusal is possible to protect third parties, but blurring usually lets you answer. The faces and license plates of other people are blurred, then the copy is handed over.
Up to €20 million or 4% of worldwide annual turnover under the GDPR. The Samaritaine paid €100,000 in 2025. The French Penal Code also provides for up to one year in prison and a €45,000 fine for capturing images in a private place without consent.
Abolishing the CNIL declaration did not lighten the obligations; it shifted them to proof. A complete sign, a record entry, short retention and access answers with third parties blurred are the foundation the CNIL checks. The Samaritaine case shows that a temporary, poorly documented system is enough to trigger a fine.
Operating outside France as well? National rules differ from country to country, even under the same GDPR.
Check your setup with the CCTV compliance check : nine questions, your result on the page, no email needed.
