TL;DR: Companies operating cameras in Germany need a warning sign before the monitored area and must answer access requests under Art. 15 GDPR within one month, without exposing other people in the copy. Volkswagen paid €1.1 million, partly over missing camera notices. This guide is for DPOs, compliance and IT teams. Gallio PRO automatically blurs faces and license plates in recorded footage. Check your setup with the CCTV compliance check : nine questions, your result on the page, no email needed.
This article describes the situation in Germany. It is written for companies headquartered elsewhere that run stores, warehouses, offices or test fleets in Germany, and for their data protection teams.
The GDPR applies across the EU. How German authorities read it, and which national rules sit next to it, is specific to Germany. The German terms appear in brackets so you can match them to local documents and advisers.
German supervisory authorities rarely inspect the camera itself. They look at what happens before and after.
Before: Is the person informed before entering the monitored area?
After: What happens when someone asks to see their footage?
In between sits the question of whether you can prove compliance. Most fines target exactly these three points.
For companies and other private bodies, the legal basis is Art. 6(1)(f) GDPR, legitimate interest. Germany's Federal Administrative Court (Bundesverwaltungsgericht, BVerwG) ruled on 27 March 2019 (case 6 C 2.18) that Section 4 of the Federal Data Protection Act (BDSG) no longer applies to video surveillance by private bodies.
In practice, you must document a balancing test between your interest and the interests of the people being filmed. Typical purposes are protection against theft, vandalism and burglary. A camera that films everything "just in case" rarely passes that test.
Art. 13 GDPR requires that people are informed at the time their data is collected. For cameras, that means the sign must be visible before a person enters the recorded area. The European Data Protection Board (EDPB) Guidelines 3/2019 recommend a two-layer approach.
First layer, the sign itself:
Second layer: the full information under Art. 13 GDPR, for example as a notice at reception, a page on your website or a QR code on the sign.
Germany's Data Protection Conference (Datenschutzkonferenz, DSK), the joint body of the federal and state data protection authorities, has published a template for this kind of sign. A pictogram alone is not enough.
Anyone who has been filmed can request access and receive a copy of the data concerning them (Art. 15(1) and (3) GDPR). The deadline is one month from receipt. For complex cases it can be extended by two further months, provided you inform the person within the first month (Art. 12(3) GDPR).
This is where the real problem starts. Almost every recording shows other people too: customers, employees, passers-by and their vehicles.
Art. 15(4) GDPR states that the right to a copy must not adversely affect the rights and freedoms of others. The EDPB Guidelines 3/2019 explicitly name image editing such as masking or scrambling as a way to protect third parties.
You cannot simply refuse the request because other people are visible. You have to make those people unrecognizable and then hand over the copy.
Under Art. 5(2) GDPR, you must be able to demonstrate compliance. For video surveillance in Germany, that means at least:
In July 2022, the State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen) fined Volkswagen AG €1.1 million. Volkswagen accepted the decision ( source: LTO, in German).
The trigger was a police check in Austria in 2019. A VW test vehicle was recording surrounding traffic with cameras to analyze errors in a driver assistance system. The magnetic camera notices on the vehicle were missing, and the filmed road users were not given the information required by Art. 13 GDPR. There was also no data processing agreement with the company that carried out the test drives.
In total, the authority found four violations. Each one was rated as minor. Together they added up to a seven-figure fine.
What the case shows:
Gallio PRO runs as an application on Windows and macOS. For enterprise environments, an on-premise command line version is available for Linux. Footage does not have to be sent to an external cloud service.
Check | Legal basis | Done? |
Warning sign before the recorded area, with controller, purpose and retention period | Art. 13 GDPR | ☐ |
Full information available as a second layer | Art. 13 GDPR | ☐ |
Balancing test documented per camera zone | Art. 6(1)(f) GDPR | ☐ |
Retention period defined and technically enforced | Art. 5(1)(e) GDPR | ☐ |
Process for access requests with a one-month deadline | Art. 12 and 15 GDPR | ☐ |
A tool to blur third parties before disclosure | Art. 15(4) GDPR | ☐ |
Data processing agreements with all service providers | Art. 28 GDPR | ☐ |
Entry in the record of processing activities | Art. 30 GDPR | ☐ |
Operating in the UK as well? The rules there follow the UK GDPR and differ in detail. See our guide to CCTV rules and regulations in the UK .
Yes. Art. 13 GDPR requires that people are informed when their data is collected. For cameras, this is done with a sign that is visible before the monitored area. A pictogram without further details is not enough.
At minimum: the controller and contact details, the data protection officer if appointed, purpose and legal basis, the legitimate interest, the retention period and a reference to where the full information can be found.
No. Following the Federal Administrative Court ruling of 27 March 2019 (6 C 2.18), video surveillance by private bodies in Germany is governed by Art. 6(1)(f) GDPR.
Yes, if the requester appears in the footage and the footage still exists. The deadline is one month and can be extended by two months in justified cases.
No. Under Art. 15(4) GDPR, the copy must not adversely affect the rights of others. Faces and license plates of third parties must be blurred before disclosure.
Only as long as necessary for the purpose. The DSK names 72 hours as a reference value. Longer periods need a justification, for example an ongoing incident investigation.
For breaches of information duties and data subject rights, up to €20 million or 4% of worldwide annual turnover (Art. 83(5) GDPR). Volkswagen paid €1.1 million in 2022 for four violations rated as minor.
A warning sign costs a few euros. An access request that goes unanswered, or is answered with other people visible, can trigger proceedings before a German supervisory authority. The Volkswagen case shows that formal gaps become expensive once they add up.
Check your setup with the CCTV compliance check : nine questions, your result on the page, no email needed.
