CCTV in Spain: AEPD Rules on Signage, Footage Access and the €12,000 Fine for a Madrid Supermarket

TL;DR: In Spain, the CCTV sign is the easy part. What the Spanish data protection authority (AEPD) fines is what happens next: who sees the footage, how it is handed over and whether other people appear in it. A Madrid supermarket paid €12,000 after a cashier sent a checkout video showing other customers via WhatsApp. For DPOs, compliance and IT. Gallio PRO automatically blurs faces and license plates. Check your setup with the CCTV compliance check : nine questions, your result on the page, no email needed.

Who this guide is for

This article describes the situation in Spain. It is written for companies headquartered elsewhere that run stores, warehouses, offices or sites in Spain, and for their data protection teams.

The GDPR applies across the EU, but Spain adds its own layer: the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) and the Organic Law 3/2018 on Data Protection and Digital Rights (Ley Orgánica de Protección de Datos y garantía de los derechos digitales, LOPDGDD). The Spanish terms appear in brackets so you can match them to local documents and advisers.

A sign does not protect you if what follows fails

Many companies download a "zona videovigilada" (CCTV area) sign, hang it at the entrance and consider the job done.

The case below shows the opposite. The fined supermarket said it had signs at every entrance. The fine did not come from the sign, but from how the footage was handled when it was needed.

Risk concentrates at three moments:

• Before recording: the sign and the information given to employees.
• During retention: who can view the footage and how long it is kept.
• At disclosure: to whom, through which channel and with which third parties visible.

What the law says: Article 22 LOPDGDD

Video surveillance for security purposes in Spain is governed by the GDPR and by Article 22 of the LOPDGDD:

• Purpose (Art. 22(1)): protecting the safety of people, property and premises.
• Public roads (Art. 22(2)): may be recorded only to the extent strictly necessary for that purpose.
• Retention (Art. 22(3)): footage is deleted within one month at most, unless it must be kept to prove acts against people, property or premises. In that case, it must be made available to the competent authority within 72 hours of becoming aware of the recording.
• Information (Art. 22(4)): fulfilled by an information sign placed in a sufficiently visible location.

Obligation 1: The "zona videovigilada" sign

Under Article 22(4) LOPDGDD, the sign must at least identify:

• The existence of the processing
• The identity of the controller
• The possibility of exercising the rights in Articles 15 to 22 GDPR

The sign may include a QR code or web address with the remaining information. The controller must keep the full Art. 13 GDPR information available to those affected. The AEPD publishes a sign template on its website, which should be completed with the company's real details: a downloaded template left blank informs no one.

If you record employees, Article 89 LOPDGDD adds three rules:

• Employees and, where applicable, their representatives must be informed in advance, expressly, clearly and concisely.
• No cameras or sound recording in changing rooms, toilets, canteens or similar rest areas.
• Sound recording is allowed only where there are significant security risks, and only proportionately.

Obligation 2: Controlled access and secure disclosure

Art. 32 GDPR requires technical and organizational measures appropriate to the risk. Its paragraph 4 requires that anyone with access to the data processes it only on the controller's instructions.

For video surveillance, that means very concrete questions:

• Who can see the monitor and export recordings?
• Is every viewing and every export logged?
• Through which channel is footage handed over, and never through a personal messaging app?

When a customer asks for their footage, they are entitled to a copy (Art. 15 GDPR). The deadline is one month, extendable by two months in complex cases (Art. 12(3)). But Art. 15(4) states that the copy must not adversely affect the rights of others. The European Data Protection Board (EDPB) Guidelines 3/2019 point to the solution: blur or mask third parties before handing over the copy.

The Madrid supermarket case: €12,000 for a video sent via WhatsApp

The AEPD closed proceedings EXP202407160 against NOVATES ALIMENTACIÓN MADRID, S.L., which runs a supermarket in Madrid ( source: AEPD decision PS/00345/2024, in Spanish).

The facts, according to the decision:

• A customer had returned a product. Later, staff told her the refund had been processed incorrectly and that she had to pay back part of the amount.
• To prove it, a cashier showed her a video from the camera covering the checkout on her own phone, then sent it via WhatsApp to the customer's personal phone.
• The 40-second video was a phone recording of the CCTV monitor. The voices of two people commenting on the footage could be heard.
• Besides the customer, two other customers appeared: the person ahead of her in the queue throughout the recording and another customer entering the store.

The company argued that it had information signs at every entrance and that the customer herself had asked for the video and provided her number. The AEPD still found a breach of Art. 32 GDPR: the footage was accessible to employees whose role in surveillance was not demonstrated, it was re-recorded with a second device and it was shared without any security measures.

The initial fine was €20,000. The company acknowledged responsibility and paid voluntarily on 11 April 2025, which triggered two 20% reductions and a final amount of €12,000. The AEPD also ordered the company to adopt security measures for its CCTV footage within one month.

What the case shows:

• Having signs does not prevent a fine if access to footage is not controlled.
• A customer asking for the video does not authorize sending it any way you like, or with other people visible.
• Disputes over returns and refunds are routine in retail. See how to handle them in our article on CCTV footage in customer disputes .
• You do not have to be a large chain: according to the decision, the company had a turnover of about €6.1 million.

Breaches of Art. 32 GDPR fall under Art. 83(4): up to €10 million or 2% of worldwide annual turnover. Breaches of principles and data subject rights fall under Art. 83(5): up to €20 million or 4%.

How to hand over CCTV footage to a customer in Spain in 5 steps

1. Route the request. Ask for the request to come through the rights channel shown on the sign, not at the till. Record the date: the one-month deadline starts that day. Verify identity and ask for date, time and location.
2. Export the clip from the system. Only an authorized person exports the clip from the video management system, never by filming the screen with a phone. Do it before the one-month retention limit and log it.
3. Blur third parties. Load the clip into Gallio PRO . The software automatically detects faces and license plates and blurs them. Face detection does not identify anyone; it only finds image areas that contain faces. Make sure the requester stays recognizable: only third parties are blurred.
4. Edit manually where needed. Name badges, till screens with data, documents and logos are not detected automatically. Mark them by hand in the built-in Gallio PRO editor. Also check reflections in glass and shop windows.
5. Deliver through a secure channel and document it. Use a corporate channel with controlled access, not a personal messaging app. Log who handed over which clip, when and what was blurred.

Gallio PRO runs as an application on Windows and macOS. For enterprise environments, an on-premise command line version is available for Linux. Footage does not have to be sent to an external cloud service. See how a large retail chain uses it in the Plodine case study .

Checklist for camera systems in Spain

Check	Legal basis	Done?
Visible sign stating the processing, the controller and data subject rights	Art. 22(4) LOPDGDD	☐
Full information available (web, QR code or reception)	Art. 13 GDPR	☐
Employees informed in advance and expressly	Art. 89(1) LOPDGDD	☐
No cameras in changing rooms, toilets or canteens	Art. 89(2) LOPDGDD	☐
Public road recorded only where strictly necessary	Art. 22(2) LOPDGDD	☐
Deletion within one month at most	Art. 22(3) LOPDGDD	☐
Monitor access and exports limited to authorized staff	Art. 32(4) GDPR	☐
Access request process with a one-month deadline	Art. 12 and 15 GDPR	☐
A tool to blur third parties before disclosure	Art. 15(4) GDPR	☐
Delivery through a secure channel, never personal messaging	Art. 32 GDPR	☐

Frequently asked questions

What must a CCTV sign in Spain contain?

At least the existence of the processing, the identity of the controller and the possibility of exercising the rights in Articles 15 to 22 GDPR (Article 22(4) LOPDGDD). It may add a QR code or web address with the remaining information.

Is a CCTV sign mandatory in Spain?

Yes. It is how the LOPDGDD considers the duty to inform fulfilled. It must be placed in a sufficiently visible location before the recorded area.

How long can CCTV footage be kept in Spain?

One month at most from recording. If it proves an act against people, property or premises, it can be kept, but it must be made available to the competent authority within 72 hours.

Can a customer request CCTV footage from a shop in Spain?

Yes, through the right of access in Art. 15 GDPR. The company must answer within one month and blur other people who appear before handing over the copy.

Can CCTV footage be sent via WhatsApp?

It is not a secure channel for this processing. In the Madrid supermarket case, sending a phone-recorded video via WhatsApp was part of the facts fined €12,000.

Can a company in Spain record its employees?

Yes, for workplace monitoring purposes, if employees are informed in advance and expressly (Article 89 LOPDGDD). Never in changing rooms, toilets or canteens.

What fines can the AEPD impose for CCTV breaches?

For security failures (Art. 32 GDPR), up to €10 million or 2% of worldwide annual turnover. For breaches of principles or rights, up to €20 million or 4%. The Madrid supermarket paid €12,000 after two 20% reductions on an initial fine of €20,000.

Conclusion

The "zona videovigilada" sign is the first step, not the last. The AEPD looks at who accesses the footage, how it is exported and whether the copy a customer receives exposes other people. The Madrid supermarket case shows that a single improvised video is enough to end in a fine.

Operating outside Spain as well? National rules differ from country to country, even under the same GDPR.

Check your setup with the CCTV compliance check : nine questions, your result on the page, no email needed.