Is your CCTV footage a privacy problem?
Nine questions on GDPR, UK, US and Canadian rules. Your result on this page, no email needed.
Download the free demoWhere does your organization operate?
The GDPR, UK GDPR and national law diverge on exactly the questions below, and outside Europe the rules are different again. The Polish position on license plates in particular is contested.
What kind of footage do you hold?
Different sources carry different expectations of privacy, and different retention norms.
Does it capture recognizable faces?
A recognizable face makes the footage personal data. Every obligation below follows from that one fact.
Does it capture car license plates?
A car number plate is personal data wherever it can be linked to an individual, and treatment differs by country.
Could it show children, patients or monitored staff?
This is where footage can become sensitive data: health information is a special category under GDPR Article 9, children's data attracts heightened protection, and monitoring staff brings consultation duties, works council agreements in Germany among them.
Who do you share footage with?
This is where most enforcement actually happens. Handing over unredacted footage exposes everyone else in frame, and sharing inside the organization counts, for example with health and safety or training. Choose every one that applies.
Where must the footage be processed?
Some organizations cannot send footage to a third-party cloud at all, whether for policy, procurement or security reasons.
How do you redact footage today?
Manual redaction is expensive and takes time. Standard blurring can sometimes be reversed, and reversible anonymization is not anonymization.
How much footage do you handle each month?
Volume changes what is practical. Manual redaction stops being viable long before most teams admit it.
What the law says about CCTV footage
- A recognizable face, or a car license plate that can be linked to a person, is personal data under GDPR Article 4(1). Recording it is processing.
- GDPR Article 5(1)(c), data minimization, is one of the articles CCTV fines cite most often: cameras or retention beyond what the stated purpose needs.
- GDPR Article 15 gives anyone the right to a copy of footage showing them. You must provide it, and you must not hand over other people in frame. Redaction is how both are met.
- In the United Kingdom the same duties apply under the UK GDPR and the Data Protection Act 2018, supervised by the ICO. Our guide to CCTV rules and regulations in the UK goes through them.
- In Poland the GDPR applies as RODO, supervised by UODO. In Germany it is supplemented by the BDSG and state data protection laws, and workplace cameras usually need works council involvement. In France and Spain the GDPR applies with national provisions, supervised by the CNIL and the AEPD.
- In the United States there is no single federal privacy law for video. Illinois BIPA covers biometric identifiers such as face geometry, Texas has its CUBI Act, and the California CCPA covers personal information including footage.
- In Canada, PIPEDA applies to commercial organizations, with separate provincial laws in Quebec, Alberta and British Columbia.
- The EDPB Guidelines 3/2019 on processing personal data through video devices are the EU-wide reference for signage, retention and disclosure.
- Blurring counts as anonymization only if it cannot be reversed. Standard blur or pixelation can sometimes be undone, so the method has to be documented and tested. Our article on sharing surveillance footage legally covers the practical side.
What this has cost other organizations
Five decisions by European data protection authorities, each linked to the authority's own publication. The check above surfaces the two that match your answers.
A customer injured in store asked for footage of their own accident. The request never reached the DPO and the recording was deleted before it could be provided. The cameras were not the problem. Answering the request was.
aepd.es, AEPD (Spain) resolution PS/00267/2021 (PDF)CCTV, ANPR and drones used in public places with no lawful basis. The DPC found breaches in 50 separate instances and temporarily banned traffic-management CCTV processing until a legal basis could be identified.
dataprotection.ie, decision 03/SIU/2018 (PDF)81 cameras covering work areas, warehouses and break areas for around two years, with recordings kept 60 days, far beyond the 48 to 72 hours German regulators regard as normal. Cut to 700,000 EUR by the Hannover court, then raised to 900,000 EUR by the Celle appeal court in 2025; the violations were upheld at every stage.
edpb.europa.eu, Lower Saxony decisionCameras concealed in the store's stockrooms to monitor staff covertly.
edpb.europa.eu, CNIL decisionOf 83 sanctions the CNIL issued in 2025, 16 concerned workplace CCTV. The recurring pattern: staff filmed continuously at desks and tills with no exceptional justification.
cnil.fr, sanctions and corrective measures 2025Sources checked 2 October 2026. Enforcement cases quoted from the publishing authority; amounts as at the date of the decision.
Not legal advice. This assessment is for general information and to help you spot where visual data may create risk. It does not constitute legal advice and creates no professional relationship. For your specific obligations, involve a qualified privacy or data protection adviser and, where appropriate, carry out a privacy impact assessment, called a DPIA under the GDPR.
Blurring should not be the hard part
Gallio PRO detects faces and license plates and masks them irreversibly, on Windows, macOS, or Linux. The footage never leaves your environment.
Download the free demo