Video surveillance in business premises: retention, access and information rights

Cameras at an entrance or checkout may protect people and property. Video surveillance is not lawful merely because a shop is open to the public or because an incident occurred in the past. The purpose, viewing area, legal basis, notice, retention period and access rules must fit together.

This article addresses business video surveillance in a shop. It focuses on recordings, short retention, protection against unauthorised access and data subject requests. Employee monitoring, a personal data breach and general security management are separate questions. The broader framework is outlined on the data protection governance page.

A camera should not operate simply because the equipment is available. The business must define the specific purpose, such as protecting an entrance, checkout or particular goods. That purpose determines which area may be covered and which recording is actually necessary.

For private video surveillance, the possible bases include consent, a specific legal rule or overriding legitimate interests. In a shop, the protection interest must be balanced against the interests and fundamental rights of the people recorded. Articles 5 and 6 GDPR require purpose limitation, data minimisation and a valid legal basis. A general reference to security does not replace that assessment.

Section 12 of the Austrian Data Protection Act adds specific rules for image processing. Under certain conditions, recording may be permitted to protect people or property on premises used exclusively by the controller or at publicly accessible places subject to the controller’s house rules. Image recording for employee control is expressly prohibited. The legitimate interests overview is therefore only a starting point, not an automatic approval.

The camera view must be limited to the protected area. An entrance may require a different assessment from a staff room, office or pavement outside the shop. Review the angle, zoom, resolution and digital masking. A limited unavoidable view of a public area is not the same as broad observation of the street.

People must be able to recognise the processing. Section 13 of the Austrian Data Protection Act generally requires suitable signage that identifies the controller unless the controller is already known in the circumstances. Article 13 GDPR also requires understandable information about the processing. A small sign without clear information about the controller, purpose and further notices may not be sufficient.

Keep a camera plan, a description of viewing angles and the notice wording. If the checkout, entrance or sales area changes, update the documentation. Data protection by design provides a useful starting point for the technical planning.

The GDPR requires storage limitation. Recordings may therefore show identifiable people only for as long as necessary for the defined purpose. Indefinite storage is not an appropriate default. The business should not only enter a number in a policy, but explain the period by reference to the protection interest and the shop’s actual processes.

Section 13(3) of the Austrian Data Protection Act requires the controller to delete recorded personal data once it is no longer needed for the purpose and no statutory retention duty applies. Retention beyond 72 hours must be proportionate, separately logged and justified. The 72-hour reference is therefore not a general permission for every recording and not an automatic entitlement to a particular period.

A relevant extract may be secured for a specific incident. Record the reason, scope, access and further retention. Routine recording should not continue indefinitely merely because one extract is needed. The storage limitation rule should be connected to deletion and clear responsibility.

Video recordings are not a freely available internal information source. Define who may view, export or delete recordings and for which reason. Access must be protected against unauthorised use. Shared passwords, exposed monitors and automatic forwarding to private devices are inconsistent with controlled access.

Section 13 of the Austrian Data Protection Act requires suitable security measures to prevent unauthorised access to or later alteration of recordings. Except for real-time monitoring, every processing operation must be logged. The log should show who accessed or otherwise processed a recording, when and for what reason.

The overview of technical and organisational measures can help structure the controls for the camera system. Maintenance, cloud storage and other suppliers require a separate role and contract assessment. The work does not end with purchasing the camera.

Under Article 15 GDPR, data subjects may ask whether personal data concerning them is being processed and may request a copy of that data. For recordings, the business must verify identity sufficiently, identify the relevant period and area, and consider the rights of other people who appear in the footage.

Providing the entire video file is not automatically required. Redaction or another format may be necessary where other people are identifiable. The right of access must not, however, be defeated by a blanket redaction or a general statement that the work would be too difficult. The right of access and the preparation of a copy must be assessed for the individual request.

Record receipt, identity checks, the relevant period, search results, redactions, transmission method and deadline. Article 12(3) GDPR generally requires a response within one month. An extension of up to two further months may be possible because of complexity or the number of requests, but it must be communicated with reasons in time. The access request checklist helps structure the record.

The camera runs without a specific purpose: A general security phrase does not explain the viewing area or necessity of recording.

Retention is indefinite: Routine footage does not become lawful simply because the system has enough storage.

Employees are monitored continuously: Image recording for employee control is prohibited under Section 12 of the Austrian Data Protection Act.

Only the sign is reviewed: The notice and Article 13 GDPR information must match the purpose, legal basis and actual processing.

Access remains invisible: Missing permissions and logs make review difficult and cannot prevent unauthorised use.

We assess purpose, camera plan, legal basis, notices, retention, deletion, permissions, logging and the process for access requests. If you are planning new cameras or reviewing an existing system, you can provide the current documentation and a description of the business premises. Subscribe to legal news and receive new legal updates from the firm.