GDPR CCTV-Konformität für EU-Einzelhandelsgeschäfte: Ein praktischer Leitfaden für Geschäftsführer in 2026

If you run a retail shop, café, restaurant, or any business with a physical premises in the EU, you almost certainly have CCTV. And if you have CCTV, the GDPR applies to you — whether you have thought about it or not.

The consequences of getting this wrong are not theoretical. Data protection authorities across the EU have issued fines to retail businesses for a range of violations: retaining footage for longer than necessary, failing to inform customers about cameras, capturing more public space than justified, and using footage for purposes that go beyond what customers were told.

This guide is built for retail business owners who want to get compliance right — not just avoid fines, but build a system that genuinely protects their business, their customers, and their employees.

Does the GDPR Actually Apply to My Shop?

Yes. The GDPR applies to any business that processes personal data — which means any business that records footage of identifiable individuals. A CCTV camera that captures customers entering your shop, staff working on the shop floor, or anyone on your premises is processing personal data under the GDPR.

This applies regardless of:

– The size of your business (the GDPR applies to businesses of all sizes)

– Whether you actively look at the footage or it just records automatically

– Whether you have ever had an incident that required the footage

– Whether you are a one-person shop or a chain

The moment you install a camera, you become a data controller under the GDPR — responsible for how that footage is collected, stored, used, and eventually deleted.

There is one common misconception that needs to be addressed: the idea that cameras facing only inward, in a space you own, means the GDPR does not apply. This is incorrect. The GDPR applies to processing of personal data in the context of a business activity. A shop is a business activity. Customers and employees filmed on that premises are identifiable individuals. The GDPR applies.

What Lawful Basis Do I Need?

Every CCTV system needs a documented lawful basis for processing. For most retail businesses, this will be legitimate interests (Article 6(1)(f) GDPR) — the interest in protecting your property, preventing theft, ensuring staff safety, and investigating incidents.

The question is not whether you have a legitimate interest — most retail businesses clearly do. The question is whether your specific use of CCTV is proportionate to that interest. This is where many businesses fall short.

Consider two scenarios:

Scenario 1: A shop installs cameras at the entrance, the tills, and the stock room — all clearly aimed at preventing theft and protecting property. The entrance camera captures a narrow view of the door. The till camera covers the counter area. The stock room camera covers the storage area. This is proportionate to the stated purpose.

Scenario 2: The same shop installs wide-angle cameras that capture the entire shop floor, the public pavement outside the entrance, and the windows of the neighbouring business. It also has a camera in the break room. This is almost certainly disproportionate. The cameras capture areas and people that have no connection to theft prevention. The break room camera raises additional concerns about employee privacy.

The test is simple: would a reasonable customer accept being filmed in this location for this purpose? If the answer is yes, the camera is likely proportionate. If the answer is no, it probably is not.

Where Can I Legally Place Cameras?

The EDPB’s Guidelines on Video Surveillance set out the EU-wide framework. Within that framework, camera placement decisions should follow this logic:

Generally Permitted in Retail

– Eingangs- und Ausgangspunkte — who entered, when, and in what direction

– Till and payment areas — der Ort mit dem höchsten Risiko für Diebstahl und Streitigkeiten

– Lagerräume und Hinterhausbereiche — Schutz des Inventars

– Interne Korridore und Treppenhäuser — Sicherheit und Zugangskontrolle

– Außenbereich und Parkplätze — Eigentumsschutz

– Kundenbereich im Verkaufsraum — wenn durch Diebstahlrisiko oder Sicherheit gerechtfertigt

Generally Prohibited

– Toiletten und Umkleideräume — kategorisch verboten

– Personalpausenräume — Mitarbeiter haben eine berechtigte Erwartung an Privatsphäre während der Pausen

– Jeder Bereich, in dem Kunden eine spezifische Privatsphäreerwartung haben — Umkleidekabinen, Beratungsbereiche, Apothekentheken

Capturing Public Pavements

Dies ist einer der häufigsten Compliance-Verstöße im Einzelhandel. Eine Kamera, die am Eingang eines Geschäfts positioniert ist, wird unweigerlich Teile des öffentlichen Bürgersteigs außerhalb erfassen. In den meisten Fällen ist dies akzeptabel, wenn es beiläufig ist – die Kamera ist auf den Eingang, nicht auf die Straße gerichtet, und die Aufnahmen des Bürgersteigs sind ein Nebeneffekt und nicht der Zweck.

Kameras, die jedoch so positioniert sind, dass sie breite Ansichten öffentlicher Straßen, Fußgängerbereiche oder öffentlicher Räume jenseits des unmittelbaren Ladeneingangs erfassen, erfordern eine zusätzliche Rechtfertigung. Je mehr öffentlichen Raum Sie erfassen, desto schwieriger ist es zu argumentieren, dass die Überwachung verhältnismäßig ist.

Praktische Regel: Wenn Ihre Kamera mehr als etwa 2–3 Meter öffentlichen Bürgersteigs jenseits Ihres Eingangs erfasst, prüfen Sie, ob der Winkel angepasst werden kann, um dies zu reduzieren. Privacy Masking – Software, die bestimmte Bereiche der Kameransicht ausblendet – ist ein praktisches Werkzeug, um ungewollte Erfassung zu reduzieren.

The Signage Requirement: More Than Just a Sign

Die UK GDPR verlangt, dass Personen darüber informiert werden, dass CCTV in Betrieb ist, bevor sie aufgezeichnet werden. Für ein Einzelhandelsgeschäft bedeutet dies Beschilderung.

Die Leitlinien der ICO und des EDPB sind klar: Schilder müssen sein:

– Deutlich sichtbar — nicht hinter einem Regal oder in Kniehöhe versteckt

– Einfach zu verstehen — keine juristische Sprache oder Fachjargon

– An jedem Eingang vorhanden zum überwachten Bereich

Ein DSGVO-konformes CCTV-Schild sollte Kunden mitteilen:

1. Dass CCTV in Betrieb ist

2. Wer dafür verantwortlich ist (der Name des Unternehmens)

3. Der Zweck der Überwachung (Sicherheit, Diebstahlprävention, Sicherheit)

4. Wo sie weitere Informationen finden können (eine Datenschutzerklärung, eine Website, eine Kontaktnummer)

Example Compliant Sign

“`

CCTV in Betrieb

Diese Räumlichkeiten werden zu Ihrer Sicherheit, zur Verhinderung von Straftaten und zum Schutz von Eigentum durch CCTV überwacht.

Verantwortlicher: [Unternehmensname]

Weitere Informationen darüber, wie wir CCTV nutzen, finden Sie in unserer Datenschutzerklärung unter [URL] oder fragen Sie einen Mitarbeiter.

“`

Dieses Schild erfüllt die gesetzlichen Anforderungen. Es ist klar, identifiziert den Verantwortlichen und weist die Menschen darauf hin, wo sie weitere Informationen finden können.

Retention: The Area Where Most Retailers Fall Short

Dies ist die häufigste GDPR-Verletzung im Einzelhandel-CCTV und die einfachste zu beheben.

Die Regel ist absolut: Aufnahmen dürfen nicht länger als nötig aufbewahrt werden. Für einen typischen Einzelhandelsladen bedeutet dies:

– 30 Tage sind der praktische Standard. Die meisten Unternehmen haben keinen Grund, Aufnahmen länger als einen Monat aufzubewahren. Nach 30 Tagen sinkt die Wahrscheinlichkeit, einen bestimmten Vorfall aus den Aufnahmen zu identifizieren, erheblich, und das Prinzip der Datenminimierung erfordert eine Löschung.

– Eine längere Aufbewahrung erfordert eine spezifische Begründung. Wenn eine laufende Untersuchung, ein Streit mit einem Kunden oder ein aktiver Versicherungsanspruch vorliegt, dürfen Sie bestimmte Aufnahmen länger aufbewahren. Diese Aufbewahrung muss dokumentiert werden, und die Aufnahmen müssen gelöscht werden, sobald die Angelegenheit geklärt ist.

– Gewohnheitsbedingte Aufbewahrung ist nicht rechtmäßig. “Wir haben Aufnahmen immer sechs Monate lang aufbewahrt” ist keine Rechtfertigung. Aufbewahrungsfristen müssen auf tatsächlichem Geschäftsbedarf basieren, nicht auf dem, was Sie immer getan haben.

How to Implement Automatic Deletion

Die meisten modernen CCTV-Systeme unterstützen die geplante automatische Löschung. Konfigurieren Sie Ihr System so, dass es:

– Die ältesten Aufnahmen automatisch überschreiben, wenn der Speicher voll ist

– Alle Aufnahmen löschen, die älter als 30 Tage sind, es sei denn, bestimmte Aufnahmen wurden im Zusammenhang mit einer aktiven Untersuchung zur Aufbewahrung markiert

– Protokollieren Sie alle Fälle, in denen Aufnahmen über den Standardzeitraum hinaus aufbewahrt werden, und den Grund dafür

Wenn Ihr aktuelles System keine automatische Löschung unterstützt, ist dies eine Prioritätsaktualisierung. Manuelle Löschprozesse sind unzuverlässig – jemand muss daran denken, es zu tun, und in einem geschäftigen Einzelhandelsumfeld wird es irgendwann vergessen.

Can I Use CCTV Footage for Staff Monitoring?

This is a question many retailers have, and the answer requires care.

If you installed CCTV primarily for shop security — protecting against customer theft, vandalism, and property damage — using that same footage to monitor staff behaviour, check attendance, or gather evidence for disciplinary proceedings is a secondary purpose.

This is not automatically prohibited, but it is not automatically permitted either. The key question is whether your staff were informed that footage might be used for these purposes.

If your staff privacy notice, employment contracts, or induction materials clearly state that CCTV footage may be used for performance management and disciplinary proceedings, then using footage for these purposes is generally acceptable — provided it is proportionate to the original security purpose.

If staff were only told that CCTV was for “security”, using footage to monitor their behaviour or conduct a new investigation about something unrelated to security is likely to be challenged. The ICO guidance on this is clear: using security CCTV for staff monitoring without adequate disclosure is a potential violation of both data protection law and employment law.

Best practice: Include a clear statement in your employment contracts and staff privacy notice that CCTV may be used for security, safety, and — where proportionate and consistent with the original purpose — performance management and disciplinary purposes.

What About Audio Recording?

Many retail CCTV systems include audio — capturing customer conversations as well as video. In most EU jurisdictions, audio recording is subject to stricter rules than video.

Under UK GDPR, recording audio in a retail environment raises additional considerations:

– The Information Commissioner’s Office considers audio recording to be more privacy-intrusive than video alone, particularly when capturing private conversations

– Recording customer conversations without their knowledge may engage additional legal frameworks beyond the GDPR, including laws around interception of communications

– In a retail context, audio recording of customer interactions (at the till, during a refund, in a changing room) raises particular concerns about capturing sensitive personal information

Practical recommendation for most retailers: Disable audio recording unless you have a specific, documented reason to have it on, and have taken legal advice on your jurisdiction’s requirements.

Handling Requests for Footage

Under the GDPR, individuals have the right to access footage in which they appear. This is called a Data Subject Access Request (DSAR).

In a retail context, DSARs typically come from:

– Customers who believe they were treated unfairly and want to see what happened

– Former employees involved in disciplinary proceedings

– Individuals making a complaint about an incident in the shop

Responding to a DSAR involving CCTV footage requires:

1. Locating the relevant footage within the one-month response window

2. Reviewing the footage to identify other individuals who may need to be redacted

3. Editing the footage to obscure the faces and identifying features of unrelated third parties (or having a clear legal basis for disclosure without redaction)

4. Providing the footage in a format the requester can access

5. Documenting the response for accountability purposes

DSARs that involve CCTV footage of other customers create a practical tension: you have an obligation to provide the requester with footage of themselves, but you also have an obligation to protect the privacy of other individuals who appear in the same footage.

The ICO’s guidance is that where footage includes third parties who cannot practically be removed, the data controller may provide the footage with the third parties blurred — or may decline to provide the footage altogether if blurring is not feasible. Document the decision either way.

What to Do If Footage Shows an Incident

When CCTV footage captures what appears to be a crime — a theft, an assault, vandalism — the instinct is to hold onto it indefinitely. This is understandable, but it conflicts with your retention obligations.

The correct approach:

1. Secure the relevant footage immediately by downloading it to a separate, protected location

2. Document the download — time, date, who made the copy, and the reason

3. Flag the footage for extended retention — note the specific incident, the date, and the reason it is being retained beyond the standard period

4. Polizei kontaktieren if a crime has been committed and the footage may assist their investigation

5. Do not share the footage publicly — sharing identifiable footage of individuals on social media or with media organisations is a data protection violation in most circumstances

6. Delete the footage once the matter is resolved (criminal case concluded, disciplinary resolved, insurance claim settled, or confirmed no further action is needed)

Do I Need to Register With the ICO?

UK businesses with CCTV that processes personal data are required to pay the data protection fee to the Information Commissioner’s Office — currently £40 per year for small organisations using up to 10 CCTV cameras, or £60 for organisations with more complex processing.

This is a common oversight. Many small retailers are not aware they need to register. Not registering is an offence — and it is one that the ICO does actively enforce, particularly following complaints.

Registration is straightforward and can be completed online at the ICO website. The process takes 15–20 minutes and requires you to describe what CCTV data you process, why, and how long you retain it.

For EU businesses, the equivalent obligation is notification to the national data protection authority — though in most EU countries, this is incorporated into the GDPR compliance framework rather than being a separate registration fee.

Building Your CCTV Compliance Checklist

Work through this list before relying on your CCTV system:

Lawful basis and purpose:

– [ ] I have documented the specific lawful basis for my CCTV processing (legitimate interests)

– [ ] I have documented the specific purposes for which footage is used (security, theft prevention, safety)

– [ ] I have conducted a balancing test confirming that my monitoring is proportionate to these purposes

Camera placement:

– [ ] No cameras are placed in toilets, changing rooms, or staff break rooms

– [ ] Cameras do not capture more public space than is necessary

– [ ] I have considered using privacy masking to exclude unintended areas from recording

Transparenz:

– [ ] CCTV signs are displayed at every entrance to the monitored area

– [ ] Signs identify the business as the data controller

– [ ] Signs direct people to where they can find more information

– [ ] Staff have been informed about CCTV in writing (employment contract or privacy notice)

Beibehaltung:

– [ ] I have a documented retention period (30 days is the standard for most retail)

– [ ] Automatic deletion is configured and tested

– [ ] I have a process for flagging and retaining footage related to active incidents

Access and security:

– [ ] Only authorised staff can access CCTV footage

– [ ] CCTV systems are protected with strong passwords (changed from defaults)

– [ ] Firmware on CCTV hardware is kept updated

– [ ] I have a process for responding to DSARs within one month

Registration and documentation:

– [ ] I am registered with the ICO (UK) or the relevant national DPA (EU)

– [ ] I have a documented CCTV policy that is reviewed annually

– [ ] I have a record of who has access to the CCTV system and why

The Business Case for Getting This Right

Beyond avoiding fines, GDPR-compliant CCTV delivers genuine business value. Footage that is properly managed, retained for the right period, and accessible when needed is an effective tool for:

– Deterring opportunistic theft — both customer and employee

– Resolving customer disputes — a refund claim contradicted by footage, or a confrontation with no witnesses

– Supporting insurance claims — documented evidence of incidents, break-ins, or property damage

– Employee safety — cameras in cash handling areas and back-of-house protect staff

– Training — anonymised footage used to demonstrate good and poor practice

A system that is poorly managed — retaining too much footage, accessible to too many people, and not documented properly — fails on all of these counts. It exposes the business to regulatory action, provides poor-quality evidence when you actually need it, and creates unnecessary risk for staff and customers.

GDPR compliance is not a burden. It is the difference between a CCTV system that protects you and one that creates liability.

Need a CCTV system that is built for compliance? Wie man die beste versteckte Kamera in 2026 auswählt to explore our range of CE and RoHS-certified retail security cameras — designed for businesses that take both safety and data protection seriously.

---

Häufig gestellte Fragen

Does GDPR apply to my shop CCTV even if I am a small business?

Yes. The GDPR applies to all businesses of any size that process personal data, and CCTV footage of identifiable individuals is personal data. The size of your business, the number of cameras you have, and whether you actively review footage are all irrelevant to whether the GDPR applies. The obligations are the same for a corner shop as for a major retail chain.

How long can I legally keep CCTV footage?

The GDPR requires that footage not be kept longer than necessary. For most retail businesses, 30 days is the practical and defensible standard. Retaining footage for 6–12 months without a specific documented reason is not lawful. You may retain specific footage for longer if it relates to an active investigation, insurance claim, or legal proceedings — but this must be documented and the footage deleted as soon as the matter is resolved.

Where do I need to display CCTV signs?

You must display signs at every entrance to the area covered by CCTV — that means every door or entry point through which customers or staff enter a monitored space. Signs should be clearly visible, easy to understand, and include the name of the business as the data controller and information about where customers can read the full privacy notice.

Can I use my security CCTV footage in staff disciplinary proceedings?

Yes, in most circumstances — but only if your staff have been informed in advance that footage may be used for this purpose. This disclosure should be in their employment contracts and staff privacy notice. If staff were only told CCTV was for “security”, using footage for performance management or unrelated disciplinary investigations may be challenged. Be specific in your disclosure about the purposes for which footage may be used.

Do I need to blur other customers before sharing CCTV footage?

When a customer submits a DSAR for footage in which they appear, you have an obligation to provide that footage. Where the footage also shows other identifiable individuals who have not consented to disclosure, you should attempt to obscure their identities — by blurring faces, for example — before providing the footage. If obscuring is not feasible, document the decision and consider whether you have a lawful basis to disclose without redaction. Never share identifiable footage of uninvolved individuals without their consent unless you have a specific legal obligation to do so.

Can I record audio on my retail CCTV system?

In most EU jurisdictions, audio recording is subject to stricter rules than video. It is more privacy-intrusive and may engage additional legal frameworks. For most retail businesses, the safest approach is to disable audio recording unless you have a specific documented reason and have taken legal advice on your jurisdiction’s requirements. If you do record audio, it must be included in your signage, your privacy notice, and your retention policy.

Do I need to pay the ICO data protection fee?

UK businesses with CCTV that processes personal data are required to pay the data protection fee to the Information Commissioner’s Office — currently £40 per year for small organisations. Registration is mandatory and the ICO actively enforces this requirement. Businesses that fail to register risk criminal prosecution and a fine. Registration is straightforward via the ICO website and should be completed before you begin operating any CCTV system.