may I retain camera images of customers in my shop

Camera footage can be retained, but not indefinitely

Customer camera footage may be retained as long as there is a clear purpose behind it and the footage is not kept longer than necessary for that purpose. The typical purpose in a shop is security: preventing theft, burglary or violence against staff, and being able to investigate afterwards. For that purpose, in practice a retention period applies that is short — surveillance that after a few weeks has given no reason to set footage aside should as a rule be deleted. Camera footage is personal data as soon as a customer is recognizable in it, and with that, recording, retaining and viewing it fall under the GDPR, just like a customer file or an application dossier.

What the camera records must also be proportionate to the purpose. A camera that films the till and the entrance for security purposes stands on different ground than a camera that is continuously aimed at staff to monitor performance — the latter is a different purpose and requires a different assessment. Also, customers and staff must be able to know that cameras are present, usually via a clearly visible sign at the entrance, and that the footage is not simply used for a different purpose than that for which it was installed. Anyone who, in addition to security footage, also records other customer data, for example for a newsletter or a customer file, does well to assess those processing activities separately — the lawful basis and the retention period can differ per type of data.

Lawful basis and storage limitation from the GDPR

That there must be a valid lawful basis for filming customers follows from Article 6 of the GDPR, which describes the conditions for lawful processing; in shop security, the focus is usually on the legitimate interest of the business owner. That footage may not be retained longer than necessary for that purpose follows from the principle of storage limitation in Article 5 of the GDPR. These rules apply throughout the EU directly, because the GDPR is a regulation; what differs is the supervisory authority that monitors it in a Member State and any further guidance that authority provides — in the Netherlands that is the Dutch Data Protection Authority, which also publishes practical guidelines on camera surveillance. For the broader question which businesses fall under these rules, see the GDPR also applies to freelancers and small businesses; and for anyone wondering which lawful basis exactly applies to a specific processing, the options are explained at when may I process personal data.