No, not entirely. The GDPR is a European regulation and applies directly in every Member State, so the basic principles are the same everywhere: a purpose for the processing, a legal basis, information to the data subjects and a retention period that is no longer than necessary. But the regulation deliberately leaves room for national legislation on a number of points, and employee camera surveillance is one of the clearest examples of this.
In practice, this means that a camera system that has been arranged with the works council in the Netherlands is not automatically permitted in the same way in Germany or Belgium. The GDPR itself does not prescribe exactly how camera surveillance on the work floor should be set up; that is left to the Member States and their own employment law. Anyone with staff or a location in multiple EU countries should therefore check per country what additional rules apply.
What the GDPR does standardise
The core of the GDPR is identical in every EU country: the legal bases for processing, the rights of data subjects such as access and erasure, the obligation to notify in the event of a data breach and the requirement that processing is proportionate. A Dutch entrepreneur who already has this in order for his head office does not start from scratch once he is also active in another EU country. The obligation to maintain a record of processing activities, for example, applies in the same way everywhere. examined by subject how the rules work in detail provides a good starting point for this, even if it concerns a specific situation abroad.
Why camera surveillance differs per country
The GDPR gives Member States explicit room in Article 88 to establish their own, more specific rules for the processing of employee personal data, provided those rules contain appropriate safeguards. Countries have made different use of that room. In Germany, there is additional national legislation that binds camera surveillance on the work floor to stricter conditions, with a strong role for employee participation. In Belgium, the role of the works council and the employment regulations in the introduction of camera surveillance is also explicitly regulated. The Netherlands has its own framework, including through the employee participation act.
The result is that the same camera, with the same purpose, may or may not be permitted to hang as you are accustomed to in one country compared to another. This is not a matter of a single setting error in the camera, but of a different national framework around it: who must be consulted, what information employees must receive in advance, and how long images may be retained.
Employee data: not just cameras
The same applies more broadly to employee data. Absence recording, performance appraisals, salary administration: the GDPR sets the frameworks, but Member States fill in some details themselves, often in combination with their own employment law. A retention period that is customary in the Netherlands for application data does not automatically have to be the same in another country, because national tax and employment law rules also play a role. This is one of the reasons why a record of processing activities drawn up for the Netherlands deserves supplementation rather than a simple copy when activities are conducted abroad.
What this means for your registration
For most SMEs with only a Dutch location, this changes nothing: your own rules apply just as you already know them. As soon as you have staff, a branch or customers in another EU country, it is advisable to check what additional national rules apply there for camera surveillance and personnel data, for example via the local supervisory authority or a lawyer familiar with that legal system. A Dutch processing register remains the starting point, but the country-specific part requires separate attention.
If you are unsure whether an existing processing activity, such as camera surveillance, also fits a data breach scenario, it helps to first check whether there is a reportable situation. You can check this in a few questions with a direct indication, regardless of the country in which it takes place. And anyone who wants to know exactly where the information on gdpria.eu comes from and how it aligns with the official texts, reads that explained on the page about our approach.
Do you want to get a picture of where you stand for your own business, in the Netherlands or elsewhere? Take the free quick-scan or browse through the knowledge bank; both can be consulted without an account and provide a brief answer per topic with the source included.