How long can I keep camera footage from my business?
The GDPR itself does not specify a fixed retention period for camera footage. The regulation requires that personal data are not kept longer than necessary for the purpose for which they were collected, and leaves it to the organization itself to determine that period and to be able to explain it.
For camera monitoring on the work floor or in a shop or business hall, the Data Protection Authority applies in its guidelines a retention period of approximately four weeks as a starting point, unless there is a concrete reason to keep footage longer. This starting point is not literally in the law, but is the way the supervisory authority interprets the principle of data minimization for this specific situation. Anyone who routinely keeps footage for three months or longer without a reason for it deviates from this starting point.
Why four weeks and not longer
The purpose of camera monitoring is usually security: preventing theft, investigating break-ins, reconstructing incidents with staff or visitors. Once that purpose no longer applies, the basis for keeping the footage also disappears. Four weeks is considered the period in which an incident is normally noticed and reported: a cash discrepancy, a complaint, a damage claim. If you routinely keep footage longer, you must be able to explain why that is necessary for your situation, for example because checks only take place after a longer cycle.
When a longer retention period can be justified
There are situations in which a longer retention period can be justified. Think of footage that is part of an ongoing theft investigation, a dispute with a supplier where camera footage serves as evidence, or a request from the police in connection with a criminal case. In those cases, you do not keep the entire set of footage longer, but isolate the relevant fragment and delete the rest according to the normal retention period. It is best to document that selection, and the reason for it, at the time itself, not afterwards.
Cameras also belong in the processing register
Camera monitoring is processing of personal data like any other, and therefore should appear as a separate section in the processing register: with the purpose, the retention period, who has access to the footage and whether it looks outward (with the possibility of footage of the public road, which requires extra attention). Many entrepreneurs forget this section because it is not a SaaS tool or supplier, but their own system. In the knowledge bank where retention periods are researched for each situation camera monitoring appears as a separate topic alongside other frequently asked retention periods.
What if an employee or customer asks for the footage
A data subject who appears in the footage can request access. This is not an unusual request: it falls under the normal rights of data subjects. Practically, this means you must be able to show or hand over the footage in which the requester appears, with other people in the footage made unrecognizable. The shorter your retention period, the smaller the chance that you will have to organize this retroactively over a large amount of material.
Camera footage and a data breach
A separate point, but relevant nonetheless: if a hard drive with camera footage is stolen, a system is hacked or footage accidentally becomes widely accessible, that is in principle a data breach like any other. The question of whether it must be reported to the Data Protection Authority depends on the risk to the people in the footage. If you are uncertain about this, you can in five questions shows where you stand check it.
Security of the footage itself
Besides the retention period, it also matters who can access the footage. A system that anyone on the floor can access with a single password does not align well with the principle that access should be limited to those who genuinely need it. For more information about what is standard practice in this regard, see how data such as camera footage must be secured.
Whether your current retention period and access arrangements are appropriate for your specific situation is something you would best discuss with a lawyer or, if you have doubts about the notification obligation, with the Authority for Personal Data itself. If you would first like to get a picture of where camera monitoring belongs in your register and documentation, you can do the free quick-scan or read through the topics about personnel data and cameras.