Cameras in Stores and Offices: Monitoring Customers and Guests

How to determine the purpose of cameras, prepare information, and restrict access to recordings.

Status checked: November 2, 2026. We are not a law firm. The material is for informational and educational purposes and does not constitute individual legal advice. Before implementing solutions, check current regulations and consult a specialist about your specific situation.

Purpose of the Camera

The administrator should define a specific purpose, e.g., property protection, and assess whether monitoring is necessary and proportional. The view of the cameras should not cover more than needed. Employee regulations may coexist with obligations towards customers and other individuals present on the company's premises.

Information Before Entering the Monitored Area

A person should be able to understand the monitoring and learn the most important information before entering the camera-covered area. Layered information can combine clear signage with a more comprehensive clause available in an appropriate location. A pictogram alone without data about the administrator, purpose, and how to obtain further information may not be sufficient.

Recording, Access, and Retention

Define the individuals authorized to view the recordings, the method of securing the recordings, and the justified retention period. There is no universal time frame for all cameras and all administrators. When monitoring includes the workplace, additionally check the specific rules of the Labor Code. A request for access to data from the recording also requires an assessment of the rights of other visible individuals.

Example of a Store

A camera at the checkout and entrance may cover customers and employees. Before installation, document the field of view, necessity, and retention plan, check the information for entering individuals, and the rules for employees. Assess separately the service provider's access to recordings and the need for a data processing agreement.

How to Prepare Information at the Entrance

On the first layer of information, indicate at least that the area is monitored, who the administrator is, and where to find the remaining information. The message should be noticeable before entering the camera area. The more comprehensive information should include elements required by GDPR, tailored to the actual processing.

Example: a shopping center operator runs a system in common areas, while the store tenant has their own cameras. It is necessary to establish the roles and purposes of both entities and then explain to entering individuals who is responsible for each system. Simply placing one sign does not determine responsibility for all recordings.

Action List

1. Create a map of cameras and purposes.
2. Minimize the area and data and secure access.
3. Place information before entry and provide a more comprehensive clause.
4. Establish retention, handling of requests, and incidents.

Sources