ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Legitimate interests for CCTV is the lawful basis most businesses use for cameras on their premises, and it is also the basis most often used badly. Article 6(1)(f) of the GDPR allows processing that is necessary for legitimate interests, but only if those interests are not overridden by the rights and freedoms of the people who are filmed. That balance has to be worked out and written down, not assumed.
This guide walks through the three-part test as it applies to video surveillance, explains how to weigh security aims against privacy, covers signage, retention and access, and shows when a DPIA is needed. It is general information, not legal advice, and national rules on surveillance vary, so check local requirements.
Most CCTV is not based on consent, because people cannot meaningfully refuse to be filmed when they walk into a shop or an office lobby, and it is rarely required by law or by a contract with the individual. Legitimate interests fits because organizations do have real interests in preventing crime, protecting property and keeping people safe.
But the basis is not a blank cheque. Using legitimate interests for CCTV means you have accepted a duty to test the interest, prove the cameras are necessary and show that the impact on individuals is proportionate. Public authorities performing their tasks may have to rely on a different basis, so check which applies to you. Our overview of legitimate interests examples shows how the test works in other settings.
State the interest specifically. “Security” is too vague. “Deterring and investigating theft from the stockroom and protecting staff working alone at night” is better. The interest must be lawful, real and present, not speculative. Where you can, point to evidence such as recorded incidents, insurance requirements or a security risk assessment.
Free legitimate interests assessment
Can you rely on legitimate interests for this processing?
Check whether legitimate interests is available, set out the purpose, test necessity, weigh the impact on people from 25 scenarios and choose the safeguards that tip the balance. Built to GDPR Article 6(1)(f), free.
Different cameras may have different interests. A camera on a car park barrier serves a different purpose from one in a reception area. Record each one, because the balance can differ.
| Test | Question for CCTV | Example answer |
|---|---|---|
| Purpose | What legitimate interest are we pursuing? | Preventing theft and protecting staff |
| Necessity | Is filming needed, or would something less intrusive work? | Cameras at entrances and stockroom, not offices |
| Balancing | Do people’s rights outweigh our interest? | Areas with high privacy expectation excluded |
| Safeguards | What limits the impact? | Signs, short retention, restricted access |
Ask whether the same aim could be achieved with a less intrusive measure: better lighting, locks, access control, staff presence or a smaller number of cameras. If a measure would work as well without filming people, the cameras are hard to justify. Limit the field of view to what the purpose requires, and avoid recording sound unless there is a specific and strong reason, since audio is generally more intrusive than video.
Document the alternatives you considered and why they were rejected. This is the section a regulator will read most closely when a complaint arrives.
Weigh the impact on the people filmed against your interest. Consider who they are: customers, staff, children, vulnerable people. Consider where the cameras are: a shop floor has a lower expectation of privacy than a changing room or toilet, where cameras should never be placed. Consider what people would reasonably expect and how much data is captured.
Staff monitoring needs particular care because of the power imbalance. If cameras also watch employees, apply the reasoning in legitimate interests and employee monitoring and consult staff or their representatives where appropriate. Record the outcome and the safeguards that tipped the balance.
People must be told that CCTV is operating, who is responsible and how to contact them. Use clear signs at entrances and in the areas covered, with a contact point and a link or reference to a fuller notice. Explain the purpose and how long footage is kept.
Because the basis is legitimate interests, individuals have a right to object under Article 21, and you must consider objections on their merits. See legitimate interests and the right to object for how to handle these requests. People also have the right to request access to footage of themselves, so have a process to find, review and redact footage of other people.
Keep footage only as long as needed for the purpose. Many organizations use a short cycle, often a few weeks or less, unless an incident requires longer retention. Write the period down and make sure the system overwrites automatically. Restrict access to named people, log who views or exports footage and store it securely with encryption where possible.
Disclosures to police or insurers should follow a documented process with a written request. Avoid casual sharing of clips, especially on social media or messaging apps, which is a frequent source of complaints.
Systematic monitoring of a publicly accessible area on a large scale requires a DPIA under Article 35(3)(c). Even where it is not mandatory, a DPIA is good practice for extensive systems, for staff monitoring and for any use of facial recognition or analytics, which raise the risk considerably. Our guide to CCTV DPIAs explains the process, and when a DPIA is required sets out the wider triggers.
Where a DPIA is not required, a well-documented legitimate interests assessment covers most of the same ground. Keep the two aligned so decisions are consistent.
Typical failures include relying on the basis without any written assessment, filming areas such as toilets or staff rest rooms, missing or unclear signs, keeping footage for months without reason, recording audio by default, sharing clips informally and failing to respond to access or objection requests. Another is installing extra cameras over time without revisiting the assessment.
Review the assessment whenever the layout, cameras, purpose or technology changes, and at least annually. Our legitimate interests assessment example shows how to structure the record.
Special care is needed where cameras overlook shared spaces such as apartment corridors, neighbouring property or public streets. Coverage of areas beyond your own premises is hard to justify and can create complaints from neighbours. Angle cameras, use privacy masking and limit the field of view so that only your own entrances and property are recorded.
For temporary uses, such as construction sites or events, run a short assessment for each deployment rather than assuming an existing one applies. Legitimate interests for CCTV is always specific to the location and purpose, so reusing an old assessment for a new setting is a common way to end up with a gap.
If you use a third party to install or monitor the system, put a processor contract in place, confirm where footage is stored and check that the provider follows your retention settings.
Before you switch a camera on, walk the site with the manager and view the live feed. Check what each camera actually sees, not what the installer said it would see. Adjust angles, add privacy masks and record the results. Repeat the walk-through after any change, so the assessment always matches the system in place.
A small retailer suffers repeated stockroom thefts and installs four cameras: one at the stockroom door, one at the till, one at the rear entrance and one at the front door. The purpose is theft prevention and staff safety. Alternatives such as a lock and a staff sign-in sheet were tried without success.
The retailer excludes the staff room, sets footage to overwrite after 28 days, puts signs at all entrances, limits access to two managers and logs exports. The assessment is signed and reviewed each year. If a customer objects, the manager follows a written procedure to consider it. That level of detail is proportionate and defensible.
If you want a structured way to record the purpose, necessity, balancing and safeguards, the Legitimate Interests Assessment Report and Workbook provides a report and workbook that follow the three-part test, in line with the ICO guidance on legitimate interests. Whatever tool you use, good practice for legitimate interests for CCTV is to write it down, keep it proportionate and revisit it when things change.
Usually not. Consent is difficult because people cannot freely refuse to be filmed. Most organizations rely on legitimate interests and must document the balancing test.
Sometimes, but the balance is stricter because of the power imbalance. You need a clear purpose, transparency, proportionate coverage and often consultation with staff.
Only as long as needed for the purpose. Many organizations use a short overwrite cycle, with longer retention only when an incident requires it.
Large-scale systematic monitoring of public areas requires one, and it is good practice for extensive or intrusive systems, including facial recognition.
Yes. Where legitimate interests is the basis, individuals can object under Article 21 and you must consider their objection on its merits.
September 30, 2026
