Cameras are legal in restaurants, shops, and gas stations, but monitoring employee activity requires a few clear steps. The checklist below helps you quickly see what you have in place and what you might be missing.
Before You Start
- Purpose is clearly defined and documented: loss prevention, safety of assets and people.
- You’ve checked that less intrusive methods were not sufficient (required by national employment and data-protection rules).
- You’ve consulted the union or employee representatives, where applicable.
- You’ve carried out a Data Protection Impact Assessment (DPIA) if surveillance is systematic (GDPR, art. 35).
- Processing is recorded in your processing activities register (GDPR, art. 30).
Employee & Customer Notice
- Employees have received a clear, written notice before the system is activated.
- Visible signs are posted at entrances and in monitored areas.
- Customers are informed via the same signs and your privacy policy.
Camera Placement
- No cameras in changing rooms, restrooms, or break areas.
- Camera angles cover work and checkout areas, not private spaces.
- No facial recognition unless you have a clear legal basis.
Retention & Access
- Recordings are kept for a maximum of 30 days, except where law or justified incidents require otherwise (national employment and data-protection rules).
- Access to footage is limited to designated staff, with all accesses logged.
- Clips saved for incidents have a written reason and a retention date.
Vendors
- You have a data processing agreement (DPA) with the company installing or managing your system.
- You know where your data is stored and who has access.
For details on each point, read our guide to workplace video surveillance. If you work with us, we’ll help you prepare employee notices, policies, and the DPIA.
This checklist is for information only and does not replace legal advice.
FAQ
Do I need each employee’s consent for cameras?
No, the legal basis is usually the employer’s legitimate interest, not consent. However, you must fully inform employees in advance and comply with national employment and data-protection rules.
How long can I keep recordings?
The law allows a maximum of 30 days, except where expressly regulated or for justified cases, such as an ongoing investigation.
Is a DPIA mandatory?
GDPR requires it when processing involves systematic monitoring of a space or individuals. Ongoing employee surveillance typically falls under this category.
See also: Fast Food · Retail & Supermarkets · Loss Calculator
Want to know your business’s real loss figure?
Request a demo
