Find the right approach
Video surveillance is an effective security instrument – but also a legal minefield. Is it allowed? What must companies consider? What rights do data subjects have? We provide a comprehensive overview of the current legal situation.
Why This Question Is Asked So Often
Few topics in the security sector cause as much uncertainty as video surveillance. The reasons:
- Overlapping laws: GDPR, Federal Data Protection Act (BDSG), state data protection laws, Works Constitution Act
- Different interpretations: Courts often decide differently
- Technological change: AI, facial recognition, mobile cameras – the laws are lagging behind
- High penalties: Fines up to €20 million or 4% of global annual turnover
The good news: Video surveillance is permitted – but only under certain conditions.
The Most Important Legal Bases at a Glance
| Legal Norm | What Does It Regulate? | Relevance for Video Surveillance |
|---|---|---|
| GDPR (Art. 6, 13, 15-22) | Processing of personal data (images are personal data) | High – core of the legal basis |
| BDSG (§§ 4, 26, 27) | National specifics, employee data protection | Medium – important for employee monitoring |
| State Data Protection Laws | Public authorities (agencies, schools, hospitals) | High for public clients |
| Works Constitution Act (§ 87) | Co-determination rights of the works council | High – without works council no monitoring of employees |
| House Rights | Of the owner or possessor | Basis for private surveillance |
When Is Video Surveillance Allowed? The 4 Central Requirements
1. Legal Basis (Art. 6 GDPR)
You must have a legal basis for processing. Relevant in practice are:
| Legal Basis | Example |
|---|---|
| Legitimate Interest (Art. 6 para. 1 f) | “I want to protect my company premises from break-ins.” |
| Contract Performance (Art. 6 para. 1 b) | “Video surveillance is agreed in the security contract with the client.” |
| Consent (Art. 6 para. 1 a) | “Visitors consent to video surveillance.” (Practically difficult to implement) |
| Legal Obligation (Art. 6 para. 1 c) | “Legally mandated surveillance (e.g. financial institutions).” |
Practical tip: In the commercial sector, “legitimate interest” is the most common legal basis. However, you must document it and carry out a balancing of interests.
2. Balancing of Interests (Art. 6 para. 1 f GDPR)
You must demonstrate that your interest in surveillance outweighs the data subjects’ interest in privacy.
Criteria for the balancing:
| In Favor of Surveillance … | Against Surveillance … |
|---|---|
| High risk of damage (e.g. jeweler, bank) | Low risk (e.g. small office without public traffic) |
| Specific incidents in the past (burglaries, thefts) | No incidents for years |
| Surveillance only at night or in sensitive areas | Permanent surveillance even in rest areas |
| Recordings are deleted after 48–72 hours | Storage for months |
Document your balancing in writing. In case of dispute, you must be able to present it.
3. Proportionality
The surveillance must be suitable, necessary and appropriate.
- Suitable: Does the camera achieve the desired goal (deterrence, securing evidence)?
- Necessary: Is there no milder means? (e.g. better lighting, mechanical security)
- Appropriate: The intensity of the surveillance (duration, number of cameras, location) must match the need for protection.
Typical violations of proportionality:
- Surveillance of toilets, changing rooms, break rooms (absolutely taboo)
- Permanent surveillance without reason
- Cameras that film into neighboring properties
4. Information Obligation (Art. 13 GDPR)
Every video surveillance must be clearly identifiable. This is not an optional but a mandatory requirement.
What the notice must include:
- Name and contact details of the controller (your company)
- Purpose of processing (e.g. “burglary protection”)
- Legal basis (e.g. “legitimate interest”)
- Storage period (e.g. “72 hours, then automatic deletion”)
- Reference to data subject rights (information, deletion, complaint)
Form of the notice:
- Signage at the entrance and in every monitored area
- Legible from a short distance (font size at least 2 cm)
- Pictogram with camera and text (not just symbol)
- Additionally online (privacy policy)
Practical tip: A small “Video surveillance” sign at the entrance is not enough. You need a detailed notice with all mandatory information.
Special Pitfalls
1. Employee Monitoring Is Severely Restricted
Monitoring of employees is only permitted in narrowly defined exceptions:
- Specific suspicion of a crime (no preventive surveillance)
- After balancing with the works council (co-determination right!)
- No covert surveillance (except in cases of specific suspicion and court order)
Absolute taboos: Permanent surveillance of workplaces, surveillance of break rooms and sanitary facilities, hidden cameras in the office.
2. Public Space Is Particularly Sensitive
Filming your property – permitted. Filming beyond that (pavement, street, neighboring property) – problematic.
- Align cameras so that only your own property is captured
- In case of unavoidable capture: masking of public areas (pixelation)
- Prohibited: Permanent surveillance of publicly accessible spaces without reason
3. Facial Recognition Is Almost Never Allowed
Biometric facial recognition is classified in the GDPR as a special category of personal data (Art. 9). It is only permitted when:
- Explicit consent of the data subjects (practically hardly feasible)
- Legal permission (e.g. in hazard prevention by police)
- Obviously public figures (celebrities? disputed)
Conclusion: Avoid facial recognition in commercial video surveillance – the risk is too high.
4. Covert Surveillance Is a Criminal Offense
The covert observation or recording of non-public conversations is punishable under § 201 of the German Criminal Code (StGB) (imprisonment up to 3 years). Exception: Specific suspicion of a crime and only with a court order.
Data Subject Rights: What Data Subjects Can Request
Anyone captured by your video surveillance has extensive rights:
| Right | What Does This Mean for You? |
|---|---|
| Right of access (Art. 15 GDPR) | Data subjects can request to know whether and which recordings of them exist. You must respond within one month. |
| Right to deletion (Art. 17 GDPR) | If the recordings are no longer needed or are unlawful, you must delete them. |
| Right to restriction (Art. 18 GDPR) | Data subjects can request that recordings are only stored but no longer used (e.g. in case of disputed lawfulness). |
| Right to lodge a complaint (Art. 77 GDPR) | Data subjects can lodge a complaint with the competent data protection supervisory authority. |
Practical tip: Maintain a processing register (Art. 30 GDPR). In it, document all cameras, purposes, deletion periods and legal bases. This makes providing information much easier.
The Most Important Fines & Penalties (Examples)
Supervisory authorities are increasingly taking action against violations:
| Violation | Possible Penalty |
|---|---|
| No warning signs | Fine up to €10,000 |
| Surveillance of toilets or changing rooms | Fine up to €50,000 + possibly criminal liability |
| Disproportionate permanent surveillance | Fine up to €20 million or 4% of annual turnover |
| Hidden cameras in the office | Imprisonment up to 1 year (pursuant to § 201 StGB) |
| No deletion after storage period | Fine up to €20 million |
Current examples from practice:
- Discount chain: €10.4 million fine for two years of unlawful employee monitoring
- Security service: €50,000 for missing warning signs at a gas station
- Office complex: €30,000 for surveillance of break rooms
Checklist for Your Video Surveillance
Check your system against these points:
- Legal basis defined and documented (e.g. legitimate interest)?
- Balancing of interests carried out in writing?
- Proportionality checked (no permanent surveillance without reason, no sensitive areas)?
- Warning signs placed in every monitored area (with all mandatory information)?
- Works council involved (if employees are captured)?
- Processing register maintained?
- Deletion concept implemented (automatically after 48–72 hours, if no incident)?
- Data processing agreement with the security service provider (if external)?
- No facial recognition in use (or legally secured)?
- No hidden cameras?
- Technical measures (encryption, access protection, logging)?
Special Case: Video Surveillance by Security Service Providers
If you as a security service provider operate video surveillance for a client, you are a data processor (see our article on order processing). This means:
- Data processing agreement (DPA) with the client is mandatory
- Instruction-bound: You may only do what the client permits
- Information obligation is the client’s responsibility (but you must advise them)
- Deletion concept must be defined in the DPA
Practical tip: Turn down clients who want unlawful video surveillance (e.g. hidden cameras). Otherwise, you may be committing an offense yourself.
Conclusion: Permitted, but with Clear Rules
Video surveillance is permitted in Germany – but only under strict conditions:
- Clear legal basis + documented balancing of interests
- Proportionality (no permanent surveillance without reason, no sensitive areas)
- Good warning signs (not just a small symbol)
- Respect for data subject rights (information, deletion, complaint)
- No covert surveillance (punishable)
Those who follow these rules can use video surveillance as an effective security instrument. Those who ignore them risk high fines, loss of trust and, in extreme cases, even imprisonment.
Do you have questions about legally compliant video surveillance in your company? We advise you discreetly, practically and with many years of experience in the security industry – from conception to implementation.
Note: This article does not replace legal advice. The legal situation may change, and individual cases should be reviewed by a lawyer specializing in data protection law.