CCTV and GDPR in Ireland: Rules for Businesses (2026)
Last updated 23 October 2026. General information only, not legal advice.
CCTV footage of identifiable people is personal data, so an Irish business that runs cameras must comply with the GDPR and the Data Protection Act 2018. In practice that means a clear purpose, a lawful basis, signage, a retention period, tight security and a process for handling access requests. This guide sets out what the Data Protection Commission (DPC) expects from businesses using CCTV.
When does GDPR apply to CCTV?
Recording and storing video can count as processing personal data even if the footage is never viewed. Where people can be identified, the business operating the system is usually the data controller. The household exemption is read narrowly, and it generally does not help a business or a camera that captures public space. The DPC publishes guidance for controllers aimed at owners and occupiers of premises, especially workplaces and places open to the public.
If your CCTV is installed or monitored by an external security company, that company may be a data processor, which brings contract requirements under Article 28 GDPR (see below).
Step 1: Identify your purpose and lawful basis
Before installing or expanding a system, the DPC expects you to define a clear purpose, show that CCTV is necessary for it, and identify your lawful basis under Article 6 GDPR. Typical purposes are protecting property, deterring theft and ensuring safety.
Legitimate interests
Most businesses rely on legitimate interests (Article 6(1)(f)), because consent is rarely practical for cameras. The DPC guidance asks you to show that the interest is genuine, the processing is necessary to achieve it, and it is not overridden by the rights of the people recorded. It recommends documenting this balancing exercise in a legitimate interests assessment. If the system serves purposes beyond security, you must be able to show those uses are proportionate.
Signage and transparency
People must be told they are being recorded. The DPC says signs should be easy to read, well lit and prominently placed, and a sign at each entrance to the monitored area will usually be enough. Signs should state the purpose of the CCTV and the controller’s identity and contact details. Where cameras operate in more sensitive settings, such as areas near toilets or changing facilities, signage should be more prominent and visible before people enter.
A written CCTV policy is best practice. It should explain why the system exists, how it is used and managed, who can see footage, how long it is kept, how it is secured, and the rights of people captured, including the right to complain to the DPC. For a workplace, bring the policy to employees’ attention. See also our GDPR employee data guide for employers.
How long can you keep CCTV footage?
There is no fixed legal retention period. Under the storage limitation principle (Article 5(1)(e)), footage should be kept no longer than necessary for the original purpose. The DPC guidance note says that for ordinary security, keeping footage beyond about one month is hard to justify unless it relates to a specific incident. It also notes that a 30-day period may be reasonable where the aim is to deal with potential personal injury claims. Footage relating to a specific incident can be isolated from general recordings and kept for longer.
Write the period into your retention policy, record why you chose it, and check the default overwrite setting on the recorder. You also need a secure way to erase footage when the period ends.
Security, access and processors
Article 32 GDPR requires appropriate security. For CCTV, the DPC guidance points to measures such as:
- restricting access to footage to a small group of designated staff, and logging and reviewing that access;
- encryption and password protection, avoiding generic or shared passwords;
- storing recording equipment in a secure environment;
- allowing remote access only for designated individuals over secure connections;
- training staff who have access in data protection and IT security.
If a security company installs or operates your system, put a data processing agreement in place covering permitted uses, security standards and retention. You remain responsible for compliance as the controller.
CCTV and staff monitoring
This is where businesses most often get into difficulty. The DPC says CCTV is generally not appropriate for monitoring staff attendance or performance, and that footage collected for security or safety should not be reused for monitoring unless an exception applies. It may be used case by case to investigate serious matters such as gross misconduct where this is necessary and proportionate, and employees must be clearly told that monitoring takes place, where and why. Cameras should be avoided in break rooms, changing rooms and toilets.
The point was tested in the courts in a 2022 Court of Appeal decision, Data Protection Commission v Doolin. An employer used security CCTV footage to discipline an employee over break times, although its policy said the cameras were for security and crime prevention. The court found that this use was not compatible with the original security purpose. The practical lesson is to state every intended use in your CCTV policy and make sure staff can foresee it.
Covert surveillance is generally unlawful. It is allowed only exceptionally, case by case, to prevent, detect or investigate offences, and requires a specific written policy, a tight focus, short duration and a DPIA before installation.
Access requests and Garda requests
People can ask for footage of themselves. Respond within one month, and do not delete the footage once a request is received. The DPC guidance says a video copy is normally provided, and that other people in the footage may need to be pixelated or de-identified, or their consent obtained. If footage has already been overwritten, tell the requester it no longer exists. Our guide to data subject access requests in Ireland covers the wider process.
For requests from An Garda Síochána, the DPC recommends disclosing footage on a formal written request stating that a criminal matter is under investigation. Urgent verbal requests can be actioned but should be followed up in writing, and you should keep a record of all requests and disclosures.
Do you need a DPIA for CCTV?
A data protection impact assessment (DPIA) is required for processing likely to result in high risk, including large-scale systematic monitoring of a publicly accessible area (Article 35(3)(c)). The DPC guidance says a DPIA is needed for large-scale monitoring of publicly accessible areas, for areas used by children, and before any covert system is installed. A small system with limited processing, such as a single shop, typically does not need an in-depth DPIA, although you should document how you reached that decision. If you have a DPO, consult them.
CCTV compliance checklist
- Define and document the purpose, and why CCTV is necessary.
- Record your Article 6 lawful basis and, for legitimate interests, your balancing assessment.
- Decide whether a DPIA is needed and document the outcome.
- Put prominent signs at every entrance to monitored areas.
- Adopt a CCTV policy and a retention period, and set the recorder accordingly.
- Restrict, log and review access to footage; secure remote access.
- Sign a processor agreement with any security company involved.
- Prepare a process for access requests and Garda requests.
- Add CCTV to your record of processing activities, and review the setup regularly.
For the wider picture, see our GDPR and data protection guides and services hub.
Need help with this? Plus Promotions Limited provides DPIA support for Irish businesses, from €495.
Frequently asked questions
Do I need a DPIA for CCTV in Ireland?
Not always. The Data Protection Commission (DPC) says a DPIA is needed for large-scale systematic monitoring of publicly accessible areas, before any covert system is installed, and where cameras cover areas used by children. A small system with limited processing, such as a single-premises shop, typically does not need an in-depth DPIA, but the decision should still be documented.
How long can a business keep CCTV footage in Ireland?
There is no fixed legal period. The DPC says footage should be kept no longer than necessary for its original purpose. For ordinary security, keeping footage beyond about one month is hard to justify unless it relates to a specific incident, which can be isolated and kept longer. Set a retention period, document the reason and check the recorder’s default settings.
Can an employer use CCTV to monitor staff?
Only in limited circumstances. The DPC says CCTV is generally not appropriate for monitoring staff attendance or performance. Footage collected for security should not be reused for other purposes unless the reuse is compatible and staff were told about it. Cameras should not cover toilets, changing rooms or break rooms.
Do I need signs for CCTV under GDPR?
Yes. The DPC expects clear, well-lit, prominent signs at the entrance to monitored areas stating the purpose of the CCTV and the identity and contact details of the controller. Fuller information, such as retention and individuals’ rights, should be available in a CCTV policy or privacy notice.
Can someone request a copy of CCTV footage of themselves?
Yes. Footage of an identifiable person is personal data, so they can make an access request. The controller should normally respond within one month, and should not delete the footage once a request has been received. Other people in the footage may need to be pixelated or otherwise de-identified.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
