Do you need a DPIA for CCTV in Ireland?
Last updated 22 October 2026. General information only, not legal advice.
Not always, but often for larger or more intrusive systems. Under Article 35 GDPR, a data protection impact assessment (DPIA) is required where CCTV is likely to result in a high risk to individuals, including where it involves systematic monitoring of a publicly accessible area on a large scale. The Data Protection Commission (DPC) expects a DPIA for large-scale systems, but says a small single-premises system typically does not need an in-depth one.
When the DPC expects a DPIA for CCTV
Article 35(3)(c) GDPR lists “a systematic monitoring of a publicly accessible area on a large scale” as a case where a DPIA is required. The DPC’s CCTV guidance for data controllers applies this as follows:
- Large-scale systems, particularly those monitoring publicly accessible areas, call for a DPIA. The guidance uses a campus as an example requiring a full assessment.
- Areas frequented by children: a DPIA is required.
- Areas with higher privacy expectations: a DPIA is strongly recommended.
- Covert surveillance: a DPIA is needed before installation. Covert recording is generally unlawful and is only allowed on an exceptional, case-by-case basis.
When a full DPIA is unlikely to be needed
The DPC guidance says small systems, such as a single convenience shop, typically do not need an in-depth DPIA. Even so, record your decision and the reasoning behind it. This fits the wider DPC screening approach, which draws on the Article 29 Working Party criteria: if processing meets two or more criteria, such as systematic monitoring plus data about vulnerable people like employees, a DPIA is generally required, and you should document your reasons if you decide not to carry one out.
What a CCTV DPIA should cover
A DPIA should describe the system and its purposes, assess whether the cameras are necessary and proportionate, identify risks to the people recorded, and set out measures to reduce them. For CCTV, those measures usually include:
- A lawful basis. Consent is unlikely to work for most CCTV, and private owners often rely on legitimate interests, which means showing that the interest is genuine, the processing is necessary and individuals’ rights are not overridden.
- Clear, prominent signage that states the purpose and the controller’s identity and contact details.
- A justified retention period, with default device settings reviewed.
- Camera positions that avoid areas such as toilets, changing rooms and break rooms. See our GDPR employee data guide for employers.
- A process for handling access requests. See our guide to data subject access requests in Ireland.
Need help with this? Plus Promotions Limited provides DPIA support for Irish businesses, from €495.
Frequently asked questions
Do small businesses need a DPIA for CCTV?
A single small system, such as one covering a shop, typically does not need an in-depth DPIA, according to the DPC’s CCTV guidance. You should still record your decision and the reasons for it.
How long can you keep CCTV footage in Ireland?
The law sets no fixed period, so you must justify the period you choose. The DPC guidance says 30 days may be reasonable for potential personal injury claims, and keeping footage beyond one month for ordinary security is hard to justify unless it relates to a specific incident.
Can employees see CCTV footage of themselves?
Yes. Anyone whose identifiable image is recorded can make an access request, and the controller normally must respond within one month. Other people in the footage must be taken into account, for example by pixelating their images.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
