If your business runs CCTV in Ireland, you’re processing people’s personal data — which means GDPR and the Data Protection Acts apply. It’s not as daunting as it sounds, but a few basics matter, and getting them right protects you as much as your customers. This is general guidance, not legal advice — the Data Protection Commission is the authority to check.
The basics most businesses need
- Tell people. Clear, visible signage at the entrance letting people know CCTV is in use, who operates it, and why. This is the single most-cited requirement.
- Have a good reason. You need a lawful basis — for most businesses that’s legitimate interests, such as protecting property and safety. Be able to explain it.
- Only capture what you need. Point cameras at your own premises, not unnecessarily at the street, footpaths or a neighbour’s property.
- Don’t keep footage forever. Retain it only as long as you genuinely need it, then let it overwrite. Keep the period reasonable and consistent.
- Keep it secure. Restrict who can view recordings, and protect the system with proper passwords — footage is sensitive.
- Be ready for requests. People can ask for footage of themselves; have a simple process to handle that.
Where it gets stricter
Cameras in areas where people expect privacy, audio recording, or systems that monitor staff need extra care and may require a data protection impact assessment. When in doubt, check the DPC’s CCTV guidance or take advice.
We set it up sensibly
When we install business CCTV, we position cameras appropriately, set sensible retention, and make sure the notification side is handled — so you get the security benefit without tripping over the compliance basics. Talk to Bellcom.