The Key Question: Yes, But Under Strict GDPR Conditions

Camera footage of people is considered personal data. As soon as you film your employees, this falls under the GDPR. The law doesn't prohibit camera surveillance in the workplace, but it does state that it is a serious infringement of employee privacy. Therefore, you must meet several strict requirements before installing even one camera.

To legally use cameras, you must carefully balance your business interests against your employees' right to privacy. This process is outlined in a number of mandatory steps.

Step 1: Determine your 'Legitimate Interest'

The very first requirement is that you have a "legitimate interest" for the camera surveillance. This means you must have a legitimate, concrete reason that outweighs the privacy invasion. Vague reasons like "keeping an eye on things" are completely insufficient. Concrete, legitimate interests include:

• Preventing theft and fraud: For example, at a cash register, in a warehouse with valuable goods or at a gas station.
• Property protection and personnel safety: Consider guarding the entrance after closing time, a parking lot, or a production line with dangerous machinery.
• Collecting evidence in incidents: For example, in the event of a robbery or aggression against staff in a shop.

Step 2: The Necessity, Proportionality & Subsidiarity Test

If you have a legitimate interest, you must then pass a three-pronged test. This is where most companies fail.

1. Necessity (Is it really necessary?)

You must be able to demonstrate that camera surveillance is necessary to achieve your goal. Is there a specific problem (e.g., recent thefts) or a real risk? Without a clear necessity, the privacy infringement is by definition too great.

2. Proportionality (Is the measure not excessive?)

The invasion of privacy must be proportionate to the purpose. Continuous 24/7 filming in an office where incidents never occur is disproportionate. However, a camera at a loading dock that only records at night when motion is detected may be. Questions to ask:

• Where are the cameras? (Not in cafeterias, restrooms, or locker rooms.)
• When is filming taking place? (Continuously, only after closing time, only when there's movement?)
• Who has access to the images? (A limited number of authorized persons.)

3. Subsidiarity (Is there no less drastic solution?)

This is the "last resort" test. You must be able to demonstrate that you cannot achieve your goal with a less privacy-intrusive method. Have you already tried other measures, such as better locks, an alarm system, access control, or additional lighting?

Step 3: The Works Council's Right of Consent

If your company has a Works Council (OR) or Employee Representation (PVT), you are legally required to request approval for the installation, modification, or removal of employee monitoring systems, which include cameras. This is not a formality; the Works Council has a significant say.

The Gray Zone: Is Covert Camera Surveillance Allowed?

Secretly filming employees with a hidden camera is generally prohibited. The Dutch Data Protection Authority states that this is only permitted in very exceptional circumstances, and even then under extremely strict conditions:

1. You have a concrete and reasonable suspicion of criminal offences (such as theft or fraud) by specific employees.
2. All other, less invasive methods have failed.
3. The camera surveillance is temporary and very targeted (only at the place and time of the suspected misconduct).
4. You inform the employees involved and the Works Council afterwards about the use of the hidden camera.

If, after legal advice, you decide to take this step, a small, discreet camera is necessary.

Dahua IPC-HDBW3541FP-AS-S2 5MP Mini Dome

For a legitimate and targeted investigation, an unobtrusive camera is essential. This compact dome model can be discreetly placed to monitor a specific location, such as a cash register or safe, without immediately attracting attention. Its high resolution provides usable evidence within strict legal frameworks.

Practical Implementation: The Step-by-Step Plan for Compliant Camera Surveillance

Have you completed all the previous steps? Then you can proceed with the implementation. Follow these steps carefully:

1. Establish a camera protocol: Document why, where, and how you film, who has access to the footage, and how long it will be retained. This protocol must be approved by the Works Council/PVT.
2. Inform your staff: Be transparent. Inform all staff (including new hires) about the camera surveillance and the protocol.
3. Post Clear Warning Signs: Both staff and visitors must be informed. Place stickers or signs indicating that there is CCTV and who the controller is (your company).
4. Maintain a strict retention period: The Dutch Data Protection Authority recommends a maximum retention period of four weeks. Longer retention is only permitted if an incident has been documented that requires further investigation.
5. Secure Access: Ensure the footage and the recorder are stored in a locked room and that access to the software is protected with strong passwords. Record who viewed the footage and when.

How Modern Technology Helps with Compliance

Fortunately, modern IP camera systems offer features that help you meet the strict GDPR requirements.

Dahua DH-IPC-HDBW5442RP-ASE WizMind Dome

This advanced camera offers features essential for a compliant business system. Privacy Masking 2.0 allows you to permanently block areas of the image (e.g., employee desks or public areas). User Access Logging records exactly who views the footage, which is crucial for accountability under the GDPR.

The Ultimate Do's and Don'ts Checklist

Conclusion: Security and Privacy Go Hand in Hand

So, is a company allowed to install cameras? Absolutely. But it requires a careful, well-considered approach that goes beyond simply installing hardware. By following the steps in this guide—from establishing your legitimate interest and conducting the NPS assessment to involving the Works Council and developing a clear protocol—you can implement a system that both protects your business and respects your employees' privacy.

The right technology is your ally. Cameras with features like AI detection, privacy masking, and access logging are no longer a luxury, but essential tools for meeting the strict requirements of the GDPR. Investing in a professional system is an investment in security, efficiency, and legal peace of mind.