GDPR-compliant video surveillance: what businesses in Austria must know

When is video surveillance allowed for businesses?

Businesses may monitor their premises and grounds with cameras if they have a legitimate interest, such as protection against burglary, theft or vandalism. The legal basis is usually Art. 6(1)(f) GDPR. The Austrian Data Protection Act (DSG) also contains its own rules on image recording. How far these still apply alongside the GDPR is legally disputed, but in practice they continue to serve as guidance.

Proportionality is decisive. The surveillance must be suitable and necessary, and the interests of the people being filmed must not outweigh your own. So first check whether milder measures would be enough, for example better lighting, stronger locks, an alarm system or recording only outside opening hours.

There is no approval or notification procedure with the data protection authority, so the company itself must be able to demonstrate that the system is operated lawfully.

Define the purpose and the coverage area clearly

Write down what each camera is for. A specific purpose, such as securing evidence of break-ins at the warehouse, can be justified; a general wish for more security usually cannot. Documented past incidents strengthen the justification. The purpose determines camera positions, angles of view, recording times and the retention period. The same principles apply to cameras at entrances with licence plate recognition.

• Usually justifiable: entrances and driveways, storage areas, cash desks, server rooms and the company grounds outside opening hours.
• Only with a specific justification: workstations where employees spend their whole working day.
• Off limits: toilets, changing rooms, break and rest rooms. Hidden cameras and audio recording are practically never justifiable either.

Public space and neighbours

Pavements, streets and neighbouring properties must generally not be filmed. If a narrow strip directly in front of the entrance cannot technically be avoided, it must be kept as small as possible. Black out any other areas that reach into the picture with privacy masking.

When planning the video surveillance, camera positions and focal lengths can be chosen so that as little as possible needs to be masked.

Signage and information for the people filmed

People must be able to recognise a monitored area before they enter it, so put up clearly visible signs before the camera's field of view, not just under the camera. The European Data Protection Board (EDPB) recommends a two-layer approach:

• On the sign: a pictogram, the name and contact details of the controller, the purpose of the surveillance, a reference to the rights of the people concerned and a note on where to find the full information.
• In the full information notice: legal basis, legitimate interest, retention period, recipients and the rights of the people concerned in detail, for example as a notice at reception or via a QR code that leads to your website.

Retention period and automatic deletion

Recordings may only be kept for as long as the purpose requires; there is no single deadline that fits every case. In its guidelines on video devices, the EDPB recommends deleting recordings after a few days in most cases, ideally automatically; the longer the period, especially beyond 72 hours, the better it must be justified. The DSG rules on image recording likewise require storage beyond 72 hours to be justified and logged separately.

Set an explicit maximum retention period in the recorder or video management software. Many recorders are set by default to overwrite only when the hard disk is full, which can take weeks depending on its size. Longer periods, for example over long weekends or company holidays, need a documented reason.

If an incident occurs, secure only the relevant sequence, document the export and hand the copy to the police if needed. Once the case is closed, this copy is deleted as well.

Protecting recordings: access, logging and technology

Video recordings are personal data and need proper protection. Only a small number of named people should be allowed to view or export them, ideally under the four-eyes principle. The system should log every viewing and every export with the time and the user.

On the technical side, this means personal user accounts, a secured recorder in a locked room and remote access only via VPN. Our article on securing IP cameras explains how to protect cameras and recorders against attacks.

If a service provider has access to the system, for example for remote maintenance or cloud storage, you need a data processing agreement under Art. 28 GDPR.

Documentation: record of processing activities and DPIA

Video surveillance belongs in your record of processing activities. The exemption for organisations with fewer than 250 employees usually does not apply here, because the surveillance is not merely occasional. The entry describes, among other things, the purpose, the people affected, recipients, deletion periods and safeguards, ideally also camera locations and who has access.

A data protection impact assessment (DPIA) is required where processing is likely to result in a high risk. The GDPR explicitly mentions the systematic monitoring of publicly accessible areas on a large scale, and shops can count as such areas. The Austrian Data Protection Authority has also published lists of processing operations that always require a DPIA and of those that are exempt: systems that cover only the company's own property, are signposted and delete recordings within 72 hours may fall under an exception.

Facial recognition and other biometric functions process biometric data and are legally very sensitive for businesses. Do not activate such functions without a prior legal review.

Employees: involve the works council early

If cameras also capture employees, Austrian labour law applies as well. Control measures that affect human dignity are only permitted on the basis of a works agreement. Where there is no works council, each individual employee must consent.

This can also apply to a camera at the staff entrance or in the warehouse, not only to cameras pointed at workstations. Involve the works council during the planning phase and set out in the agreement the purpose, camera locations, retention period, access and a ban on using the footage to monitor performance or behaviour. Measures that violate human dignity, such as complete permanent surveillance of workstations, are not permitted even with consent.

Checklist for your video surveillance

Every system is different, and this article does not replace legal advice. If in doubt, have your concept reviewed by a lawyer who specialises in data protection. Q-entra supports you with the technical side, from planning and project engineering with camera positions and masking to installing the video surveillance with a permission concept and automatic deletion.