Privacy and GDPR in CCTV Design: What to Build In From the Start
A camera system captures personal data the moment it goes live, so privacy and GDPR duties belong in the design phase, not a fix bolted on after installation. This page is general orientation for engineers, not legal advice.
Building privacy into the design: 4 steps
Define the purpose and lawful basis first
Before any camera is chosen, write down why the system exists — deterrence, evidence, access monitoring — and what lawful basis covers the recording. This single sentence shapes every decision that follows.
Set camera aim and boundaries deliberately
Plan each camera's field of view to cover the intended risk zone without spilling onto a neighbour's private property or more of a public street or path than the purpose actually justifies.
Decide a retention period, not a default
Agree a defined, limited number of days or weeks footage stays available before being overwritten, sized to the actual purpose — a retention window is a project decision, never a universal figure.
Plan signage and an access-request process
Work out where notices will go and who handles a request to see or delete footage before the system goes live, so both are ready on day one rather than improvised later.
What privacy-by-design looks like in a CCTV project
Privacy planned before purchase
Lawful basis, camera aim and retention period are decided at the design stage — before a single camera model is chosen.
A documented lawful basis
A short, written reason for recording that the design can be checked against — general orientation only; the applicable data-protection authority or a lawyer confirms specifics for your case.
Signage that matches what's recorded
Clear notices at the points people enter a monitored area, placed and worded to match the actual cameras and coverage, not a generic sticker bought separately from the design.
Camera aim that respects boundaries
Field-of-view lines checked against neighbouring properties and public space during design, not discovered as a complaint after installation.
A defined, limited retention period
A specific number of days agreed for this project and configured on the NVR, instead of footage accumulating indefinitely by default.
Network isolation and access control tied in
Camera traffic kept on its own VLAN so a compromised camera can't reach the rest of the network, plus access control on who can actually view footage — see our managed-switch VLAN segmentation guide and the Dahua and Safire access-control integration pages for how this connects to the wider system.
What a privacy-aware CCTV design brief includes
Bring these points into the design conversation and privacy stops being an afterthought.
- {'t': 'Purpose and lawful basis note', 'd': 'One or two sentences stating why the system exists and what lawful basis applies — the starting point for everything else.'}
- {'t': 'A site sketch with aim lines', 'd': "Each camera's field of view marked against the property boundary, showing where it does and doesn't reach."}
- {'t': 'Retention period decision', 'd': 'The number of days footage is kept for this specific project, recorded and set on the recorder rather than left at a factory default.'}
- {'t': 'Signage placement plan', 'd': "Where notices go, so they're visible before someone enters a monitored area."}
- {'t': 'Access-request contact point', 'd': "Who handles a request to see or delete footage, and roughly how quickly — decided before it's ever asked, not improvised on the day."}
Frequently asked questions
Is this page legal advice?
No. It's general orientation on the concepts worth considering when designing a CCTV system. For your specific situation, the applicable data-protection authority — in Latvia, the Datu valsts inspekcija — or a lawyer is the right place to confirm details.
Can I point a camera at my neighbour's garden or a public street?
In most cases this is where systems run into trouble — coverage is generally expected to stay limited to what the stated purpose justifies, avoiding a neighbour's private property or more public space than necessary. Confirm the specifics for your situation with the applicable authority or a lawyer.
How long should we keep footage?
There's no universal number — it's a project decision based on the actual purpose, generally kept as short as reasonably works rather than indefinite. What's appropriate for a family home and a business with its own obligations will often differ.
What happens if someone asks to see or delete their footage?
Having a defined process and a named contact point, agreed at the design stage, generally makes this straightforward to handle. It's worth confirming the exact obligations that apply to your situation with the applicable authority or a lawyer.
Does the Latvian Datu valsts inspekcija apply if we're not in Latvia?
No — GDPR is EU-wide but each country has its own data-protection authority. The Datu valsts inspekcija is our Latvia-specific reference point; check your own country's equivalent authority for guidance that applies there.
Designing a CCTV system and want the privacy side checked?
Talk to our engineers about how camera placement, VLAN isolation and access control fit together in your design — vendor-neutral, honest about what needs a lawyer's confirmation.