EUROPE · SPAIN DIVISIONSECUREVIEW EUROPE · SPAIN DIVISION
GDPR and Video Surveillance Compliance in Spain
A practical planning guide for Spanish businesses using commercial security cameras under the GDPR, Spain’s LOPDGDD and AEPD guidance.
01
Video surveillance images are personal data
When a camera captures an identifiable person, the organization is processing personal data. Compliance therefore concerns more than where equipment is mounted. The business should identify the controller, the security purpose, the applicable legal basis, the people and areas affected, who can view or export recordings, how long footage is retained and how rights requests are handled. Camera design and data-governance decisions should be coordinated before installation.
02
Spain’s principal video-surveillance framework
Commercial security-camera processing in Spain sits within the EU General Data Protection Regulation and Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD). Article 22 of the LOPDGDD specifically addresses image processing to protect people, property and facilities. Other rules can apply to employment monitoring, private security, public authorities, regulated sites and specialized uses. A company should obtain qualified advice for its specific circumstances.
03
Necessity, purpose and proportionality
The AEPD states that video surveillance should be used only when less privacy-intrusive means are not sufficient. Define the concrete security problem before choosing cameras. “General security” should become a documented operational purpose such as protecting an entrance, verifying access to a restricted room or investigating loss at a loading bay. Avoid collecting images merely because equipment makes collection possible.
04
Minimize camera coverage and public-space capture
Article 22 limits capture of public roads to what is indispensable for the security purpose, subject to specific exceptions for strategic assets or transport-linked infrastructure. Camera angles should avoid neighboring property, private interiors and irrelevant areas. Use appropriate lenses, physical repositioning and privacy masking where they support the required purpose. Recheck coverage after construction, landscaping, racking or operational changes.
05
Visible notices and layered privacy information
People should be informed before or as images are collected. Spanish law provides for a visible information device identifying at least the existence of processing, the controller and the possibility of exercising GDPR rights. The controller must also keep the remaining required information available. The AEPD describes a layered approach: a concise sign at monitored access points and accessible expanded information explaining purpose, legal basis, retention, recipients, rights and contact details.
06
Record of processing activities and accountability
The AEPD’s compliance guidance points organizations to the GDPR record of processing activities. The record should align with the deployed system: locations, purposes, categories of people and images, recipients, retention, access roles and security measures. Maintain a camera schedule or drawing, configuration records, authorized-user list, incident-export procedure and evidence of periodic review. Documentation should describe the real system rather than a generic policy.
07
Retention, incident preservation and deletion
Article 22 provides that video-surveillance data are generally deleted within a maximum of one month from capture. It recognizes an exception where recordings must be preserved to demonstrate acts against people, property or facilities; in that situation the images must be made available to the competent authority within the statutory period described by the law. Configure retention deliberately, verify that automatic deletion operates, and document any incident hold separately.
08
Access control, exports and service providers
Only authorized people should access live or recorded images, and their permissions should reflect their responsibilities. Use individual accounts, strong authentication, secure remote access, logging where available and a controlled export process. When an installer, monitoring provider, cloud service or maintenance company accesses images on the controller’s behalf, determine the parties’ roles and put an appropriate data-processing agreement or other legal instrument in place where required.
09
Employees, audio, analytics and higher-risk uses
Workplace monitoring is subject to additional requirements, including Article 89 of the LOPDGDD. Audio recording is more intrusive and should not be enabled casually. Facial recognition, biometric identification, behavioral analytics, large-scale monitoring and systematic observation can materially increase risk and may trigger additional GDPR analysis or a data-protection impact assessment. Obtain specialist advice before enabling advanced functions simply because a camera or recorder offers them.
10
Security, maintenance and demonstrable compliance
A compliant design can become noncompliant if cameras drift, new users retain access, retention changes or remote connectivity is exposed. Review physical aim, privacy masks, accounts, firmware strategy, recording health, storage behavior, exports and documentation. SecureView System Health™ can support technical reliability, but the controller remains responsible for governance and for validating legal decisions with an appropriate professional.
Commercial video-surveillance compliance checklist
- Document the security purpose and legal basis
- Map every camera and intended field of view
- Minimize public-space and neighboring-property capture
- Install visible notices and publish expanded information
- Maintain the processing-activity record
- Set and verify the retention/deletion rule
- Restrict live view, playback and export permissions
- Document service-provider access and contracts
- Create an incident preservation and disclosure procedure
- Review workplace, audio, analytics and DPIA questions
- Test technical security and recording health periodically
Official sources
Use the current official texts and AEPD materials when reviewing your organization’s obligations.