Is a Sign Enough? The GDPR Truth About Store CCTV

The Sign That Fooled Everyone

You walk into a store, see a small sign saying 'CCTV in operation,' and assume that's it—they've checked the legal box. But under GDPR, that sign is just the appetizer, not the main course. The real question is: do you need a full privacy notice?

Featured Snippet Bait: Under GDPR, a simple CCTV sign is not enough. You must provide a detailed privacy notice explaining why you're recording, how long you keep footage, and people's rights. The sign is only a warning, not a substitute for the full information.

What GDPR Actually Requires

Article 13 of the GDPR is crystal clear: when you collect personal data (yes, video footage counts), you must give the data subject a laundry list of information—your identity, purpose, legal basis, retention period, and their rights. A sign with a camera icon doesn't cut it.

Think of it like this: a sign is like a 'Beware of Dog' notice. It warns you, but it doesn't tell you the dog's name, why it's there, or how to complain if it bites. That's what the privacy notice does.

The Two-Step Dance

You need both: a visible sign to alert people they're being recorded, and a readily available privacy notice (e.g., on your website, a QR code, or a printed leaflet). The sign is the 'hey, look here,' the notice is the 'here's the fine print.'

And no, sticking the full notice on the sign itself isn't practical—it would be the size of a billboard. Instead, make the notice accessible. For example, a sign that says 'For details, scan this QR code or visit our website.'

Real-World Consequences

In 2022, a Dutch retailer was fined €525,000 for inadequate CCTV signage. They had signs, but no privacy notice. The Dutch DPA said the signs didn't inform people of their rights or the retention period. Ouch.

So, if you're a store owner, don't rely on a $5 sign from Amazon. Invest in a proper privacy notice. Your customers—and your wallet—will thank you.

FAQ