Installing CCTV cameras in a business is legal, but hanging up a sign is not enough. In 2025, video surveillance was the area with the most sanctioning proceedings opened by the Spanish Data Protection Agency (AEPD): 81, ahead of internet services and data breaches. Most of these cases do not involve large companies but shops, bars, offices and residents’ associations that record more than they should, fail to inform properly or keep footage for too long.
In this article we review what Spanish law currently requires from CCTV cameras in a business, based on the video camera guide the AEPD updated in February 2025, and answer the questions people search for most often.
In this article we will discuss...
Which rules apply to CCTV cameras in Spain?
Images of identifiable people are personal data. That is why the General Data Protection Regulation (GDPR) applies and, specifically, two articles of Spain’s Organic Law 3/2018 (LOPDGDD):
- Article 22: video surveillance for security purposes, retention period, public roads and the information sign.
- Article 89: using cameras to monitor employees.
In addition, the AEPD’s guide on the use of video cameras for security and other purposes sets out the criteria the Agency applies when it investigates a complaint.
Can I install cameras in my business?
Yes. The security of people, property and premises is a legitimate purpose. However, the camera must be proportionate: it should record only what is necessary for that purpose. In practice, this means:
- Pointing cameras at entrances, tills, storerooms or risk areas, not the whole premises.
- Not capturing third-party spaces, such as the building entrance or the shop next door.
- Limiting who can view the footage and in which cases.
Also, there is no longer any need to register a file with the AEPD: that obligation disappeared with the GDPR. What must exist is the processing activity in the company’s record of processing activities, if the company is required to keep one.
What must a CCTV sign say?
This is the most frequent search and the source of many fines. The sign must be placed somewhere sufficiently visible, before entering the recorded area, and include at least (Article 22.4 LOPDGDD):
- The existence of the processing, that is, that recording is taking place.
- The identity of the controller: the name of the business, not just the security company.
- How to exercise data protection rights.
The sign may include a QR code or a link to the rest of the information. However, there is no mandatory “approved” sign: the AEPD offers a template that can be used as a reference. A generic hardware-store sign that only says “CCTV in operation” does not comply, because it does not identify the controller.
How long can I keep the recordings?
For a maximum of one month from recording (Article 22.3 LOPDGDD). After that, they must be deleted unless they prove an act against people, property or premises. In that case, they must be handed over to the competent authority within 72 hours of becoming aware of the recording.
Therefore, it is advisable to configure the recorder to overwrite footage automatically before 30 days. Moreover, if someone asks for a copy of their images, the response must protect the other people who appear in them.
Can the camera record the street?
As a general rule, no. Surveillance of public roads is a matter for the police. A business or an individual may only capture the minimum portion of the street that is essential to protect their entrance, or that is impossible to avoid because of where the camera is located (Article 22.2 LOPDGDD).
The same applies to home cameras and video doorbells. If they only record the inside of the home, they fall outside the GDPR. By contrast, if they point at the street or a neighbour’s door, they are no longer a purely household use and all obligations apply.
Can I record my employees?
Yes, to monitor compliance with their employment duties (Article 20.3 of the Spanish Workers’ Statute), subject to three conditions in Article 89 of the LOPDGDD:
- Prior information: employees and their representatives must be informed, expressly, clearly and concisely, that the cameras may also be used for employment monitoring.
- Prohibited areas: never in changing rooms, toilets, canteens or rest areas.
- Audio, only exceptionally: recording sound is only allowed where there are relevant security risks and in a proportionate way.
If the camera captures an employee committing a flagrant unlawful act, the information sign is enough to use the recording. Even so, hidden cameras remain a very limited exception that requires well-founded suspicions and a case-by-case analysis, as the European Court of Human Rights recalled in López Ribalda v. Spain.
Who is liable if a security company installed the camera?
Your business. The company that installs or maintains the system is usually a data processor, but the controller responsible for what is recorded, the sign and retention is whoever decides to install the cameras. That is why you should sign a data processing agreement with the installer and know who has remote access to the footage.
What about residents’ associations?
Cameras in common areas require an agreement of the owners’ meeting. The same rules also apply: sign, one-month retention, minimal capture of the street and restricted access, usually to the president or the maintenance company.
Is a data protection impact assessment required?
Not for an ordinary shop. However, it may be necessary when video surveillance involves large-scale systematic monitoring of publicly accessible areas, or when combined with facial recognition or other biometric data. The latter is also subject to very strict restrictions under the GDPR and the AI Act.
Can someone ask me for a copy of the recordings?
Yes. Anyone recorded can exercise their right of access and request the images in which they appear, within the retention period. The business must respond within one month, but without infringing the rights of other people in the footage. In practice, third parties must be blurred or, if that is not possible, a description of what the images show can be provided. And if the request arrives after the footage has been deleted, it is enough to state that it no longer exists.
If the police or a court request the footage, it is handed over to the requesting authority. By contrast, it should not be given to a neighbour, an insurer or another customer who asks for it “to see what happened” without a legal basis.
What about fake or dummy CCTV cameras?
A dummy camera does not record, so it does not process personal data and the AEPD does not treat it as processing subject to the GDPR. However, if it points at a neighbour’s home or business, it may lead to a privacy dispute before the civil courts. It is therefore best to position it as if it were a real camera.
Can I use cameras with facial recognition or artificial intelligence?
The margin here is minimal. Facial recognition processes biometric data, a special category that Article 9 GDPR only allows in very limited cases. In fact, the AEPD fined a large supermarket chain €2.52 million for using facial recognition in its stores. In addition, the AI Act prohibits certain biometric uses and classifies others as high risk. By contrast, video analytics that do not identify people, such as counting occupancy, are usually feasible if properly configured and disclosed. We explain this further in artificial intelligence lawyers for companies.
What fine can the AEPD impose for CCTV cameras?
It depends on the seriousness, the size of the company and whether it is a first offence. For SMEs and shops, video surveillance fines usually range from a few hundred to a few thousand euros. In addition, Spanish law allows reductions of up to 40% for acknowledging liability and paying voluntarily (Article 85 of Law 39/2015). Even so, the AEPD also orders the installation to be corrected, and failing to do so may lead to new proceedings.
CCTV mistakes the AEPD fines most often
- No sign, a badly placed sign or one that does not identify the controller.
- Cameras recording the public road or other people’s property.
- Keeping footage for more than one month.
- Not informing employees before using the footage to discipline them.
- Cameras in rest areas or recording audio without justification.
- Sharing footage on social media or messaging groups.
Quick checklist for your CCTV cameras
- Does each camera have a clear purpose and a proportionate field of view?
- Is there a visible sign with the business name and how to exercise rights?
- Does the recorder delete footage within one month?
- Have employees and their representatives been informed in writing?
- Is there a data processing agreement with the installer or maintenance company?
- Is the activity included in the record of processing activities?
If any answer is “no”, it is better to fix it before a complaint arrives. At Auratech we review video surveillance systems as part of our data protection audit and, if we are your data protection officer, we prepare the sign, the information for staff and the procedure for retaining and accessing footage.
