Why this is an important topic

You are allowed to install cameras, but not without restrictions. The General Data Protection Regulation (GDPR, known in the Netherlands as the AVG) sets requirements for camera surveillance. The rules for private individuals differ from those for businesses, and a breach can result in hefty fines. We get questions about it every week, so let's set it out clearly.

Please note: this article is not legal advice. If you're unsure about a specific situation, consult a lawyer or the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Private individuals: what are you allowed to do around your home?

As a private individual, you may install cameras to protect your own home and property. That falls under the "household exemption" in the GDPR. But there are limits.

You may film your own property: the front garden, back garden, driveway and the front of the house. No problem.

You may not simply film the public road. Sometimes a small strip of pavement is unavoidable, and that is accepted. But deliberately pointing your camera at the street or at your neighbours' driveway is not allowed.

Nor may you film your neighbours' garden or home. Not even "by accident". If your camera consistently takes in part of your neighbours' property, you must re-angle it or set up a privacy mask. On good systems this can be configured in the software, and we do so as standard on every installation.

We put a sticker at the front of the house stating that camera surveillance is in use. That isn't compulsory for private individuals, but it's good practice and it acts as a deterrent.

Businesses: this is where it gets stricter

The full GDPR requirements apply to businesses. That means you must be able to justify your camera surveillance.

First, you need a legitimate interest. Burglary prevention, protecting property or the safety of your staff are legitimate reasons. Filming staff "for the fun of it" or to measure their productivity does not qualify.

In addition, you must weigh up whether it is necessary and proportionate. Can you achieve the same goal by less intrusive means? Then that is what you must do. A camera covering the warehouse is fine, but a camera that films the staff break room can almost never be justified.

Obligations for businesses

A few things you need to arrange as a business:

Inform people. At every entrance to the monitored area there must be a clear sign or sticker: "CCTV in operation". Preferably with the contact details of the person responsible as well. We supply the official stickers as standard.

Record of processing activities. Businesses with cameras must set out in their record of processing activities (the internal register of personal data processing required under the GDPR) which cameras they have, what they are for, how long footage is kept and who has access to it.

Inform your staff. If you have employees, they must be informed about the presence of the cameras, their purpose and their rights. This is often done through the staff handbook or a separate policy. The works council (if there is one) has a right of consent.

Securing footage. Footage must be stored securely. Not just on a hard drive under the desk. Encryption, strong passwords, restricted access. Our installations meet these requirements as standard.

How long can you keep footage?

The rule of thumb: no longer than necessary. For most situations that means 4 weeks. Sometimes a shorter period is reasonable (for example 7 days for a quiet office environment), and sometimes longer, if there is a good reason.

After an incident you may keep footage for longer, until the matter has been dealt with. But routinely keeping footage for 6 months "just in case" is not allowed.

Our NVRs (network video recorders) are set up as standard so that old footage is automatically overwritten after the agreed period. You don't need to do anything yourself.

Hidden cameras and staff

Hidden cameras are almost always prohibited for businesses. Only in very exceptional cases (a specific suspicion of theft by staff, and then only temporarily and in a targeted way) may they be permitted. Strict rules apply, and really it should only be done on the basis of legal advice.

Cameras in toilets, changing rooms and other private areas are always prohibited. No exceptions.

Audio recording

In the Netherlands, recording audio is regulated far more strictly than recording images. As standard, we switch off audio on the cameras we install for businesses. If you still want to use audio (for example with an intercom), there must be a separate justification and clear information for everyone who enters the area.

Right of access

People who appear in your footage have a right of access. If you receive such a request, you must respond within one month. You may not simply share all the footage (other people's privacy has to be protected), but you must make clear whether there is any footage of them and what it consists of, and where appropriate let them see themselves in an extract.

In practice this rarely happens, but it's good to know that it can.

What do we do for our customers?

With every installation, we take care of the following as standard:

Privacy masks wherever the public road or neighbouring properties come into view
Stickers and information signs at the entrances
A correctly configured retention period on the NVR
Secure storage with strong passwords
Access control for the camera system (who can view what)
A short document setting out the choices made, for your record of processing activities

That way you can be sure your camera surveillance is GDPR-compliant, without having to dig into the legislation yourself.

Questions?

Not sure whether your situation complies with the rules? Or would you like advice on a new camera system that is set up to be GDPR-compliant from the start? We'd be happy to come and see you.

Request a no-obligation consultation

Camera surveillance and the GDPR: what is and isn't allowed in 2026?