In Spain, cameras recording beyond the strictly domestic sphere must comply with the GDPR and Organic Law 3/2018: a visible information sign, capturing only the space needed, no recording of public streets beyond what is essential, and deleting footage within one month unless it evidences an incident.
Basic rules
- A visible information sign at the entrances to the monitored area, identifying the controller and how to exercise rights.
- Proportionality: capture only what security requires.
- Public streets: only the part essential to monitor your own entrance; use privacy masks if the camera covers more.
- Retention: delete footage within one month unless it must be kept as evidence.
- Restricted access to recordings and password-protected equipment.
Depending on where they are installed
| Place | Bear in mind |
|---|---|
| Inside a private home | Domestic use; still respect the privacy of people living or working there (e.g. domestic staff). |
| Outside a home | Do not capture the street or neighbouring property beyond what is essential. |
| Residential community | Requires an owners’ meeting resolution and a sign; cameras aimed at common areas. |
| Business | Signage, a record of processing activities and prior notice to employees. |
Audio and sensitive areas
Recording sound is far more restricted than recording images and, at work, is only allowed in very specific cases. Cameras must never be installed in toilets, changing rooms or rest areas.
How we handle it in an installation
When designing a CCTV system we set each camera’s orientation, apply privacy masks where needed and configure the recorder to overwrite automatically so footage is not kept longer than it should be.
This guide is for information only and is not legal advice. For specific cases, see the video-surveillance guide from the Spanish Data Protection Agency (AEPD) or consult a lawyer.