Installing security cameras has become commonplace in businesses, residential communities, shops and offices. What is often not precisely understood is that recording images of people is a processing of personal data and, as such, is subject to demanding regulation. This general guide explains what Spanish law says about video surveillance: which legal framework applies, which principles must be respected, how to inform, how long images are retained and which specific rules apply when the cameras affect workers.
In 20 seconds
- Security video surveillance is governed by the GDPR and art. 22 of the LOPDGDD.
- The principles of legitimate purpose (security) and minimisation apply: only what is essential is recorded.
- You must inform with a visible sign (AEPD model) plus the extended information under art. 13 GDPR.
- Images are deleted within the legal period of art. 22 LOPDGDD (as a general rule, one month).
- With cameras in the workplace, art. 89 LOPDGDD applies: prior and express information to staff.
The legal framework of video surveillance
Video surveillance does not have its own isolated law: it rests on two rules that operate together. The basis is the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), because images of identifiable people are personal data. On that basis, art. 22 of the LOPDGDD (Organic Law 3/2018) specifically regulates the processing of images for security purposes.
Art. 22 LOPDGDD authorises natural and legal persons to capture and process images through camera systems for the purpose of preserving the security of persons and property, as well as of their premises. That is the typical purpose of a security camera: to prevent and, where appropriate, to evidence theft, robbery, damage or assault.
The usual legal basis for this purpose is the legitimate interest of the controller (art. 6(1)(f) GDPR): there is no need to seek consent from someone entering a video-surveilled space, provided that the duty to inform and the remaining safeguards are met. It is worth dispelling a frequent misconception here: there is no prior AEPD authorisation to install cameras. What the law requires is not a permit, but compliance with a set of obligations from the design of the system.
Where the system affects workers, art. 22 is joined by art. 89 of the LOPDGDD, which introduces additional safeguards in the employment context. And the duty of transparency is always completed by art. 13 GDPR, which sets out the information that must be provided to those affected.
The principles that govern every camera
Before turning to specific obligations, it is worth setting out the GDPR principles that govern any video surveillance system. They are the filter through which you decide what may and may not be recorded.
Legitimate and specified purpose
The purpose must be clear and defined in advance: the security of persons, property and premises. Once that purpose is set, the images cannot be reused for other incompatible purposes. Recording "for security" and then using the images to measure staff productivity, analyse purchasing behaviour or monitor working hours amounts to a diverted use that the declared purpose does not cover.
Minimisation
The system should capture only what is strictly essential for the security purpose. This principle has very concrete practical consequences: the number of cameras, their orientation and their range must be limited to what is necessary. A camera covering far more than security requires breaches minimisation even if its purpose is legitimate.
Do not record the public thoroughfare beyond what is essential
The capture of the public thoroughfare by private parties is limited to the strip strictly essential to monitor access to one's own building or premises. It is not permissible to record the entire pavement, the flow of passers-by, the roadway, third parties' entrances or the façade of a neighbouring building. Where the equipment allows, privacy masks are applied in the software to blank out the areas that must not be recorded.
Areas where recording is never allowed
There are spaces where the right to privacy prevails absolutely and where the installation of cameras is barred: toilets, changing rooms and rest areas. In the employment context, this prohibition is categorical: art. 89(1) of the LOPDGDD prohibits installing video surveillance systems (or sound recording) in places intended for the rest or leisure of workers, such as changing rooms, toilets, canteens and similar spaces.
The duty to inform: sign and extended information
The duty to inform (art. 13 GDPR) is met in video surveillance at two complementary levels, as specified by art. 22(4) of the LOPDGDD.
The first level is the information device: the well-known video-surveilled area sign, which must be placed in a sufficiently visible location before entering the recorded area. The AEPD publishes a guidance model sign that serves as a free reference. Its usual minimum content includes:
- The indication that this is a video-surveilled area (camera pictogram).
- The identity of the controller (name or company name and means of contact).
- The purpose of the processing: security.
- The legal basis (usually, legitimate interest).
- The possibility of exercising rights and the way to do so.
- A reference to where the extended information can be consulted.
The second level is the extended information under art. 13 GDPR, which must be kept available to those affected. It covers all the required elements: identity and contact of the controller and, where applicable, of the data protection officer; purposes and legal basis; recipients (for example, law enforcement authorities or the judicial authority where appropriate); retention period; rights and how to exercise them; and the right to lodge a complaint with the AEPD. This information is made available in a real and accessible way: extended sign at reception, leaflet, a QR code linking to a URL or a printed text on request.
Retention period of the images
Recordings cannot be kept indefinitely. They must be deleted within the period legally provided for by art. 22 of the LOPDGDD, which as a general rule is one month from their capture. Once that period has passed, the images must be effectively deleted or overwritten.
The only exception is where the images must be retained to evidence the commission of acts against the integrity of persons, property or premises. In that case, the relevant recordings are made available to the competent authority (law enforcement or the judicial authority). Outside that scenario, images cannot be kept "just in case".
In practice, this translates into configuring the recorder (DVR/NVR) or the cloud service with an automatic overwriting cycle that respects the period. When an incident occurs, only the relevant fragment is extracted, safeguarded with appropriate traceability and handed over to the authority, while the rest of the system continues its normal deletion cycle.
"A security camera is judged with three questions: why it records, what falls within the frame and how long the footage is kept. The law does not prohibit surveillance; what it requires is that those three answers are thought through and written down before the system is switched on, not improvised by whoever runs the cabling."
Mario P. Talamillo · Managing Partner, Certix®
Workplace video surveillance: rules of art. 89 LOPDGDD
Where the cameras reach workers, the regulations add specific safeguards. Art. 89 of the LOPDGDD, in connection with the power of control under art. 20.3 of the Spanish Workers' Statute, permits video surveillance for the purpose of monitoring work activity, but subjects it to strict conditions.
The first and most important is the duty of prior and express information: workers and, where applicable, their representatives must be informed in advance, and in an express, clear and concise manner, about the existence and characteristics of the system. In the employment context, the general video-surveilled area sign is not enough as the sole means of informing about the monitoring: the communication to staff must be prior and express.
The second is the absolute prohibition already mentioned in art. 89(1): cameras cannot be installed in places intended for rest or leisure (changing rooms, toilets, canteens and the like), regardless of any monitoring purpose.
In addition, every workplace video surveillance measure must pass the proportionality test: it must be suitable for the purpose pursued, necessary (with no less intrusive alternative) and balanced. Installing cameras in a generalised or covert manner over the workstation, without that prior analysis, finds no cover in art. 89. These situations always require an individual legal analysis.
Where cameras may and may not be placed
The guiding criterion is minimisation: capturing only what is necessary for security. This table sums up the practical rule for the most common areas.
| Area | Can it be recorded? | Regulatory nuance |
|---|---|---|
| Own entrances and perimeter | Yes | Security purpose (art. 22 LOPDGDD). |
| Interior common and transit areas | Yes | With signage and minimisation of the frame. |
| Public thoroughfare | Only what is essential | Only the minimum strip needed to monitor one's own access. |
| Third parties' buildings and entrances | No | Neighbouring dwellings or premises cannot be framed. |
| Workstations | With limits | Prior and express information (art. 89 LOPDGDD) and proportionality. |
| Toilets, changing rooms and rest areas | Never | Absolute prohibition (art. 89(1) LOPDGDD). |
Compliance checklist
These are the minimum points that any video surveillance system must cover to operate with guarantees in line with the regulations:
- Security purpose declared and defined; no diverted uses of the images.
- Cameras oriented only to what is essential; without capturing a broad public thoroughfare or third parties' buildings.
- No camera in toilets, changing rooms or rest areas.
- Video-surveilled area sign visible at each entrance, in line with the AEPD's guidance model.
- Extended information under art. 13 GDPR available and accessible (URL, leaflet or counter).
- Overwriting cycle configured to respect the period of art. 22 LOPDGDD (as a general rule, one month).
- Protocol to extract and hand over images to the competent authority when they document an incident.
- Access to the system restricted to persons with a security function, with individual credentials.
- If the system affects staff, prior and express information to the workforce (art. 89 LOPDGDD).
- Video surveillance processing documented within the organisation's processing activity.
Frequently asked questions
What regulations govern security cameras in Spain?
Video surveillance for security purposes is governed by the GDPR (Regulation (EU) 2016/679) and by art. 22 of the LOPDGDD (Organic Law 3/2018), which authorises the capture of images to preserve the security of persons, property and premises. The duty to inform is completed by art. 13 GDPR and, where staff are affected, by art. 89 LOPDGDD. There is no prior AEPD authorisation: a set of obligations must be complied with from the design of the system.
Is it mandatory to display a video-surveilled area sign?
Yes. Art. 22(4) of the LOPDGDD requires a visible information device (the video-surveilled area sign) and keeping the extended information under art. 13 GDPR available. The AEPD publishes a guidance model sign that serves as a reference. Without a visible sign, the system does not comply with the duty to inform.
How long can camera images be retained?
They must be deleted within the period legally provided for by art. 22 of the LOPDGDD, as a general rule one month from their capture, unless they must be retained to evidence an incident against the integrity of persons, property or premises, in which case they are made available to the competent authority. They cannot be used for purposes other than security.
Can cameras be installed to monitor workers?
Within strict limits. Art. 89 of the LOPDGDD, together with art. 20.3 of the Spanish Workers' Statute, permits video surveillance for work monitoring if the workforce is informed in advance and expressly and the measure is proportionate. Art. 89(1) absolutely prohibits cameras in changing rooms, toilets, canteens and rest areas. Each case requires individual analysis.
Related reading
- Video surveillance in shops and retail — how to apply these regulations to the specific case of a physical establishment.
- Complete guide to the LOPDGDD — the Spanish legal framework within which art. 22 sits.
This content is purely informational and educational; it does not in any way constitute specialised legal advice. Applying the regulations to each specific case requires individual analysis. Spanish regional sectoral regulations may extend or modify deadlines and requirements.
Does your video surveillance system comply with the regulations?
At Certix we review your camera installation with a data protection expert: purpose, framing, signage, retention periods and information to staff. No commercial intermediaries, no generic templates.
Speak to an expert