CCTV is lawful when its legal basis is documented in advance, generally legitimate interests under Article 6(1)(f) GDPR, and everyone entering the monitored area receives the required information. A balancing test comparing your interests with the privacy intrusion must exist before cameras start operating. At work, Section 13(4) of the Labour Code additionally requires prior consultation with employee representatives on the monitoring mechanism and notification to employees.
Cameras above the till, in the warehouse and in corridors are standard shop equipment today. Legally, however, two assessments are needed. The system must satisfy the GDPR for everyone entering its field of view and, at work, the Labour Code in relation to employees.
The legal basis is usually legitimate interests, rather than consent
Obtaining every customer’s consent would be impractical in a shop and is generally unnecessary. In Guidelines 3/2019 on processing personal data through video devices, the European Data Protection Board primarily envisages the controller’s legitimate interests under Article 6(1)(f) of Regulation (EU) 2016/679 (GDPR); consent is relevant only exceptionally. Legitimate interests may be legal, economic or non-material, typically protecting property against theft and vandalism and ensuring personal safety.
The balancing test must exist before cameras start operating
Legitimate interests must be assessed before using cameras. The Czech data protection authority’s February 2024 CCTV methodology provides guidance. Since both countries apply the same Regulation, its reasoning is also useful in Slovakia. This assessment, commonly called a balancing test, is completed and documented before processing begins. First, substantiate a real threat, such as a history of thefts, burglaries or damage to goods, rather than a general sense of risk. Next, consider whether a less intrusive measure could achieve the same purpose, then balance your interest against the privacy intrusion for people captured.
Data minimisation under Article 5(1)(c) GDPR is related: cameras should cover tills, entrances and shelves, not changing rooms, toilets or the entire pavement outside. Recordings should be retained only as long as necessary. Large-scale systematic monitoring of publicly accessible areas also requires a data protection impact assessment under Article 35(3)(c) GDPR.
Information has two layers
The EDPB guidelines use layered notices. The first layer is a warning sign positioned so people see it before entering the monitored area, providing the key processing details. The second contains full information that is easily accessible, for example at the till or online. An unmarked camera is difficult to defend during inspection even if the balancing test is otherwise sound.
Section 13 of the Labour Code also applies at work
The GDPR alone is insufficient for employees. The Labour Code (Act No. 311/2001 Coll.) permits workplace monitoring only for serious reasons and prescribes a specific procedure:
An employer must not, without serious reasons arising from the particular nature of its activities, interfere with an employee’s privacy at the workplace and in the employer’s common areas by monitoring them […] without prior warning. When introducing a monitoring mechanism, the employer shall consult employee representatives on its scope, method and duration, and inform employees of its scope, method and duration.
— Section 13(4) of the Labour Code (unofficial English translation)
Where there are no employee representatives, the employer may act independently under Section 12(2) of the Labour Code. The duty to inform employees in advance of the scope, method and duration remains. In practice, both are addressed in an internal monitoring policy, which also serves as evidence during inspection. We discuss broader processing duties in what the GDPR requires.
How we can help
Our GDPR and personal data protection service covers the balancing test, information notices and retention periods. Our internal regulations and policies service covers the monitoring policy and consultation with employee representatives. For larger-scale processing, we also assess whether you need a data protection officer.
If cameras are already operating without documentation, contact us before a dissatisfied employee or customer makes a complaint.
This answer provides general information on the law as at 29 August 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.
