Cameras and GDPR: what you can record at your house and business

A camera system is one of the most effective ways to prevent burglary and vandalism — but it also records personal data, so its operation is governed by the GDPR and the Czech Civil Code (protection of personality and privacy). In this guide we walk through the most common real-world scenarios: a family house, a video doorbell, a business and an apartment building. For each one you will learn what you may do, what you must not do, and under what conditions.

When the GDPR applies to your camera

The GDPR does not apply to data processing in the course of a purely personal or household activity — the so-called household exemption under Article 2 GDPR. If the camera captures only your own house, flat and land, you have no GDPR duties to deal with.

However, as soon as a recording camera covers public space or someone else's property, the household exemption no longer applies. This was confirmed by the Court of Justice of the EU in the Ryneš judgment, which concerned precisely a camera on a family house in the Czech Republic. In that case you become a personal data controller with all the related duties: legitimate interest, information duty, proportionate retention period.

Family house: your own land, the street and the neighbour

• Your own land and house — you may record without restriction. Aim the camera at the entrance door, driveway, garden and facade.
• Public street and pavement — only to the extent necessary. A narrow strip immediately in front of the driveway or entrance gate is acceptable if it is needed to protect property (for example because of vandalism to the facade or thefts near the driveway). Covering the whole street or the opposite pavement is disproportionate. Most modern cameras support privacy mask zones — you can permanently black out part of the image directly in the settings.
• Your neighbour's property — never without their consent. A view into a neighbour's garden or windows interferes with privacy protected by the Civil Code and the neighbour can even defend themselves in court. The solution is physically re-aiming the camera, a shorter focal length, or a privacy mask zone.

Doorbell camera (video doorbell)

A video doorbell by its nature points into the street, so a stricter view applies. Safe operation looks like this:

• set the view as tightly as possible on the space in front of the door, not the whole street,
• prefer a mode where recording is triggered by a ring or by motion detection at the door, instead of continuously recording public space,
• keep recordings only briefly and delete them as soon as they are no longer needed.

Business: employees and customers

Employees: workplace monitoring is only possible for serious reasons, typically protection of property (warehouse, till, entrances). The employer has an information duty — employees must know in advance where the cameras are, what they capture and why. An absolute ban applies to changing rooms, toilets, showers and rest rooms — a camera must never be there. Cameras must also not be used for blanket monitoring of work performance.

Customers: you may monitor a shop, premises or car park on the basis of legitimate interest (protection of property, safety of persons). The condition is a visible information sign before the entrance — customers must know about the monitoring before they enter the area. Hidden cameras are not permissible.

Apartment building and homeowners' associations

In an apartment building, the installation of cameras is decided by the assembly of the homeowners' association (or the housing cooperative) — a decision by a single owner is not enough. You may monitor common areas with a justified risk: entrance doors, cellars, bicycle rooms, garages or lifts. Cameras must not capture the entrances to individual flats more than strictly necessary, and never the flats themselves. All residents of the building must be informed about the system (a sign + more detailed information e.g. on the notice board).

How long you may keep recordings

The GDPR sets no fixed period — the principle of proportionality applies. The Office for Personal Data Protection has long recommended keeping recordings only for the time necessary to detect an incident; in practice:

• family house, flat: usually up to 7 days,
• businesses and apartment buildings: usually up to 14 days; a longer period must be justified (e.g. premises open seasonally),
• after an incident: you may export the specific recording and keep it for as long as the matter is being resolved (handover to the police, the insurer).

Loop overwriting is set directly in the recorder — older recordings are overwritten automatically.

Information sign: what it must contain

Every monitored area accessible to other people must be marked before the entrance. The sign contains:

• a camera pictogram and the text "This area is monitored by a camera system with recording",
• the controller's identity (name / company name) and contact details,
• the purpose of processing (e.g. protection of property and safety of persons),
• a reference to where the data subject can find detailed information (website, reception, notice board) — including the retention period and information about their rights.

Registration and the balancing test

Good news: registration of camera systems with the Office for Personal Data Protection was abolished with the arrival of the GDPR in 2018. It was replaced by the principle of controller accountability:

• balancing test — if you operate cameras on the basis of legitimate interest (Article 6 GDPR), you should be able to demonstrate that your interest in protecting property outweighs the interference with the privacy of the people captured,
• records of processing activities — an internal document describing the purpose, scope, retention period and security (relevant mainly to companies and homeowners' associations),
• data protection impact assessment (DPIA) — required only for large-scale systematic monitoring of publicly accessible areas; it does not apply to an ordinary house or a small shop.

Overview: what you may and may not do

Frequently asked questions

Do I have to register the camera on my family house anywhere?

No. The registration duty was abolished with the arrival of the GDPR in 2018. For a home camera capturing only your own property you do not even need documentation; if the camera extends into public space, you must be able to justify the operation and mark it with a sign.

My neighbour's camera looks into my garden. What can I do?

First ask your neighbour to re-aim the camera or set up a privacy mask zone. If they do not comply, you can file a complaint with the Office for Personal Data Protection or defend yourself with a personality-protection lawsuit under the Civil Code.

Can I use camera footage as evidence for the police?

Yes. Hand the recording of the incident (burglary, property damage) over to the police — that is exactly the purpose for which you operate the system. For this purpose you may keep the recording longer than the standard period, for as long as the matter is being resolved.

Do I need an information sign on a family house too?

If the camera captures only your own property, a sign is not mandatory (but it does no harm — it has a deterrent effect). If the view extends into public space, the sign is mandatory.

May I record audio as well?

We do not recommend it. Audio recording is a considerably more invasive interference with privacy and is considered disproportionate for ordinary camera systems. On PATRONUM cameras, audio recording can easily be switched off in the settings.

Related: GDPR and the camera system — what you must comply with