CCTV in your building: where cameras may point, how long you keep it

An apartment building may put CCTV in its common areas if the owners approve it, the cameras cover only what is needed and a sign announces them. Footage is normally kept for one or two days: under the European Data Protection Board's Guidelines 3/2019, keeping it beyond 72 hours calls for a stronger argument that it is still needed.

Footage from the entrance camera expires faster than the milk in the fridge. An association that installs a system hoping to build an archive, just in case something happens one day, tends to find out late that the European standard points the other way. In Ireland, the Data Protection Commission's CCTV guidance says footage may not be kept on a "just-in-case" basis and that, for a normal security system, retention beyond one month would be difficult to justify. Retention is only one of four decisions worth getting right: where the cameras point, how long footage is kept, what the sign says, and who may watch.

The camera in the hallway is nobody's private business

The Regulation carves out an exception for what each of us does in a purely household context, and plenty of boards assume the building's camera falls inside it. It does not. In the Ryneš judgment (C-212/13), the Court of Justice of the European Union held that a camera on a family home which also monitors part of a public space is no longer a purely personal or household activity. A camera in common parts records, by definition, dozens of people going about their day.

Whoever decides why the recording happens and what is done with it is the association or management company, acting as the controller. The firm that installs and maintains the system is a processor, and Article 28 GDPR requires a contract setting out what it may and may not do with the footage. If the engineer dips into recordings from the office without that contract, it is the association that has to explain it.

The installation is decided in the way each country's law requires, usually by a vote at a general meeting, and recorded in the minutes. That record is the first thing anyone asks for when a complaint lands. If the system is paid for through the service charge, every owner has a direct interest in seeing the decision written down; if the managing agent holds the paperwork, check it comes back to you when you change managing agent.

Where the camera may point, and where it may not

The principle governing all of this is minimisation: record the least that serves the stated purpose. A camera installed after a run of break-ins in the car park may cover the entry ramp; the same camera turned towards a ground-floor window protects nothing and watches a family.

The limits most often crossed by accident:

• The door or windows of one particular home are off limits, even when that neighbour is the suspect
• Public street may appear only in the narrow strip needed to cover the entrance
• Areas where staff rest or eat are not monitored
• Audio needs its own justification and rarely has one: a camera does not need to hear in order to deter

No camera goes up simply because someone wants it.

The usual lawful basis is the association's legitimate interest (Article 6(1)(f) GDPR), and the Guidelines require a real situation behind it (previous thefts, repeated vandalism, documented incidents) plus the absence of any less intrusive way to achieve the same end. Changing the lock or lighting the entrance properly comes first if that solves the problem. Put that reasoning in writing before installing: it is exactly what gets asked afterwards.

A note on the law: dummy cameras fall outside the Regulation altogether, since they process no personal data. Then again, they deter nobody who looks twice, and a sign presenting them as real can create trouble by other routes. If the association wants deterrence without recording, better to say so plainly.

How long the footage may be kept

Start by checking what retention period the installer's recorder is set to. If it loops until the disk is full, the size of the disk is choosing your retention period, not the association. The Irish DPC is explicit that a device's default retention period should be reviewed against the controller's own assessment of what is necessary. The European criterion is one or two days as a rule, and the longer the period, the heavier the argument needed to show it is still necessary.

The logic is straightforward. If nobody has reported anything within three days, that footage no longer serves the purpose that justified the camera; it is simply a log of your neighbours' movements waiting to leak. The Guidelines recommend erasing it after a few days, ideally automatically, and a scheduled deletion is also the best evidence that the system is set up properly.

When something does happen, the right move is to extract and preserve that specific sequence for whoever needs it, without extending the retention period across the whole system because an incident occurred once. Agree in advance who can do that: the Guidelines suggest nominating, where necessary, a person responsible for screening and securing video material. If the board learns on Monday that a car was scratched on Saturday and nobody knows the recorder's password, a 48-hour loop may already have overwritten the sequence before the installer calls back.

The sign: what residents must know before they walk in

Information is given in two layers. The first is the sign, placed visibly before anyone enters the monitored area so they can decide whether to walk through it: who is recording, why, how long footage is kept and where to exercise their rights.

The second layer is the full information, which will never fit on a sign and has to sit somewhere reachable: the lawful basis, the exact retention period, who the processor is, whether footage is disclosed to the police and how to complain. A link, a QR code or the notice board all work; "the managing agent has it" does not.

Who may watch the recordings

Fewer people than most assume. Who gets access is decided by the association (the chair, the caretaker, the managing agent or the security company) and that designation is worth recording in the minutes, like the rest of the system. Access to the viewer is not a perk of office: it is limited to the person designated, with their own login and, where the system allows, a log of every viewing. And even they do not watch the footage at will, only when there is a concrete reason: an incident, a crime, a police or court request. A chair who scrolls through footage out of curiosity is processing data with no lawful basis, and so is the neighbour who asks to see "who took the bins out last night".

Be careful with a screen at the concierge's desk. The Guidelines ask for monitors to be positioned so that only authorised operators can see them, especially in open areas such as a reception. A live screen that anyone waiting for the lift can glance at fails that test.

Anyone who appears in a recording may request a copy, but only of their own images, and the right of access under Article 15 GDPR is narrower than it sounds: they must provide the day and approximate time so the footage can be located, and if the retention period has already erased it, the correct answer is to confirm the deletion. When the sequence does exist, it is handed over with third parties obscured; and if they cannot be obscured without making the image useless, access can be limited, because Article 15(4) says a copy must not adversely affect the rights and freedoms of others.

And the case everyone has in mind (seeing who scratched the car or who left a sofa next to the bins) is not a right of access at all: those images identify a third party and are handed only to the police or the courts. What the affected neighbour can ask is that the association extract the sequence and keep it for the authorities, not watch it themselves.

An association with well-planned cameras keeps four documents to hand: the resolution from the meeting, the reasoning for why cameras were necessary, the contract with the installer and the wording of the sign. With those, a complaint takes an afternoon to answer. In Vecinly those documents sit with the minutes in the building's document store, so the next board president finds them without asking anyone.

Before the next meeting, check what retention period the recorder shows. If it says 30 days and nobody knows why, you have your first agenda item.

Information updated September 2026. This article is for general information only and does not constitute legal advice.