GDPR Video Surveillance at the Workplace: Section 4 BDSG and DPIA

Main article: Creating a record of processing activities 2026 — how to set up the record of processing activities under Art. 30 GDPR; video surveillance needs its own entry there (section 9).

1. Requirements of § 4 BDSG

Clarify the scope first: § 4 of the German Federal Data Protection Act (BDSG) carries the official heading "Video surveillance of publicly accessible spaces" and, under § 4(1) BDSG, covers exclusively the monitoring of publicly accessible spaces — that is, reception, customer areas, sales floor and car park. There, video surveillance is only permissible to the extent that it is necessary for the performance of the tasks of public bodies, for the exercise of domiciliary rights or for the pursuit of legitimate interests for specifically defined purposes, and where there are no indications that overriding interests of the data subjects deserving protection prevail.

For working areas that are not publicly accessible (office, warehouse, production, workshop), § 4 BDSG does not apply. The legal basis here is § 26(1) BDSG (data processing for the purposes of the employment relationship) in conjunction with Art. 6(1) GDPR. In both constellations the same applies: document proportionality (the grid at the end of this section) and carry out a DPIA where there is a likely high risk (see section 6).

Both constellations additionally require a condition from Art. 6(1) GDPR: processing is lawful only if at least one of the six grounds listed there is met — consent, contract, legal obligation, vital interests, public interest or legitimate interest (point (f)). For public authorities, point (f) is unavailable in the performance of their tasks. Anyone basing cameras on consent must be able to demonstrate that the data subject has consented; consent can be withdrawn at any time, and withdrawal must be as easy as giving it (Art. 7(1) and (3) GDPR). Austria has no employee data protection provision comparable to § 26 BDSG; which rules take its place there is set out in section 8.

Practical recommendation: record proportionality for each camera in writing in four steps — (1) which specific purpose is pursued (domiciliary rights, protection of property, occupational safety); (2) whether and how the camera contributes to that purpose; (3) which less intrusive means were examined — locking systems, lighting, access control, limiting recording to night-time hours, masking of sub-areas — and why they are not sufficient; (4) why the interests of employees deserving protection do not prevail, in particular with a view to surveillance pressure and coverage density. Step 4 is exactly the question that § 4(1) BDSG asks for publicly accessible spaces; the following sections refer back to this four-step grid.

2. Duty to put up notice signs

A notice sign must be displayed ahead of every recorded area, naming the controller, the purpose, the storage period and the contact details of the data protection officer. The legal anchor is the duty to provide information at the point of collection: it follows directly from Art. 13 and Art. 14 GDPR — in Austria the DSG contains no separate rule on this, and the GDPR articles apply there unchanged.

Two points are regularly overlooked. First, the information must also cover the right to lodge a complaint with the supervisory authority (Art. 13(2)(d) GDPR); in Austria the Austrian Data Protection Authority (Datenschutzbehörde) must be named as the complaints body. In Germany, the authority responsible for non-public bodies is the one competent under Land law (§ 40(1) BDSG). Second, in Austria the standalone labelling obligation under § 13(5) DSG applies alongside the information under Art. 13 GDPR; both duties must be met side by side.

Practical recommendation: record the sign text, the location of each sign and the date it was put up in the record-of-processing entry for video surveillance (section 9) — the labelling can then be evidenced without an on-site inspection.

3. Storage period

As a practice standard, businesses delete or overwrite video recordings after 48 to 72 hours; following an incident, the secured sequence may be kept until the investigation is concluded, and storage beyond that only where there is a specific reason. Fourteen days is regarded as the outer practice limit; it comes into consideration as a practical recommendation only where the purpose suggests that the incident may be discovered later — for instance in areas that are only visited at longer intervals — and where the justification for each camera is set out in the record-of-processing entry. The 48 to 72 hours, the securing of a sequence after an incident and the 14 days are practice values.

Austria turns the mark into a rule: § 13(3) DSG attaches to the same 72 hours, but turns it into a duty to justify and log. Retention lasting longer than 72 hours must be proportionate and must be separately logged and justified. So anyone storing for two weeks in Austria needs a documented proportionality justification and a log entry for exactly that duration — not merely a recorder setting.

In both countries the envisaged erasure period belongs in the record-of-processing entry: Art. 30(1) GDPR counts the envisaged time limits for erasure of the categories of data among the mandatory particulars. Practical recommendation: set automatic overwriting on the recorder and record the exceptional case — securing a sequence after an incident — with date, reason, purpose and responsible person in a separate log.

4. Prohibited areas

Video surveillance is not permitted in toilets, changing rooms, break rooms and sick rooms; in addition, under BAG 1 ABR 16/22, permanent covert recording at the workplace is not permitted — on the narrowly limited suspicion-based exception, see the FAQ "Is covert video surveillance at the workplace permitted?".

Austria takes the purpose as its starting point, not the location: § 12(4) no. 2 of the Austrian Data Protection Act (DSG) expressly declares image recording for the purpose of monitoring employees to be impermissible. What matters is therefore what the system is operated for, not solely which room is in the picture. § 12 DSG is the Austrian special rule on the admissibility of image recordings; § 13 DSG supplements it with specific data security measures and the labelling requirement.

Practical recommendation: draw up a camera plan — for each camera the location, field of view, purpose and the areas deliberately left out or masked. It is the basis for the proportionality assessment under the four-step grid from section 1, for the DPIA (section 6) and, in Austria, for defining the purpose against which § 12 DSG measures the admissibility of the image recording.

5. Works council co-determination

In Germany, video surveillance at the workplace is subject to mandatory co-determination by the works council under § 87(1) no. 6 of the German Works Constitution Act (BetrVG); without its consent, evaluating the recordings is not permitted. Practical classification: where there is no works council, the co-determination right does not arise — the proportionality assessment under the four-step grid (section 1), the information under Art. 13 GDPR (section 2) and the documentation in the record of processing activities (section 9) remain mandatory unchanged; determining who may view recordings then belongs in an internal access rule rather than in a works agreement.

Austria does not run via the BetrVG but via the ArbVG: monitoring measures that affect human dignity are permitted there only with the consent of the works council or on the basis of a works agreement (§ 96(1) no. 3 of the Austrian Labour Constitution Act (ArbVG)). What matters is therefore not the location of the camera but the monitoring character of the measure.

Practical recommendation: set out in the agreement who may view recordings, under which four-eyes principle and on what occasion, and refer to the same deletion cycle as the record-of-processing entry names. An agreement that deviates from the actual storage period creates a contradiction between the works agreement and the record-of-processing entry — both lie side by side on the table when a supervisory authority makes enquiries.

6. DPIA obligation

The DPIA obligation attaches to the likely high risk (Art. 35(1) GDPR), not to a headcount — with systematic video surveillance of employees such a risk is likely according to practical assessment; there is no statutory presumption. Art. 35(3)(c) GDPR names as a standard example "a systematic monitoring of a publicly accessible area on a large scale" — the provision knows no threshold based on headcount. Whether video surveillance of employees is subject to a DPIA therefore follows from Art. 35(1) GDPR (likely high risk on account of the nature, scope, context and purposes) as well as from the mandatory lists published by the supervisory authorities under Art. 35(4) GDPR; in Austria, the mandatory list of the Datenschutzbehörde expressly names observation, monitoring or control by means of image processing as a criterion (DSFA-V, BGBl. II No. 278/2018). What counts is the list of the supervisory authority competent for you: in Germany the authority competent for non-public bodies under Land law (§ 40(1) BDSG), in Austria the Datenschutzbehörde (§ 18(1) DSG). Practical recommendation: check that list before putting into service and record the result — hit or no hit — in the DPIA pre-assessment.

The frequently repeated limit of 20 persons comes from § 38(1) BDSG and concerns the appointment of a data protection officer — it is not a DPIA threshold. Conversely: if processing is subject to a DPIA under Art. 35 GDPR, a DPO must be appointed under § 38(1) sentence 2 BDSG regardless of headcount.

Art. 35(3) GDPR names two further standard examples that can apply to camera systems: a systematic and extensive evaluation of personal aspects with legal effect (profiling) and processing on a large scale of special categories of data under Art. 9 GDPR — the latter, for instance, with large-scale facial recognition (section 7). Practical classification: for a video system this can become relevant as soon as statements about individual employees are derived from the images in an automated manner — such as attendance, movement or performance patterns — and decisions are linked to them. "Prior" here means: before the system is put into service, not in subsequent documentation.

The GDPR assigns responsibility for the DPIA and the use made of it to two places. Where a data protection officer has been appointed, advising on the data protection impact assessment is one of their statutory tasks (Art. 39(1)(c) GDPR). Vis-à-vis the supervisory authority, the DPIA is, in practical experience, one of the four pieces of evidence regularly requested (section 9). Practical recommendation: build the assessment on two elements that should exist anyway — the camera plan from section 4 (location, field of view and purpose per camera) and the four-step grid from section 1 (purpose, suitability, less intrusive means, balancing) — and additionally record which protective measures reduce the residual risk: limited recording times, masked image areas, access restrictions and automatic deletion.

Austria: Art. 35 GDPR applies unchanged. What differs is the consequence for the data protection officer — Austria provides for no numerical appointment threshold going beyond Art. 37 GDPR; the duty there follows directly from Art. 37 GDPR, for example where the core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale (Art. 37(1)(b) GDPR). The German link in § 38(1) sentence 2 BDSG does not apply in Austria.

7. AI-based video analysis: the prohibitions of the AI Act

As soon as an AI system within the meaning of Art. 3(1) of the EU AI Act (Regulation (EU) 2024/1689) analyses the images, the AI Act applies alongside the GDPR — and three of its prohibitions can affect the analysis of workplace cameras. Art. 3(1) AI Act means by this a machine-based system that is designed to operate with varying levels of autonomy and that infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions. Under Art. 5(1) AI Act, the following are prohibited, among others: emotion recognition in the workplace and in education institutions (point (f)), the untargeted scraping of facial images from the internet or CCTV footage (point (e)) and biometric categorisation to deduce sensitive attributes (point (g)). These prohibitions have applied since 2 February 2025; the Regulation applies in principle since 2 August 2026. The high-risk obligations of Chapter III, Sections 1 to 3 apply to systems under Art. 6(2) and Annex III from 2 December 2027 and to systems under Art. 6(1) and Annex I from 2 August 2028 (Art. 113(3) AI Act as applicable since 27 July 2026 under Regulation (EU) 2026/1744).

Outside the prohibited zone, the classification still has to be examined: "employment, workers management and access to self-employment" is one of the eight areas of Annex III in which the AI systems listed there are deemed high-risk under Art. 6(2) AI Act; "biometrics" is another. Allocation to one of these areas does not, however, settle the classification on its own: a system named in Annex III exceptionally is not deemed high-risk where it does not pose a significant risk to health, safety or fundamental rights — unless it performs profiling of natural persons (Art. 6(3) AI Act). The classification is therefore an assessment of the specific system, not of the product category. Where such a system is permissible outside the prohibitions of Art. 5 AI Act, deployers of emotion recognition or biometric categorisation systems must inform the persons concerned (Art. 50(3) AI Act). Infringements of the prohibitions in Art. 5 are subject to fines of up to EUR 35,000,000 or — in the case of undertakings — up to 7 % of total worldwide annual turnover for the preceding financial year, whichever is higher (Art. 99(3) AI Act).

In data protection terms, Art. 9 GDPR comes on top: the processing of biometric data for the purpose of uniquely identifying a natural person is prohibited, with exceptions governed by Art. 9(2) GDPR — for instance explicit consent. Facial recognition on camera images is therefore not a mere added function of the system but requires an exception of its own.

8. Austria: what applies alongside §§ 12, 13 DSG

The image recording provisions §§ 12 and 13 DSG are the special rule, not the whole set of duties. The Austrian DSG contains no separate employee data protection provision comparable to § 26 BDSG; what counts are Art. 6 and Art. 88 GDPR. The employment context is given concrete form there via § 12(4) no. 2 DSG (section 4) and the works agreement under § 96(1) no. 3 ArbVG (section 5). German supplementary provisions — § 26 BDSG as well as § 38(1) BDSG — do not apply in Austria.

Three further provisions belong in an Austrian video concept. § 6 DSG (data secrecy) obliges controllers, Data Processors and their staff to maintain confidentiality — that concerns every person with access to the monitor, the recorder or exports. § 11 DSG provides for the proportionate application of Art. 83 GDPR by the Datenschutzbehörde, in particular a warning instead of a fine for first-time infringements. § 62(1) DSG additionally penalises administrative offences of its own — up to EUR 50,000, unless the act already constitutes an offence under Art. 83 GDPR or is subject to more severe penalties under other administrative penal provisions; covered is, for example, intentionally obtaining unlawful access to a data processing operation or intentionally transmitting data in breach of data secrecy (§ 6 DSG). The Datenschutzbehörde is competent to decide.

Practical recommendation: bring the points together in a video surveillance concept under §§ 12, 13 DSG — purpose and admissibility under § 12 DSG, camera plan, labelling under § 13(5) DSG, retention including justification and log under § 13(3) DSG, authorised users and their commitment to data secrecy under § 6 DSG.

9. Documentation: record of processing activities, data processing agreement and evidence for the supervisory authority

Video surveillance is a processing activity in its own right and needs its own entry in the record of processing activities — "video surveillance of the works hall / outdoor area" is one of the typical SME entries under Art. 30 GDPR. The exemption in Art. 30(5) GDPR rarely helps: it applies only cumulatively — fewer than 250 employees AND no risk to the rights and freedoms of data subjects AND no regular processing AND no special categories under Art. 9 or criminal-law data.

Where a service provider operates the system or the recordings are held in its cloud, that is regularly processing on behalf of a controller; the distinction from joint controllership (Art. 26 GDPR) has to be examined and documented — in practical experience, confusing the two roles is a frequent source of errors in records of processing activities. Practical recommendation on the distinction — the criterion is who decides on purposes and means: if your business specifies field of view, purpose, storage period and access rights and the service provider merely operates the system on instructions, it remains processing on behalf of a controller under Art. 28 GDPR; if the service provider co-decides on purposes or analyses recordings for its own purposes, joint controllership under Art. 26 GDPR is likely — the result, with reasons, belongs in the record-of-processing entry. For processing on behalf of a controller the following applies: the controller may only work with Data Processors who provide sufficient guarantees of appropriate technical and organisational measures, and needs a contract containing the particulars of Art. 28(3) GDPR — subject matter and duration, nature and purpose, type of data, categories of data subjects as well as the obligations and rights of the controller. If recordings leak, Art. 33(1) GDPR applies: notification to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to the rights and freedoms; where a high risk is likely, communication to the data subjects under Art. 34(1) GDPR is added.

A picture from supervisory practice: the record of processing activities is regularly the first piece of evidence requested; then follow the data processing agreement, the technical and organisational measures and the DPIA. Anyone who has mapped video surveillance there cleanly delivers all four pieces of evidence in one go. For the video system, the third point means, in concrete terms — as a practical recommendation: personalised logins for the recorder and the live monitor instead of a shared password, a log of every access and every export, encrypted storage of exported sequences, a locked installation site for the recorder and a written determination of who may view recordings (section 5). In the record of processing activities, a reference to the central technical and organisational measures concept under Art. 32 GDPR is sufficient for this — the measures are not repeated for each processing activity.

The following overview lists the duties that regularly coincide with a video system, together with the trigger and the source. The rows marked (DE) or (AT) apply only in the respective jurisdiction; the rows on the data breach, on data subject requests and on justifying and logging retention beyond 72 hours (AT) concern ongoing operation, while the remainder are to be dealt with before putting into service.