Video surveillance in your business: sign, time limits and rights

If you have cameras filming customers, patients or employees in your business, the law requires you to put up a visible sign and to keep the recordings for a maximum of 1 month, unless they serve as evidence of a criminal offence (art. 22 of the Ley Orgánica 3/2018, de 5 de diciembre — LOPDGDD, Spain's data protection act). The sign must follow the official model of the Agencia Española de Protección de Datos (AEPD, Spain's data protection authority) and has no minimum size set by law: it only has to be "in keeping with the space" and "sufficiently visible". This article, reviewed on 16 July 2026, explains what the sign must carry, how long you can keep the images and what someone who appears on a recording can ask you for.

Contents

1. Do I need to put up a sign if I have cameras in my business?
2. What exactly must the sign say?
3. What size does the sign have to be?
4. Is the sign enough, or do I need to give more information?
5. How long can I keep the recordings?
6. Are there places where I can never put a camera?
7. Do I have to inform my employees separately from the sign?
8. What can someone who appears on my cameras ask me for?
9. What happens if I don't comply with these rules?
10. Frequently asked questions

---

Do I need to put up a sign if I have cameras in my business?

Yes, whenever the cameras capture images of identifiable people: customers, employees or anyone who comes into your premises. The obligation arises from article 22 of the LOPDGDD, which requires a "visible information device" wherever there are cameras, and from article 13 of the RGPD (the EU General Data Protection Regulation), which requires you to inform anyone who gives you their data — including when that data is their own image.

You do not need anyone's permission to record for security reasons: the legal basis is the business's legitimate interest in protecting people and property (art. 6.1.f RGPD). What the law requires in exchange is that you give notice with a visible sign, that you give the full information to anyone who asks for it, and that you do not record where you should not. That is exactly what this article covers.

Any device that captures images of people counts as a camera, even if it does not record them: if you only watch the live image without saving it, that viewing is already data processing and needs the same sign. The only difference is that there is no recording to keep or to delete.

What exactly must the sign say?

You do not draft the sign from scratch: the AEPD publishes an official model that has to be reproduced exactly as it is, without adding or removing fields. It carries:

• The heading «Zona videovigilada» (video-surveilled area), with the official camera pictogram.
• Data controller: the name of your business and your NIF.
• Where to exercise your data protection rights: your contact email address or that of your data protection officer, if you have one.
• Where to find more information: the URL of your privacy policy, or an address where it can be requested if you have no website.

It is the same sign that anyone recognises in the street: yellow background, black lettering, the drawing of the camera and those three pieces of information. It is not free text that you can summarise or adapt to your own style.

What size does the sign have to be?

There is no minimum size set by law. According to the legal report of the AEPD's Gabinete Jurídico (its legal service) on the dimensions of the sign, the only requirement is that the sign be "in keeping with the space where it is to be placed" and "sufficiently visible". A small shop can use a smaller sign; a large shop window, a bigger one. In practice, A4 is a convenient printing recommendation, not a legal obligation.

Nor does the sign need to be approved by any private security body: the obligation arises from data protection (art. 13 RGPD), not from private security rules. What is obligatory is that it is in place, that it can be seen, and that it can be seen before entering the recorded area, not once inside it.

Is the sign enough, or do I need to give more information?

The sign gives notice, but it cannot carry all the information, for lack of space. The AEPD itself points out in its practical video surveillance factsheets that the rest of the information under article 13 of the RGPD has to be made available to anyone who asks for it: what you use the cameras for, how long you keep the images, who else can see them and what rights the person filmed has.

That second layer of information is not hung on the wall: it is kept in your data protection folder and handed over to whoever asks for it, such as a customer, an employee or an inspector. In addition, if you process data on a regular basis — and cameras that record every day do — you have to include the video surveillance processing in your record of processing activities (RAT, art. 30 RGPD).

How long can I keep the recordings?

At most, 1 month from the day they were recorded (art. 22 LOPDGDD). Once that period has passed, you have to delete them; you cannot keep them "just in case". The only exception is when the images show a theft, an assault or any other criminal act: in that case you can keep them available to the police or to the court until the case is resolved.

This 1-month period is shorter than other periods you may know from your business, such as the 4 years for tax documents or the 6 years for commercial books. Do not confuse them: camera images have their own period, specific and much shorter.

Are there places where I can never put a camera?

Yes. The LOPDGDD expressly prohibits installing cameras in changing rooms, toilets and staff rest areas (art. 89 LOPDGDD), and the AEPD's practical factsheets extend that prohibition to any place of a similar nature or to spaces that are not yours. Nor can you point a camera towards the street or towards the business next door beyond what is essential for your own security: capturing a public space in a general way for security purposes has strict limits.

The practical rule is simple: a security camera records in order to protect your business, not to watch over anyone's privacy. If you are unsure whether a particular framing is right, the question to ask yourself is whether that image is necessary for security or whether you are recording more than you should.

Do I have to inform my employees separately from the sign?

Yes, if the cameras film your team while they work. The sign gives notice to anyone who comes into your premises, but your employees are also entitled to specific information in writing: where the cameras are, what you use them for, how long you keep the images and what they can ask you for (art. 89 LOPDGDD and art. 13 RGPD). It is not a permission they have to sign — you do not need their consent to have security cameras — it is information they have the right to receive.

Give it to them on their first day at work, together with the rest of the hiring paperwork. If you already had cameras and never formally explained this to your team, do it now: there is no deadline you have breached by not having done it earlier, but the sooner you do it, the sooner that item stops being outstanding.

What can someone who appears on my cameras ask me for?

The same six things they can ask about any other data of theirs (arts. 15 to 21 of the RGPD): to see the recording they appear in, to correct a detail that has been entered wrongly, to ask you to delete it, to ask you to stop using it for a time, to take it elsewhere or to object to your using it. If they ask to see a recording, ask them for the approximate day and time: it is usual to blur out the faces of other people who appear in the image in order to protect their privacy.

You have 1 month to reply from the moment you receive the request (art. 12.3 RGPD). If they believe you have not answered them properly, the person can complain to the AEPD through www.aepd.es (art. 77 RGPD). Complaining costs the complainant nothing.

What happens if I don't comply with these rules?

The AEPD is the body that oversees data protection in Spain, including video surveillance. It can ask for explanations, order changes or, in the most serious cases, impose a penalty. The RGPD sets the possible maximums at two levels: up to 10 million euros or 2% of annual worldwide turnover, and up to 20 million or 4%, depending on the infringement (art. 83 RGPD); whichever of the two is higher applies.

In practice, those figures are the legal ceiling, not the norm: the penalty is graded according to the seriousness, the size of the business and whether you have cooperated. A small business that puts up its sign, respects the 1-month period and does not record where it should not is outside that scenario. Complying with these rules is, above all, a matter of having two pieces of paper in order: the sign on the wall and the extended information on file.

If your business has many cameras, cameras with facial recognition or particularly extensive surveillance, an impact assessment (EIPD, art. 35 RGPD) may also be needed before you put them into operation. If that is your case, it is worth reviewing it with your gestoría (a firm that handles other businesses' administrative paperwork) before installing the system.

Frequently asked questions

Can I draft my own video surveillance sign instead of using the AEPD model? No. The sign reproduces the official AEPD model exactly as it is: same heading, same pictogram and the same three information fields. It is not a text you can summarise or personalise.

Does the sign have to be a particular size, such as A4? No. The AEPD does not set any minimum size: it only requires that it be proportionate to the space where you put it and that it be clearly visible. A4 is a practical printing recommendation, not a legal obligation.

Can I keep the recordings for more than 1 month "in case I need them"? No, unless the images show a theft, an assault or any other criminal act. In that case you can keep them until the case is resolved, available to the police or to the court. Beyond that, the maximum period is 1 month.

Can I put a camera in the changing room or the toilet of my business? No, never. The LOPDGDD expressly prohibits it, with no exceptions on security grounds.

Do I have to ask my employees' permission to install security cameras? You do not need their consent: the legal basis is the business's legitimate interest in its own security. You do have to inform them, with the sign and with specific written information about the cameras that film them.

---

How to carry on from here

Putting up the right sign and keeping the extended information about your cameras are two specific documents, not an open-ended task. At Tranquilia we generate them already filled in with the name, the NIF and the address of your business, in the same place where you keep the rest of your data protection folder.

👉 Generate the video surveillance sign for your business — free for up to 2 companies, no card and no time limit.

---

Report produced with Tranquilia — it does not constitute an official certification or a legal opinion. Always check specific cases with your gestoría or with a legal professional.

Primary sources cited in this article:

• Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD), arts. 22 and 89 — BOE
• Reglamento (UE) 2016/679 (RGPD), arts. 6, 12, 13, 15-21, 24, 30, 35, 77 and 83 — EUR-Lex
• Official model video surveillance information sign (AEPD)
• Practical video surveillance factsheets — General information (AEPD)
• Legal report of the AEPD's Gabinete Jurídico on the dimensions of the video surveillance sign
• Agencia Española de Protección de Datos (AEPD)