27/10/2026
Video surveillance systems have become a standard component of the security infrastructure of public institutions and businesses. Their use is intended mainly to protect people and property, prevent incidents and ensure an adequate level of control over access to certain areas. Technological development, however, has substantially changed the nature of these systems, which can no longer be analysed solely in terms of the physical equipment installed.
IP cameras, recording equipment, video management platforms, cloud storage services and applications allowing remote access form an interconnected IT ecosystem. Its operation depends on software, network configuration, authentication mechanisms and the ability of manufacturers and administrators to identify and remedy security vulnerabilities.
In these circumstances, the compromise of a surveillance system does not merely mean the temporary loss of footage or the unavailability of equipment. Such an incident may allow unauthorised access to recordings, the disclosure of personal data, the alteration or deletion of material with evidential value and, in certain situations, the use of the compromised infrastructure as an entry point into the organisation's other IT systems.
The guide “Security of Surveillance Systems”, published by the National Cyber Security Directorate (DNSC) in October 2026, reflects this change of perspective by treating surveillance systems as IT infrastructures whose security must be ensured throughout their entire period of use.
From a legal point of view, this development calls for an integrated analysis of the obligations relating to the guarding of premises, cybersecurity, personal data protection, public procurement and contractual liability. The mere existence of a functioning system or the installation of high-performance equipment does not, in itself, demonstrate compliance with all applicable legal obligations.
The legal regime of video surveillance systems is determined by the purpose for which they are used, the technical characteristics of the infrastructure, the nature of the data processed and the status of the organisation operating the system.
A first point of reference is Law No 333/2003 on the guarding of premises, goods and valuables and the protection of persons, together with its implementing rules approved by Government Decision No 301/2012, insofar as the system falls within the scope of that framework. These provisions must be taken into account in relation to the requirements governing the organisation of physical security measures and the use of technical means of protection.
At the same time, Regulation (EU) 2016/679 on the protection of personal data (GDPR) becomes relevant where the system allows natural persons to be identified directly or indirectly. Recording images of people entering an institution, commercial premises or a production facility is, as a rule, a personal data processing operation subject to the principles and obligations laid down in the Regulation.
A third legislative layer is Government Emergency Ordinance No 155/2024 establishing a framework for the cybersecurity of networks and information systems in the national civilian cyberspace, approved with amendments and additions by Law No 124/2025. The applicability of the obligations laid down in that act must be determined according to the entity's specific classification within the regulated categories and the conditions laid down by law. Not every organisation that uses video cameras becomes, for that reason alone, an entity subject to all the obligations specific to the NIS2 regime.
In addition, for products with digital elements, the provisions of Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements, known as the Cyber Resilience Act, may be relevant, in accordance with its phased application timetable.
Depending on the system's functionalities, the applicability of Regulation (EU) 2024/1689 on artificial intelligence must also be examined, in particular where advanced video analytics or biometric identification mechanisms are used.
These legislative acts must not be applied mechanically or confused with one another. Each lays down distinct obligations, which must be identified in light of the organisation's activity, its technical architecture and the operations actually carried out.
One of the most important legal aspects of video surveillance is the lawfulness of processing images and the proportionality of the monitoring measures.
Under the principles laid down in the GDPR, the controller must determine, before installing the system, the purpose of the processing, the legal basis, the categories of data collected, the persons who may access the recordings and how long they will be kept. Video surveillance cannot be justified solely by a general reference to security, without an analysis of the necessity and proportionality of the measure in relation to the aim pursued.
Where the processing is based on legitimate interest, the controller must be able to demonstrate the existence of the interest invoked, the necessity of the processing and the balance between that interest and the rights and freedoms of the data subjects. In other situations, the legal basis must be identified in light of the specific circumstances and the rules applicable to the activity carried out.
Particular attention must be paid to the monitoring of employees. An employment relationship does not give the employer an unlimited right to monitor, and the employee's consent is generally not an appropriate legal basis where the imbalance between the parties affects whether it is freely given. Monitoring must be justified by a legitimate aim, limited to what is necessary and organised in compliance with the safeguards provided by the applicable legislation.
Similarly, cameras must be positioned in a way that respects reasonable expectations of privacy. Monitoring toilets, rest areas or examination and treatment rooms raises particularly serious legal issues and cannot be legitimised simply by displaying a notice about the presence of cameras.
Informing data subjects is another essential obligation. Visible signage before entering the monitored area must be supplemented by the information required by Article 13 GDPR, in an accessible form. The controller must also ensure that data subjects can effectively exercise their rights, including the right of access, while protecting the rights and freedoms of other persons captured in the recordings.
The retention period for footage must be set according to the specific purpose of the processing and the need to keep the data. There is no general justification for storing recordings indefinitely, and access to and export of footage must be subject to clear, documented and verifiable rules.
In the situations provided for in Article 35 GDPR, the controller must carry out a data protection impact assessment before processing begins. Whether such an assessment is needed must be examined in light of the nature, scope, context and purposes of the operations, and of the criteria applicable to processing likely to result in a high risk to the rights and freedoms of natural persons.
Data protection cannot be effectively ensured without appropriate cybersecurity measures. An organisation may have formal documentation on video surveillance and may properly inform data subjects, yet remain exposed to significant risks if the equipment is poorly configured or access to recordings is not controlled.
Article 32 GDPR requires the controller and, where applicable, the processor to adopt appropriate technical and organisational measures to ensure a level of security appropriate to the risk. The assessment must take into account the state of the art, the costs of implementation, the nature and purpose of the processing and the risks to data subjects.
For surveillance systems, appropriate measures may include replacing default credentials, using individual accounts, limiting administrative privileges, encrypting communications, updating firmware, disabling unnecessary services and keeping logs of access and configuration changes.
Remote access requires particular attention. Exposing cameras or recording equipment directly to the internet through unjustifiably open ports may create an access route for unauthorised persons. Where remote administration is necessary, it should be carried out through secure mechanisms controlled by the organisation and, where appropriate, with multi-factor authentication.
Separating the surveillance system from the general IT network can also limit the spread of an incident's effects. Network segmentation, restricted communications and documentation of the technical architecture help reduce the risk that a compromised camera or vulnerable recording device will allow access to the organisation's other IT resources.
From a legal perspective, these measures should not be seen merely as technical recommendations independent of the controller's obligations. Insofar as they are necessary to meet the applicable legal requirements, their absence may become relevant when assessing whether the security measures adopted were appropriate.
However, no incident automatically gives rise to the controller's liability. The analysis must take into account the obligations actually applicable, the risks that could reasonably have been identified, the measures adopted and the specific circumstances in which the incident occurred.
A frequently overlooked point is that the security of a surveillance system begins before the equipment is installed, namely at the stage of defining requirements and selecting the supplier.
For contracting authorities, the procurement documents must be drawn up in line with the aim pursued, the needs identified and the applicable public procurement rules. The assessment of solutions should not be reduced to the initial price, camera resolution or storage capacity, but should also take into account the possibility of secure administration, the availability of updates, the duration of technical support, interoperability and dependence on the supplier.
From this perspective, the specifications should include verifiable requirements on authentication, access control, logging, encryption, security updates, backups, restoration and the technical documentation handed over to the beneficiary.
Equally important is the contractual regulation of the supplier's access. The contract must clarify under what conditions the system may be accessed, who authorises interventions, how operations are recorded and when access rights are revoked. If the supplier or integrator has access to personal data, the legal characterisation of the relationship between the parties must also be examined, including whether a contract under Article 28 GDPR is required where the conditions applicable to a processor are met.
It is also useful to include clauses on vulnerability notification, availability of updates, incident response times, the duration of technical support and the handover of the documentation needed to administer the system independently.
Acceptance should not be limited to confirming the delivery and installation of the equipment. It should allow verification of the contracted functionalities, security settings, accounts and roles, logging, backup mechanisms and the delimitation of the supplier's access.
A purely formal acceptance may carry vulnerabilities into the operational phase that are harder and more costly to remedy later. For this reason, documenting the checks carried out and recording any non-conformities identified has both operational and legal value, including in any subsequent disputes over performance of the contract.
The compromise of a surveillance system may give rise to different forms of liability, depending on the nature of the obligation breached, the status of the person responsible and the consequences that ensue.
In the field of data protection, breaches of GDPR obligations may lead to corrective measures and, where the legal conditions are met, administrative fines. Where material or non-material damage results from an infringement of the Regulation, the compensation mechanism provided for in Article 82 GDPR may also apply, under the conditions laid down therein.
Contractually, liability may arise where the supplier fails to meet its obligations regarding product security, updates, technical support, confidentiality or the remedying of defects. Conversely, legal consequences may also arise for the beneficiary where it does not comply with the terms of use, does not properly manage access or does not fulfil its own obligations under the contract.
For entities within the scope of GEO No 155/2024, incidents must also be examined in light of the specific risk management and reporting obligations. An event is not presumed to be a significant incident merely because a surveillance system has been affected; this must be determined according to the legal criteria and the impact on the entity and its services.
At the same time, where the incident involves a personal data breach, the obligations under Articles 33 and 34 GDPR must be examined separately. Notification of the supervisory authority within 72 hours of becoming aware of the breach is required where the conditions of Article 33 are met, and communication to data subjects is required in the situations provided for in Article 34.
It is therefore essential to distinguish between a technical incident, a cybersecurity incident relevant to a particular legal regime and a personal data breach. These categories may overlap, but they are not identical and may give rise to distinct obligations.
In any assessment of liability, the documentation on the risk assessment, the updates applied, access to the system, the supplier's interventions and the measures taken to contain the incident may play a decisive role in reconstructing the facts and establishing the conduct of each party.
An appropriate legal approach cannot be limited to the time of installation or acceptance of the system. Risks evolve as new vulnerabilities appear, staff change, configurations are modified or the manufacturer's support ends.
The organisation must be able to demonstrate, to the extent required by the applicable legal framework, that the system is administered in a controlled manner, that access is granted according to job responsibilities and that technical interventions are documented. Regular review of permissions, application of updates and testing of restoration mechanisms help maintain an adequate level of security.
Equally, decommissioning equipment must not be treated as a mere inventory operation. Hard drives, memory cards and other media may contain recordings or sensitive configurations, and associated accounts and connections may remain active after the equipment has been withdrawn.
Proper decommissioning involves identifying the components withdrawn, revoking access, securely erasing or, where appropriate, destroying the media in a documented manner, updating the inventory and removing integrations that are no longer needed.
These operations close the system's life cycle and reduce the risk that data or access points remain exposed after it is no longer in use.
Video surveillance systems must be analysed as infrastructures combining physical security, information technology and the processing of personal data. This reality calls for an integrated legal approach, in which the controller's obligations are not limited to justifying the installation of cameras and displaying notices to data subjects.
Compliance requires correctly identifying the applicable legal framework, assessing risks, adopting appropriate technical and organisational measures, carefully selecting suppliers, drafting appropriate contractual clauses and effectively verifying the system before it is put into operation.
The DNSC guide of October 2026 provides a practical reference for integrating cybersecurity into all these stages. Its guidance nature should not be confused with that of a legislative act, but its recommendations can help identify risks and document the measures adopted by the organisation.
Finally, the security of a surveillance system cannot be assessed solely by whether the cameras work or by the quality of the footage recorded. The relevant criterion is the organisation's ability to use the system lawfully, protect the data collected, prevent unauthorised access and demonstrate that the risks have been properly identified and managed.
Author: P.A.
