Every use needs a documented Article 6 lawful basis; consent is hard to obtain in public spaces, so legitimate interests (supported by an assessment) or public task are the likely bases, but the organisation must identify the one that fits. Deliberate processing of special category data, biometric identification by facial recognition for example, needs an Article 9 condition, and five conditions also need section 10 and Schedule 1 DPA 2018. Footage used as criminal offence data, such as CCTV compiled against an employee suspected of till theft, needs Article 10 compliance and a Schedule 1 condition, and an appropriate policy document where required.
This control maps to 3 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.