EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices
The EDPB's guidelines on CCTV and other video devices under the GDPR: specify each camera's purpose, prove a real legitimate interest, try less intrusive means first, keep cameras out of places where people expect privacy (washrooms, rest areas, most of the workplace), do not rely on staff consent, post an eye-level first-layer sign with a full second-layer notice, keep footage a few days, switch off audio and analytics, and meet strict conditions for facial recognition. Guidance, not law. Built from the complete text.
EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices is a compliance framework from European Union and EEA with 6 domains and 37 controls that map to 1 other frameworks. The largest domains are Section 5: Special categories of data and biometrics – EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices (11 controls), Section 3: Lawfulness of processing – EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices (10 controls), Sections 8 to 10: Storage, security measures and DPIA – EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices (6 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Section 3: Lawfulness of processing – EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices
| Code | Title |
|---|---|
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::3(a) | 3(a) Purposes specified in detail and documented in writing for every camera; 'safety' is not a purpose |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::3.1.1 | 3.1.1 Legitimate interest must be real and present, documented by incidents, and reassessed periodically |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::3.1.2(a) | 3.1.2(a) Necessity: less intrusive alternatives first |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::3.1.2(b) | 3.1.2(b) Necessity in place and time: when cameras run, and no filming beyond the property boundary |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::3.1.2(c) | 3.1.2(c) Necessity in how evidence is kept: black box, real-time viewing or guards |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::3.1.3 | 3.1.3 Balancing is mandatory and made case by case, weighing the intensity of the intrusion |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::3.1.3.2 | 3.1.3.2 Reasonable expectations: no cameras where people expect privacy, including most workplaces, washrooms and rest areas |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::3.2 | 3.2 Public task: a basis in law, necessity, and national video surveillance rules |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::3.3(a) | 3.3(a) Consent only exceptionally, and then from everyone entering the monitored area |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::3.3(b) | 3.3(b) Employers should not rely on consent; employment-specific rules may come from national law or works agreements |
Section 4: Disclosure of video footage to third parties – EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices
| Code | Title |
|---|---|
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::4.1 | 4.1 Disclosing footage to third parties needs its own legal basis and a compatible purpose |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::4.2 | 4.2 Disclosure to law enforcement: legal obligation where the law requires it, otherwise legitimate interest on reasonable suspicion |
Section 5: Special categories of data and biometrics – EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices
| Code | Title |
|---|---|
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::5(a) | 5(a) Special categories: an Article 9 exception plus an Article 6 basis, never 'manifestly made public' |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::5(b) | 5(b) Minimise the capture of other sensitive information, even outside Article 9 |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::5(c) | 5(c) An employer must not use footage of a demonstration to identify strikers |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::5.1(a) | 5.1(a) Biometrics: assess first, and know when Article 9 applies |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::5.1(b) | 5.1(b) Biometrics: never capture people who have not consented; separate entrances and user-triggered capture |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::5.1(c) | 5.1(c) Biometrics: a non-biometric alternative without restraint or extra cost, and a back-up |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::5.1(d) | 5.1(d) Biometrics: delete comparison templates immediately and keep enrolment templates only for the purpose |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::5.2(a) | 5.2(a) Biometric templates: no excess data and no transfer across systems |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::5.2(b) | 5.2(b) Biometric templates: stored on the user's own device, or encrypted centrally with a key only the person holds |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::5.2(c) | 5.2(c) Biometric data security: compartmentalise, separate stores, encrypt, detect fraud, sign, no external access |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::5.2(d) | 5.2(d) Delete raw biometric data effectively, on unauthorised access and at the device's end of life |
Section 6: Rights of the data subject – EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices
| Code | Title |
|---|---|
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::6.1(a) | 6.1(a) Access requests: give confirmation and a copy, masking other people |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::6.1(b) | 6.1(b) Access requests: ask for the time window, and explain if the person cannot be found |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::6.2.1 | 6.2.1 Erasure: erase on request when footage is no longer needed; blurring irreversibly counts |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::6.2.2 | 6.2.2 Objection: stop filming the objector or restrict the area in advance |
Section 7: Transparency and information obligations – EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices
| Code | Title |
|---|---|
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::7 | 7 Transparency in layers: the Article 13 information for footage collected by observation |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::7.1.1 | 7.1.1 Warning signs at about eye level before the monitored area, making clear what is covered |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::7.1.2 | 7.1.2 Sign content: purpose, controller, rights, greatest impacts, and where to find the rest |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::7.2 | 7.2 Second layer: the full Article 13 notice, easy to reach and available without entering the area |
Sections 8 to 10: Storage, security measures and DPIA – EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices
| Code | Title |
|---|---|
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::10 | 10 DPIA for large-scale monitoring of public areas and large-scale special category processing; consult if high risk remains |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::8 | 8 Storage: a few days, deleted automatically; beyond 72 hours needs stronger justification |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::9.2 | 9.2 Data protection by design and by default in the system and in the purchase specification |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::9.3 | 9.3 Privacy-friendly technology on; unnecessary functions (zoom, pan, audio, analytics) off |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::9.3.1 | 9.3.1 A video surveillance policy covering responsibility, prohibited uses, access, training and requests |
| edpb-guidelines-3-2019-on-processing-of-personal-data-through-video-devices::9.3.2 | 9.3.2 Technical security: physical protection, secure transmission, encryption, access control and logging |
Maps to 1 other framework
Coverage is not the same as your position
This page shows what EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices and who does it apply to?
EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices is a compliance framework from European Union and EEA with 6 domains and 37 controls. The EDPB's guidelines on CCTV and other video devices under the GDPR: specify each camera's purpose, prove a real legitimate interest, try less intrusive means first, keep cameras out of places where people expect privacy (washrooms, rest areas, most of the workplace), do not rely on staff consent, post an eye-level first-layer sign with a full second-layer notice, keep footage a few days, switch off audio and analytics, and meet strict conditions for facial recognition. Guidance, not law. Built from the complete text. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices actually require?
EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices has 37 controls organised across 6 domains. The largest domains are Section 5: Special categories of data and biometrics – EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices (11 controls), Section 3: Lawfulness of processing – EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices (10 controls), Sections 8 to 10: Storage, security measures and DPIA – EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices do I already cover?
EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices maps to 1 other compliance frameworks. The top mapping partners are GDPR (100% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices?
Start your EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about EDPB Guidelines 3/2019 on Processing of Personal Data through Video Devices requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 37 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 844 frameworks.
Get Started Free →Free forever — no credit card required