Two layers of information

European supervisory authorities recommend a layered approach. The first layer is the sign at the camera: short, visible before someone enters the field of view, with the information that matters most. The second layer holds the full information required by Art. 13 GDPR and is available elsewhere, for example on your website, behind a QR code or at reception.

This page is general information, not legal advice. The assessment for your site stays with your data protection officer and, where needed, your lawyer.

What belongs on the sign

Video surveillance with AI analysis
  • Camera symbolA clear pictogram, visible before entering the field of view
  • Who is responsibleCompany name and contact details of the controller
  • Data protection officerContact details, if you have one
  • Purpose and legal basisFor example: protecting property after hours, Art. 6(1)(f) GDPR
  • Legitimate interestIn a few words, for example: preventing theft and break-ins
  • Use of AIThat images are analysed automatically, for example to detect intrusion or fire
  • RetentionHow long recordings and incident clips are kept
  • RecipientsIf footage is passed on, for example to a security provider
  • RightsA short reference to access, erasure and objection
  • Full informationWhere the second layer is: a web address or QR code, reception
Example layout of a first-layer sign

Where to put it

  • At eye level, before the area covered by the camera, so people can decide before they are filmed.
  • At every entrance to a monitored site, not only at the main gate.
  • Readable in the languages of the people who come to the site, for example drivers from other countries at a logistics site.
  • Updated whenever purposes, retention or the use of AI change.

What changes when images are analysed with AI

If cameras feed an AI analysis, the sign and the second layer should say so, along with the purpose of the analysis (for example detecting intrusion after hours or fire and smoke) and that no faces are recognised, if that is the case. The second layer should also explain which events are detected, who receives alerts and how long incident clips are kept.

Template for your site

Our data protection and security pack for ProDataAI Lens includes a sign template and the second-layer text, filled in with your configuration. Ask for it when you talk to us.

Frequently asked questions

Is a CCTV sign mandatory?

Yes. People must be informed about video surveillance before they enter the area (Art. 12 and 13 GDPR). A sign at the camera is the usual way.

Is a camera pictogram alone enough?

No. It should come with the controller's identity, the purpose and where to find the full information, at least.

Do we need to mention AI on the sign?

If images are analysed automatically, people should be told. It is part of transparent information about the purpose and the processing.

GDPR, works council and the EU AI ActThe legal frame for AI video analytics in Germany and the EU, in one guide.Checklist: DPIA and works agreementWhat to cover in the DPIA and the works agreement for AI video analytics.Site and perimeter protectionIntrusion into areas you draw, after hours, with the clip attached.Retail: after closing timeMovement after closing, stock rooms and cash offices, unattended deliveries.