Biometrics and data protection
CCTV and access control: how to integrate them and what Spanish law requires
Quick answer
A camera on each controlled entrance lets you check who really used a credential and what happened when an alarm went off. To do it lawfully in Spain you must display the information sign, capture only the space needed, delete footage within one month at most and, if there are employees, inform them.
Why link them
- Verification. The log says "Ana's card, 23:14"; the image says whether it was Ana.
- Understanding alarms. Door forced or held open: the linked video saves a trip.
- Spotting tailgaters behind an authorised person.
- Remote handling of an intercom or barrier.
Current systems link each access event to the matching video clip.
Where to put cameras
- Facing the entrance from the inside, to see the face of the person entering and not the street.
- At the right height and distance to recognise the person.
- No backlighting: a glazed lobby gives black silhouettes.
- One camera per lane on vehicle entrances, if plates are also to be read (how).
What the rules require
CCTV for security purposes is governed by article 22 of Spain's Data Protection Act, and the AEPD expands on it in its guide on video cameras. In short:
- An information sign in a visible place, identifying that processing takes place, the controller and how to exercise rights.
- Proportionality. Capture only what is needed. You may not record the public street beyond the strip essential to the entrance, nor other people's premises.
- No-go areas: toilets, changing rooms, rest areas.
- Retention: footage is deleted within a maximum of one month, except images that must be kept as evidence of acts against people, property or premises.
- Restricted access to recordings.
- No audio, as a general rule.
If you are used to UK practice (ICO guidance, flexible retention), note that Spain sets the one-month ceiling in statute.
At work
Article 89 of the Data Protection Act allows cameras for workplace monitoring within legal limits, but requires employees and their representatives to be informed beforehand, expressly, clearly and concisely. The AEPD details this in its employment guide.
In residential communities
An agreement of the owners' meeting is needed, and the AEPD recommends it state the number of cameras and the area covered (AEPD fact sheet). See access control for community garages.
Who may install them
Spain's Private Security Act reserves to licensed security companies the installation and maintenance of security systems connected to alarm receiving centres or to control or video-monitoring centres. If your system will be connected to one of those services, that part must be done by an authorised security company.
Facial recognition is another category
A camera that records is not biometrics. A system that automatically identifies people by their face is, with everything that implies (biometrics in access control).
Common mistakes
- A camera with no sign, or a sign with no controller details.
- Recordings that are never deleted.
- An outdoor camera covering half the street.
- Using footage for purposes other than those stated.
We integrate cameras and access as part of our access control and parking services.
Frequently asked questions
How long can recordings be kept?
One month at most, except images that must be kept as evidence of acts against people, property or premises, which must be made available to the competent authority.
Can a camera at my door point at the street?
It may only capture the portion of public street essential to monitor the entrance. General recording of the street is reserved to the police.
Sources
- Spanish Data Protection Act, Organic Law 3/2018 (BOE, in Spanish)
- AEPD guide on the use of video cameras for security and other purposes (in Spanish)
- AEPD guide on data protection in employment relationships (in Spanish)
- AEPD fact sheet on cameras in residential communities (in Spanish)
- Spanish Private Security Act 5/2014, art. 5 (BOE, in Spanish)
This guide is for information only and is not a substitute for legal advice or for the technical design of each installation. Regulations change: always check the current text at the official source.