Skip to content
Law

Workplace Surveillance –

What to look out for?

Mgr. Jan Pavlík
Published:Updated:

Workplace cameras may be used only where the employer can demonstrate a legitimate purpose, necessity and proportionality of the interference with employees’ privacy. Employees must be informed in advance, while sensitive areas such as changing rooms or toilets must not be monitored. The article explains the balancing test, recording retention, covert monitoring and GDPR duties.

Professional discussing workplace camera regulations.

Key takeaways

Cameras in the workplace are permissible only as a last resort. The use of a camera system is justified only if there is no less invasive method to achieve the same objective, such as supervision by a superior. Monitoring areas like restrooms or changing rooms is strictly prohibited.
Before activating the cameras, you must inform your employees in detail. It is necessary to communicate what data will be collected, where and for how long it will be stored, who will have access to it, who will review it, what will be archived, and what security measures are in place.
A camera system requires information signs and an internal policy. Furthermore, you must maintain records of processing activities pursuant to Art. 30 of the GDPR, consider a data protection impact assessment pursuant to Art. 35 of the GDPR, and allow employees to view the footage.
Review recordings promptly and retain them only for the necessary period. The review of the footage should generally take place within 3 days, and if nothing relevant is found, there is no reason to retain the recording further.
ARROWS law firm

Legal basis

The use of cameras will only pass a balancing test if there is no other, less invasive method that would also achieve the employer's objective (typically, for example, supervision by a superior). It goes without saying that surveillance in certain areas such as toilets or changing rooms is completely inadmissible.

What are my obligations as an employer?

If an employer decides to use cameras, they must not forget other statutory obligations. First and foremost, employees must be informed in advance. The employee should be told at a minimum:

  • what data will be collected by the employer,

  • where such information will be collected,

  • for how long the information is collected,

  • who will have access to the information,

  • who will review the collected information,

  • which data will potentially be archived long-term, or

  • what security measures are in place to prevent unauthorised access.

The employer should also post information signs and define the detailed process of making camera recordings in an internal regulation. The review of the footage should then be immediate (usually within a maximum of 3 days), also for the purpose of promptly addressing, for example, unlawful conduct by an employee. If the employer finds nothing relevant during the review, there is no reason to further retain the footage.

The employer should also not forget to maintain records of processing activities under Art. 30 of the General Data Protection Regulation (GDPR), the obligation to conduct an impact assessment under Art. 35 GDPR, or to make the entire process transparent by allowing the employee concerned to view the footage.

DO YOU NEED LEGAL HELP?

Get in touch — we're happy to help.

ARROWS law firm

Covert surveillance

Employers are generally only entitled to conduct overt surveillance of employees, where employees are informed about the camera system. Nevertheless, there are exceptions that also permit covert surveillance, as confirmed by case law. The Supreme Administrative Court has, for example, already stated in its decision-making practice that covert surveillance may be justified if it was not possible to prove the monitored fact in any other way.

The European Court of Human Rights (ECHR) has taken the same position in its rulings, for example, in the cases of Köpke v. Germany and López Ribalda and Others v. Spain. In both cases, the ECHR took into account that the covert surveillance was carried out only for a certain period and was aimed at employees who were strongly suspected of committing unlawful acts. It must be added that in both cases the suspicion was confirmed, and the covert surveillance led to a conviction for the unlawful conduct.

Risk and potential problems

How ARROWS helps

Installing cameras without a balancing test and DPIA

We will conduct a legal balancing test, prepare a DPIA assessment, and draft a bulletproof internal directive and templates for information signs.

Illegal covert surveillance or cameras in changing rooms

We will assess borderline situations of covert monitoring according to the case law of the ECHR and the SAC and set up legal procedures to convict dishonest employees.

Use of dummy cameras and sanctions from the labour inspectorate

We will conduct an audit of workplace monitoring and recommend legal, effective ways to protect property without the risk of penalties from the labour inspectorate.

Long-term retention of recordings and personal data breaches

We will set up processes for secure archiving, shredding, and access rights to recordings, and prepare records of processing activities according to Art. 30 GDPR.

ARROWS law firm

Frequently asked questions about camera installation and covert surveillance in the workplace

1. When is the installation of a camera system in the workplace legally permissible?

  • A camera system must pass a so-called balancing test (proportionality test). The employer must demonstrate that the surveillance pursues a legitimate aim (e.g., protection of property or security) and that this aim cannot be achieved by any other, less invasive method (e.g., regular supervision by a superior).

2. What must employees be informed about before a camera system is launched?

  • The employer has an obligation to transparently inform employees in advance. They must specify the scope of the data collected, the areas monitored, the retention period of the recordings, the persons with access rights, the method of review, security measures, and any long-term archiving. The premises must also be marked with information signs.

3. Under what exceptional circumstances can covert surveillance be used without the employees' knowledge?

  1. Covert surveillance is permissible only in very exceptional cases. According to the case law of the Supreme Administrative Court and the European Court of Human Rights (e.g., Köpke or López Ribalda), it can be used only for a limited period, against specific employees with a strong suspicion of unlawful conduct (e.g., serious theft), and provided that the evidence cannot be obtained in any other way.

ARROWS law firm

What about dummy cameras?

Even the use of a dummy camera in the workplace can cause unexpected legal problems for an employer. Although such a device does not process any personal data, which means there is no breach of GDPR, dummy cameras can cause undue stress and a feeling of being constantly monitored among employees.

In this sense, the labour inspectorate has already ruled in the past, stating that the installation of a dummy camera constituted a violation of Section 302(c) of the Labour Code, which imposes on employers the duty to create favourable working conditions and ensure safety and health at work. Therefore, employers should not install dummy cameras at all for the purpose of "unsettling" employees.

Who can you turn to?

Mgr. Jakub Oliva, LL.M., MSc.

Mgr. Jakub Oliva, LL.M., MSc.

advokát, partner

oliva@arws.cz
Mgr. Alexandra Johnová

Mgr. Alexandra Johnová

advokátní koncipientka

johnova@arws.cz
ARROWS law firm

Conclusion

As you can see, operating camera systems in the workplace is a very complex and complicated issue that should not be underestimated. A poorly configured camera system can lead not only to fines from the relevant authorities but also to a disruption of working relationships, privacy, or employee trust. It is therefore always advisable to consult a lawyer before implementing any monitoring system, who will help you avoid unnecessary legal complications and set up the system in accordance with applicable regulations.

Frequently asked questions about dummy cameras, GDPR obligations, and sanctions

1. Is it legal to install dummy cameras in the workplace for prevention purposes?

  • No. Although dummy cameras do not process personal data and do not violate GDPR, according to the decisions of the labour inspection authorities, they violate Section 302(c) of the Labour Code. They cause reasonable stress and unfavourable working conditions for employees, so employers should not use them at all.

2. How long can an employer keep camera recordings?

  • The review of recordings should be carried out without delay (usually within 3 days). If the review does not reveal any incident or unlawful act, the recording must be deleted immediately. Long-term archiving is only possible for specific recordings capturing a security incident or damage.

3. In which areas of the workplace is the placement of cameras strictly prohibited?

  • Cameras must under no circumstances intrude into areas intended for the purely private purposes of employees. Monitoring toilets, showers, changing rooms, or break rooms is absolutely inadmissible and constitutes a gross violation of the right to privacy.

4. What mandatory documents under GDPR must an employer have ready for operating cameras?

  • The employer must have an internal directive governing the operation of cameras, maintain records of processing activities under Art. 30 GDPR, and in cases of large-scale or systematic monitoring, also conduct a data protection impact assessment (DPIA) under Art. 35 GDPR.

5. Does an employee have the right to request to see a camera recording in which they are captured?

  • Yes. Based on the right of access to personal data under GDPR, an employee has the right to view a recording in which they are clearly identifiable, provided that this does not adversely affect the rights and freedoms of third parties.

6. What sanctions does an employer face for illegal monitoring of employees?

A breach of GDPR can result in high financial penalties from the Office for Personal Data Protection (ÚOOÚ). At the same time, there are penalties from the State Labour Inspection Office for violating the Labour Code and the risk of lawsuits from employees for the protection of personal rights or compensation for non-pecuniary damage.

DO YOU HAVE MORE QUESTIONS? GET IN TOUCH

ARROWS law firm

About the author

Mgr. Jan Pavlík
Mgr. Jan Pavlík

Associate

Jan Pavlík is an experienced attorney who focuses on resolving complex situations in corporate life. At Arrows Law Firm, he primarily deals with corporate law, labor law, commercial disputes, and contractual matters.

Disclaimer:

The information contained in this article is for general informational purposes only and serves as a basic guide to the issue as of 2026. Although we strive for maximum accuracy, laws and their interpretation evolve over time. We are ARROWS Law Firm, a member of the Czech Bar Association (our supervisory authority), and for the maximum security of our clients, we are insured for professional liability with a limit of CZK 350,000,000. To verify the current wording of the regulations and their application to your specific situation, it is necessary to contact ARROWS Law Firm directly (consultation@arws.cz). We are not liable for any damages arising from the independent use of the information in this article without prior individual legal consultation.