A camera by a machine can help against vandalism, but it records people. That is processing personal data.
Recording people's images near a machine is processing personal data, to which the GDPR applies. The CCTV controller – the site owner, operator, or both, depending on arrangements – sets the purpose, scope, and retention of recordings and informs people about the monitoring. In workplaces, the Polish Labor Code's monitoring rules also apply.
What to Agree
- Who controls the recordings.
- Purpose and scope.
- Retention period.
- How people are informed.
Further Information
The FAQ section (publisher's site) covers common questions.
FAQ
Is a CCTV sticker enough? Notice is needed, but the controller's duties go further.
Is this article legal advice? No. It is a general overview.
This article is general information, not legal advice. Regulations change – check the current rules or consult a lawyer before deciding.
Basis: Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR); Article 22² of the Polish Act of June 26, 1974 – Labor Code (consolidated text Dz.U. 2026 item 1245).
Legal status: based on the regulations in force at the time of the last editorial review; this article is reviewed periodically.