Video Surveillance in Stores: The CNIL Obligations You Need to Know
Video protection in stores: a data processing activity governed by law
A video surveillance system installed in a store captures images of identifiable people: this is personal data processing, just like a customer file. Since the GDPR came into force, prior declaration to the CNIL is no longer required, but the system remains subject to the rules of the title dedicated to video protection in the Code de la sécurité intérieure.
For areas open to the public that are exposed to a risk of theft or aggression, the retailer must obtain a prefectural authorization before switching the system on, after informing the mayor. A store open to the public is also a place receiving the public, subject to a visit from the safety commission competent for this type of establishment.
The term video protection refers to cameras filming places open to the public and requires a prefectural authorization. The term video surveillance, strictly speaking, covers areas not open to the public (stockroom, offices): no prefectural authorization, but the same requirements for purpose, information and retention period still apply.
Obligations to meet before switching the system on
The CNIL states that a video surveillance system in a store must meet a precise, documented purpose: preventing theft, protecting property and people, or securing the premises. This purpose must be recorded in the store's data processing register, and serves as a reference to later check that the system stays proportionate.
Where the company has at least 50 employees, the staff council (CSE) must be informed and consulted before any decision to install cameras likely to concern staff, as part of the introduction of new technologies. This consultation fits within the broader employer's safety obligation, which requires involving staff representatives in decisions affecting working conditions.
The CNIL cites installing a staff video surveillance system without prior CSE consultation as an example of an unlawful monitoring device. The resulting footage can be dismissed as evidence, and the employer risks a complaint before the CNIL or the labor inspectorate.
Camera coverage must stay limited to useful areas: fitting rooms, restrooms and staff-only areas other than the till cannot be filmed. A camera also must not continuously film a fixed workstation in close-up, which the CNIL considers disproportionate under its guidance on monitoring employee activity.
The mandatory notice: what the public must see
A visible, understandable notice must be permanently displayed, typically one at the store entrance and one in the staff area. It must include a camera pictogram, the purpose of the system, the image retention period, the contact details of the controller or data protection officer, and the right to file a complaint with the CNIL. Additional details (legal basis, data recipients) may appear on the store's website instead of the notice itself.
Retention period: the one-month rule is not an automatic entitlement
The CNIL states that the retention period must not exceed what is necessary for the purpose pursued: in principle, one month is enough to carry out the checks needed after an incident and to start any procedure. This duration cannot be set by default based on the recorders' storage capacity alone, and must stay proportionate to the risk actually faced by the store.
A store cannot systematically keep its footage for a month without a justification linked to the site's risk. Beyond the retained period, footage must be automatically deleted, unless it is needed for an ongoing judicial investigation or disciplinary procedure.
Video surveillance and employees: the line between safety and monitoring work
Video surveillance cannot be used as a permanent tool to monitor an employee's activity. At a till, for instance, the camera should be aimed at the checkout area itself to identify a potential theft, not continuously at the employee: this is the distinction the CNIL uses to assess how proportionate a system is.
Centralize the tracking of your video surveillance obligations
CompliAssist tracks the declared purpose, the CSE consultation, the notice posted and the retention period applied: the documented proof to present during a CNIL check or a dispute.
Documenting your obligations: what changes during a check or a loss
During a CNIL check, a labor dispute, or a loss linked to a theft, having a dated file changes the nature of the exchange: the retailer presents verifiable elements rather than an after-the-fact reconstruction, much like the ERP safety register for fire safety obligations. This same traceability logic echoes the one already presented for business property insurance: a documented file works in the retailer's favor, whether facing an insurer or a check.
Video surveillance in stores: two scenarios facing a check
| Documented file (register, CompliAssist) | Informal tracking (memory, scattered notes) | |
|---|---|---|
| Proof of the declared purpose | Recorded from installation, dated | Reconstructed from memory, sometimes approximate |
| Proof of CSE consultation | Dated, consultable history | Hard to find after the fact |
| Retention periods applied | Monitored and adjustable based on risk | Rarely tracked over time |
| Responsiveness during a CNIL check | File consultable immediately | Last-minute document search |
Algorithmic anti-theft video surveillance: an experiment still under review
A bill introduced by deputy Paul Midy, filed on 18 March 2025, was adopted in first reading by the National Assembly on 16 February 2026 (adopted text n°239). It aims to authorize, on an experimental basis, the analysis by an algorithm of video protection images in retail stores, large stores and shopping centers, to spot behaviors associated with theft. The text explicitly excludes facial recognition, and states that an alert generated by the algorithm cannot by itself found a prosecution.
This text was transmitted to the Senate the same day it was adopted by the National Assembly and remains, at this stage, under review: it is not enacted and its provisions may still change. No store can rely on this text today to justify an algorithmic video surveillance system; check its actual status before any such project.
Nothing in this article constitutes personalized legal advice. Only the CNIL, the prefecture, or a legal professional can precisely assess a given store's situation.
SécuQuiz
Test your knowledge of video surveillance in stores
Question 1 sur 4
According to the CNIL, what is, in principle, the maximum retention period for store video surveillance footage?
Sources & references
- Video surveillance in stores — CNIL
- Monitoring employees' activity — CNIL
- Article L251-1 - Code de la sécurité intérieure — Légifrance
- Article L251-2 - Code de la sécurité intérieure — Légifrance
- Article L2312-8 - Code du travail — Légifrance
- Legislative file: Improving the protection of shopkeepers through digital tools — Assemblée nationale
Frequently asked questions
Tom BasinStrategic Partnerships Manager
Holding a Master's degree in risk prevention, Tom Basin serves as Partnerships Manager at CountAct, contributing to the development and rollout of the first turnkey crisis management support solution, with the aim of putting security back at the heart of businesses. His experience, along with his training at the Master's level and at the Institut national des hautes études de la sécurité et de la justice, gives him a broad perspective on security and crisis management.
