In brief
Cameras covering an area open to the public and cameras covering a restricted area do not serve the same purpose, do not call for the same equipment, and do not carry the same obligations. This article sets out what separates the two, how to combine them, and the compliance points that apply in either case.
Most sites end up with both, without ever having made the distinction explicitly. A camera at the entrance and a camera in the server room look alike, are bought at the same time and are wired into the same recorder — yet they answer two different questions.
Making the distinction is not an administrative nicety. It determines where you place your cameras, which equipment you choose, how long you keep the footage and what you must tell the people being filmed.
Two purposes, not two technologies
| Areas open to the public | Restricted areas | |
|---|---|---|
| Typical locations | Sales floors, shopping centres, car parks, reception halls, sites and events exposed to risk | Warehouses, data centres, server rooms, secure storage, sensitive zones |
| Primary purpose | Deterrence and prevention | Continuous monitoring and immediate response |
| What is expected of the system | Being visible, and producing usable evidence after the fact | Detecting in real time and allowing intervention |
| People filmed | Mostly the public, in large numbers | Mostly staff and contractors, identified |
The technologies overlap almost entirely. What differs is the intent behind each camera — and it is the intent, not the hardware, that regulators look at.
Worth remembering: most organisations need both. Deterrent coverage at the entrance to discourage and record; close monitoring in critical areas, linked to a control point. The mistake is not choosing one over the other — it is deploying one where the other was needed.
Which one for which need?
For spaces open to the public or otherwise exposed, deterrent coverage is the right answer. It discourages intrusion while recording evidence should an incident occur.
For sensitive or access-restricted areas — server rooms, high-value storage, safes — closer monitoring is more appropriate. It allows real-time follow-up, which is what makes an immediate response to suspicious behaviour possible.
Many organisations combine the two: deterrent coverage at the entrance to address external risk, and closer monitoring in critical areas where the consequences of an incident are highest.
Compliance: what applies in both cases
Authorisation regimes are national, not European. Some countries require prior authorisation before cameras covering areas open to the public can be switched on; others do not. Retention limits also vary. Check the rules applicable in the country where the site is located — in France, for example, cameras covering public-facing areas require prior authorisation, and the competent authority for data protection is the CNIL.
The GDPR, on the other hand, applies across the European Union, and it sets out obligations that hold whatever the type of area:
- Proportionality — every installation must be justified by a specific purpose and must not go beyond the actual need. This is the principle most often failed in practice.
- Restricted access to recordings — viewing must be limited to authorised people, and that access should be logged.
- Information of the people filmed — clear, visible signage stating that cameras are in operation and why.
- Right of access — individuals filmed can ask to see the footage concerning them and check how it is used.
- Limited retention — footage must be kept only as long as necessary for the purpose, then deleted. The maximum permitted duration is set nationally.
Penalties for failing these obligations are set at national level and can be substantial, including administrative fines issued by data protection authorities. Legislation also moves: it is worth checking periodically that an installation approved several years ago still meets current requirements.
Good practice, whichever type of coverage
Define the areas to be covered, precisely
Start by identifying exactly which areas need coverage. This avoids both gaps and excess — filming places that are not essential, or that are intrusive, such as toilets and break rooms. Coverage must stay proportionate to the objective, whether that objective is a car park, a server room or a sensitive warehouse.
Inform and involve your teams
Transparency towards employees and visitors is both a legal obligation and an ethical one. Put up visible signs indicating that cameras are present, and explain their purpose clearly. Briefing teams on how the system is used builds acceptance and heads off misunderstanding.
Respect retention periods
Retention is a cornerstone of compliance. Beyond the period justified by the purpose — with exceptions for ongoing investigations or recurring incidents — footage must be deleted. Automatic purging at expiry is the only arrangement that holds over time.
Maintain the system
An effective system depends on regular maintenance. Test equipment frequently to identify failures and blind spots. These preventive checks are what guarantee image quality and, above all, that the recording is actually there on the day you need it.
Keep your documentation current
Keep an up-to-date record of what is installed, why, who has access and how long footage is kept. It is this documentation, and not the equipment itself, that you will produce in the event of an inspection.
Choosing the right equipment
For public-facing coverage, dome cameras offer discreet, wide-angle coverage, with night vision and motion detection. Connected IP systems allow secure remote access to the streams.
For restricted areas, high-definition cameras with optical zoom deliver the level of detail required. Centralised systems can additionally analyse streams automatically and flag suspicious behaviour in real time.
Towards a joined-up security strategy
For stronger protection, combine technologies rather than stacking cameras:
- Deterrent camera coverage at the site entrance, to discourage and to record.
- Closer monitoring in critical areas, linked to a control point.
- Badge-based access control to physically restrict certain zones.
- Connected alarms coupled with video detection, to alert immediately on intrusion.
Frequently asked questions
What is the difference between covering a public area and a restricted area?
The purpose. Coverage of areas open to the public — sales floors, car parks, reception halls — is primarily deterrent and preventive, and produces evidence after an incident. Coverage of restricted areas — server rooms, secure storage, sensitive zones — is aimed at continuous monitoring and immediate response. The technologies are largely the same; the intent is not.
Do I need authorisation before installing cameras?
That depends on your country. Authorisation regimes are national, not European: some countries require prior authorisation for cameras covering areas open to the public, others do not. In France, for example, prior authorisation is required. Always check the rules applicable where the site is located.
How long can footage be kept?
Only as long as necessary for the purpose pursued, after which it must be deleted. The maximum permitted duration is set nationally and varies between countries. Automatic purging at expiry is the only arrangement that holds over time.
Which obligations apply regardless of the type of area?
Under the GDPR: proportionality of the installation to a specific purpose, access to recordings restricted to authorised people, clear information for the people filmed, their right of access to footage concerning them, and limited retention.
Can both types of coverage be combined on one site?
Yes, and most organisations need to. Deterrent coverage at the entrance addresses external risk; closer monitoring protects critical areas where the consequences of an incident are highest. The mistake is not choosing one over the other, but deploying one where the other was needed.
Review your camera coverage
A conversation about your areas, their purpose and the obligations that apply where your sites are located.
Contact us
