Conducting an impact assessment

Before installing and implementing video surveillance systems, you should conduct a privacy and data protection impact assessment.

The purpose of an impact assessment is to determine the impact of the proposed system on individuals' privacy and other fundamental rights, and to identify ways to mitigate or avoid adverse effects.

How much effort should go into the impact assessment? It depends on the circumstances. A video surveillance system with a high risk of encroaching on privacy warrants a greater investment than a video surveillance system with limited impact on privacy, for example, a conventional static CCTV system.

At a minimum, according to Article 35 subparagraph 7 of the GDPR, the assessment must contain at least:

  • A systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the Data Controller
  • An assessment of the necessity and proportionality of the processing operations in relation to the purposes
  • An assessment of the risks to the rights and freedoms of data subjects referred to in Article 35 (1) of the GDPR:

    Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks.

  • The measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with GDPR taking into account the rights and legitimate interests of data subjects and other persons concerned

In any event, and in all cases, you must assess and justify whether to resort to video surveillance, how to place the cameras, select and configure the systems, and how to implement the required data protection safeguards. For more information about securing your XProtect VMS installations, see the hardening guide and the certificate guide.