When we think of GDPR data protection, most of us tend to think of organisations that retain details, such as our name, date of birth, address, financial details and the like. But there is a method of obtaining data that is so widespread we barely notice it anymore – CCTV. If your business uses CCTV, you need to know that the images collected are classed as personal data and subject to GDPR data protection regulations.
Recording CCTV footage in shops, offices and restaurants is allowed. The business must have a solid policy, however, outlining the purposes for it. That isn’t hard. It’s for security purposes, but you have to include what sort of security issues you are trying to monitor, such as theft or vandalism. Your policy should also include an explanation of why you chose CCTV over other options such as security staff and it must be proportional to the risk. For example, if you have staff handling cash, you have a reason to record them at the till but not in the break room.
Your CCTV policy should cover three other points to meet your GDPR data protection requirements. First, just like with any other form of gathering data, you must notify people that you are doing it. You should also ensure that the footage is stored securely and state in your policy how long you intend to keep it and why. Eventually, you will be deleting old footage and disposing of old equipment. That is why you need to consider secure HDD destruction.
When the time comes to upgrade your CCTV system, merely deleting the footage and recycling the hard drive is not enough. To comply with your GDPR data protection obligations, you need to ensure that the hard drive is destroyed.
The only way to ensure that your video data is truly gone to satisfy GDPR data protection requirements is to hire a professional HDD destruction service. A good service will come to your location and provide you with a Certificate of Destruction, documenting that your data has been completely and irretrievably destroyed.
It’s easy to minimise the importance of destroying video. But under the GDPR data protection rules, it is imperative. CCTV video can be misused in criminal ways. It can abet stalking, and it can inadvertently reveal financial or other details about an individual. The Data Protection Commission has laid out the obligations for businesses, individuals and communities that use CCTV. Cyclone Shredding can help you meet those obligations with our HDD destruction services. Get in touch today to find out more.