CCTV in your shop or café: the compliant setup in one page

The lawful small-business setup, per the EDPB’s video guidelines: Purpose & placement — theft prevention and security justify entrances, tills and stock areas; they do not justify fitting rooms (never), toilets (never), staff break rooms (no), or pointing at the pavement beyond your frontage (crop or mask). Permanent surveillance of employees as a management tool fails proportionality — see cameras at work. Signage before entry — a visible sign at the door: camera symbol, purpose, operator, contact, retention, reference to full information (QR to your privacy note works). Retention — as short as the purpose allows: a few days is the regulator-friendly norm; incidents get preserved separately. “The recorder keeps 90 days by default” is a settings problem, not a justification. Access & security — named persons only, protected login (change the recorder’s default password — genuinely, this is how footage ends up public), no feed on a screen customers see. Requests — customers and staff can request footage of themselves (how that looks from their side): respond within a month, mask third parties, don’t delete after a preservation request. Live remote viewing on your phone counts as processing too — same rules, plus extra security. Write these choices into a half-page camera policy and your Art. 30 record; done properly once, it never costs a thought again.