Video surveillance without forced cloud: UniFi Protect and the GDPR
Workplace cameras are quickly bought and quickly run the wrong way. The two decisive questions are where recordings live and who can access them. This article explains how a locally configured UniFi Protect system can simplify the GDPR assessment, which optional cloud functions still need review, and what a clean setup looks like for a shop, workshop or office. Updated August 2026.
Published on July 12, 2026 · Updated on August 8, 2026 · Daniel Gläser
Why the storage location of recordings is so central
Video surveillance almost always processes personal data, so the GDPR applies in full: legal basis, information duties, deletion concept, technical security. One point decides half the assessment: the storage location. If recordings sit on a recorder in your own building, responsibility and control stay with you. If they land in a provider's cloud, you add processing agreements, sub-processors and, with US providers, the third-country transfer question.
Local does not mean old-fashioned
Local recording today does not mean a VCR in a cupboard with tape changes. Modern systems offer AI detection, smartphone access and central management. Whether recordings leave the building depends on the Protect remote-access and archiving configuration you choose.
UniFi Protect: local by default, without forced cloud
UniFi Protect records to your own recorder or UniFi console by default, and AI analysis runs locally. Footage can nevertheless be archived optionally to Google Drive, OneDrive, Dropbox or a NAS. The core Protect application has no mandatory per-camera license; optional services, extra storage and ongoing support can still create recurring costs.
| Item | UniFi Protect (local) | Typical cloud video service |
|---|---|---|
| Cameras | One-off purchase | One-off purchase or rental |
| Recorder/storage | One-off purchase (entry: UNVR Instant, 199 USD US list price) | Not needed, storage sits with the provider |
| Mandatory app license per camera | 0 EUR | A monthly or yearly fee per camera is common |
| Storage location of recordings | On premises by default; external archiving optional | Provider's data centre |
| Data processing agreement required | Configuration-dependent: review provider support, remote access and external archives | Yes, plus review of sub-processors and third-country transfers |
An honest footnote on Ubiquiti and the cloud
Protect supports optional remote access through Ubiquiti accounts and external archiving. Ubiquiti also had a confirmed cloud incident in December 2023 in which, according to the vendor, consoles and notifications belonging to 1,216 accounts were briefly visible to other users; only around a dozen accounts were reportedly accessed. For maximum control, deliberately keep recording and access local or use your own VPN, and document every enabled cloud function.
The opposite model: cloud-managed camera systems
Cloud video providers, from Meraki to pure video-as-a-service offerings, move storage or management into their data centres. That is not inherently unlawful, but it shifts the duties: you need a data processing agreement, must know the sub-processor chain and, with US providers, assess the data transfer. Serious providers supply evidence for this; Cisco Meraki, for example, offers an EU cloud with processing in EU data centres, at most 14 months retention of dashboard data and a BSI C5 attestation (retention of the video footage itself is configured separately). Such packages cost recurring money though, usually per camera per year.
The legal situation in 2026: the DPF applies, but is not set in stone
- The EU-US Data Privacy Framework (DPF) is the current basis for transfers to certified US providers. The EU General Court dismissed the challenge against it (Latombe case) on 3 September 2025, so the DPF remains in force.
- An appeal is pending at the Court of Justice (case C-703/25 P). In addition, on 29 June 2026 the US Supreme Court overturned the independence of the FTC in Trump v. Slaughter, one of the pillars the adequacy decision rests on; noyb has since called on the EU Commission to withdraw the decision in an orderly way. A third Schrems scenario is not off the table.
- Practical consequence for SMEs: cloud video with a US nexus is currently legally possible, but rests on a foundation that could tip again. Local storage is simply unaffected by this uncertainty.
GDPR basics for workplace cameras
Regardless of the technology, a few ground rules apply to any workplace video surveillance. The following checklist is an orientation; for the concrete implementation, consult the German DSK's guidance on video surveillance and, in sensitive constellations, a data protection officer:
- Define purpose and legal basis: usually legitimate interest, such as protection against burglary and theft, documented with a balancing test.
- Limit covered areas: entrances, till, warehouse yes; break rooms, sanitary areas and permanent workplace monitoring no. Public space in front of the door only minimally.
- Mark and inform: a clearly visible sign before entering the covered area with the mandatory details, plus the full information under Art. 13 GDPR.
- Keep deletion periods short: retain recordings only as long as the purpose requires, as a rule a few days, and configure the period technically in the recorder.
- Restrict and log access: few named persons, strong passwords, two-factor login, no shared accounts.
- Update the record of processing activities and check whether extensive surveillance requires a data protection impact assessment.
- Audio off: audio recording is legally far more delicate than video and is best left completely disabled in a business setting.
Example setup for a shop or workshop
For a shop or workshop with four cameras, a compact setup is enough: four Protect cameras for entrance, till or counter, warehouse and yard, plus a small recorder such as the UNVR Instant (199 USD US list price) or a UniFi console with Protect support, integrated into the existing network on its own camera VLAN. In this deliberately local configuration, recordings stay on site. Running costs cover power, maintenance and any optional services; there is no mandatory app license per camera.
What the UniFi ecosystem as a whole offers a business, from networking to Wi-Fi, is covered in the overview article UniFi in business. And if cameras are part of a bigger project: as part of my UniFi network planning I plan network, VLAN separation and camera system as one, including clean access and deletion concepts.
Sources
- Ubiquiti Help Center: How UniFi Protect Protects Your Data (lokale Speicherung, keine Kamera-Lizenzen)
- Ubiquiti Help Center: Exporting Clips & Cloud Archiving with UniFi Protect
- Ubiquiti Blog: UNVR Instant (Einstiegs-Recorder)
- Cisco Meraki Documentation: Dashboard Data Storage (EU-Cloud-Speicherorte)
- Cisco Meraki: GDPR (Aufbewahrung von Kundendaten maximal 14 Monate)
- IAPP: EuG weist Latombe-Klage ab, Data Privacy Framework bleibt bestehen (September 2025)
- noyb: US Supreme Court kippt FTC-Unabhängigkeit, Folgen für EU-US-Datentransfers (Juni 2026)
- BleepingComputer: Ubiquiti-Statement zum Cloud-Vorfall Dezember 2023 (Zahlen)
- Datenschutzkonferenz: Orientierungshilfen (u. a. Videoüberwachung)
- The Register: Ubiquiti-Cloud-Vorfall Dezember 2023
This article is carefully researched guidance, not legal or tax advice. For binding information, please consult your tax advisor or lawyer.
Frequently asked questions
Does UniFi Protect need licenses or a subscription?+
The core Protect application has no mandatory per-camera app license. You pay for hardware and installation; optional services, external storage and ongoing support can add costs. As of August 2026.
Where are the recordings stored with UniFi Protect?+
On the UniFi recorder or console on site by default. External archiving to Google Drive, OneDrive, Dropbox or a NAS can be configured optionally. AI analysis runs locally.
Is cloud video surveillance automatically GDPR-non-compliant?+
No. It can be lawful when the homework is done: processing agreement, understood sub-processors and, where needed, a valid third-country transfer mechanism. With Protect, provider support, remote access and enabled archives also need review; a fully local configuration can substantially reduce this chain.
Am I allowed to film my employees?+
Only very restrictively. Permanent monitoring of workplaces is regularly unlawful, break rooms and sanitary areas are off-limits. Purpose-bound areas such as the till or warehouse can be permissible with a documented balancing test. When in doubt, clarify with a data protection officer first; it protects against expensive mistakes.
How long may I keep recordings?+
As short as possible. A few days is the rule of thumb, unless an incident justifies longer retention in the individual case. The concrete period belongs in the deletion concept and, technically, in the recorder so it applies automatically.
What does a 4-camera setup cost to run?+
A fully local Protect setup mainly incurs power and maintenance costs. There is no mandatory per-camera app license. Optional cloud storage, archiving and managed support can add recurring costs.
Cameras that stand up to data protection
I plan video surveillance for SMEs so that technology and GDPR fit together: local storage, clean VLAN, clear access rules and automatic deletion periods. From Chemnitz for SMEs in Saxony and across Germany.
Daniel Gläser
Owner of Gläser IT-Solutions, Chemnitz
I build software and run IT infrastructure for small and medium businesses, from the first analysis to day-to-day operations. Everything here comes from real projects and is backed by sources.
