UniFi Protect and the GDPR: video surveillance at work

Why the storage location of recordings is so central

Video surveillance almost always processes personal data, so the GDPR applies in full: legal basis, information duties, retention and deletion policy, technical security. One point decides a large part of the assessment: the storage location. If recordings sit on a recorder in your own building, responsibility and control stay with you. If they land in a provider’s cloud, you add data processing agreements, sub-processors and, with US providers, the third-country transfer question.

UniFi Protect: local by default, without forced cloud

UniFi Protect records on a UniFi console on site, such as a network video recorder (UNVR) or a Cloud Gateway Max with storage. Unlike the Network application, Protect cannot be run on your own server. According to Ubiquiti there is no cloud backup of video by default, and AI detection runs locally on the camera or via accessories such as the AI Port and AI Key. Footage can optionally be archived to Google Drive, OneDrive, Dropbox or a NAS. Ubiquiti charges no per-camera licence fees; optional services, extra storage and support can still create recurring costs.

The opposite model: cloud-managed camera systems

Cloud video providers, from Meraki to pure video-as-a-service offerings, move storage or management into their data centres. That is not inherently unlawful, but it shifts the duties: you need a data processing agreement, must know the sub-processor chain and, with US providers, assess the data transfer. Reputable providers supply evidence for this. Cisco Meraki, for example, stores dashboard data in Germany if you choose the Europe region and holds a BSI C5 attestation; video from MV cameras is stored on the camera itself by default, and cloud archiving costs an additional licence per camera. Such models involve recurring costs, usually per camera per year.

The legal situation in 2026: the DPF applies, but is not set in stone

• The EU-US Data Privacy Framework (DPF) is the current basis for transfers to certified US companies; Ubiquiti states in its privacy policy that it is certified under it. The EU General Court dismissed the action against the DPF (case T-553/23, Latombe) on 3 September 2025, so the DPF remains in force.
• An appeal is pending at the Court of Justice (case C-703/25 P). In addition, on 29 June 2026 the US Supreme Court ruled in Trump v. Slaughter that the US President may remove members of the Federal Trade Commission without cause. The adequacy decision partly relies on this agency’s oversight. noyb has since called for an orderly withdrawal of the decision, and on 31 July 2026 the European Data Protection Board asked the EU Commission to assess the impact closely. A third Schrems scenario is not off the table.
• Practical consequence for SMEs: cloud video with a US nexus is currently legally possible, but rests on a foundation that could tip again. Local storage is far less affected by this uncertainty. If you use remote access through Ubiquiti accounts, still include the transfer of account and connection data in your review.

Legal basis: GDPR, BDSG and employees

For businesses, the central legal basis is usually legitimate interest under Art. 6(1)(f) GDPR: the camera must be necessary for a specific, defined purpose, and the interests of the people filmed must not outweigh the operator’s legitimate interest. Some German specifics come on top:

• Section 4 BDSG: the German Federal Data Protection Act still contains its provision on video surveillance of publicly accessible spaces. However, on 27 March 2019 the Federal Administrative Court ruled that surveillance by private operators is governed by Art. 6(1)(f) GDPR; the supervisory authorities therefore do not apply section 4 BDSG to businesses as a legal basis.
• Section 26 BDSG: following the Court of Justice judgment of 30 March 2023 (C-34/21), the Federal Labour Court ruled on 8 May 2025 that the general permission in section 26(1) BDSG must be disapplied. Employee data is therefore governed directly by the GDPR’s legal bases. There is no dedicated employee data protection act: the October 2024 ministerial draft failed with the end of the previous coalition, and a new attempt has been announced (as of September 2026).
• Employees: according to the guidance of the German Data Protection Conference, permanent video surveillance of workplaces is generally unlawful, as is monitoring performance or behaviour by camera. Employee consent is usually not freely given because of the imbalance of power in the employment relationship and therefore no solid basis. Targeted surveillance on concrete suspicion of a criminal offence is only possible under narrow conditions and for a limited time.
• Works council: if there is a works council, it generally has a right of co-determination when cameras are introduced under section 87(1) no. 6 of the Works Constitution Act (BetrVG), because they can be used to monitor employees’ behaviour or performance.

GDPR ground rules for workplace cameras

Regardless of the technology, a few ground rules apply to any workplace video surveillance. The following checklist is general guidance based on the video surveillance guidance of the German Data Protection Conference (DSK) and the European Data Protection Board’s Guidelines 3/2019. For the concrete implementation and in sensitive constellations, involve a data protection officer or seek legal advice:

• Define purpose and legal basis: usually legitimate interest, such as protection against burglary and theft, documented with a balancing test.
• Limit covered areas: entrances, outdoor areas, merchandise displays and storerooms without permanent workstations are more likely to qualify; the till only under narrow conditions and limited to the till terminal. Break rooms, changing rooms, sanitary areas and permanent workstations are off-limits. Capture public space in front of the door only as far as unavoidable, and mask image areas you do not need.
• Mark and inform in two layers: a clearly visible sign before entering the covered area with a camera symbol, the controller and contact details, the data protection officer where appointed, purpose and legal basis, the legitimate interest, the retention period and a pointer to further information; plus the full information under Art. 13 GDPR as a notice on site or on your website.
• Keep retention short: the DSK considers a retention period of 72 hours generally permissible; storing longer requires a specific justification. Configure the period in the recorder so it applies automatically.
• Restrict and log access: few named persons, individual accounts instead of a shared login, strong passwords and multi-factor authentication.
• Update the record of processing activities and check whether a data protection impact assessment is required: it is mandatory, for example, for large-scale monitoring of publicly accessible areas and for biometric analysis. Employees as data subjects, remote access or pan-tilt cameras can also indicate a high risk.
• Face recognition off: with AI and G6 cameras, Protect offers face recognition. That is processing of biometric data, which the DSK generally considers unlawful for video surveillance and which in any case requires a data protection impact assessment. Number plate recognition also needs a separate review.
• Audio off: recording the privately spoken word of others without authorisation is a criminal offence under section 201 of the German Criminal Code (StGB). According to the DSK guidance, the audio function of surveillance cameras must therefore be disabled irreversibly.

Example setup for a shop or workshop

For a shop or workshop with four cameras, a compact setup is enough: four Protect cameras for entrance, merchandise area, storeroom and yard, plus a small recorder such as the UNVR Instant with a built-in PoE switch (193 EUR net in the Ubiquiti Store Europe, hard drive separate) or a UniFi console with Protect support, integrated into the existing network on its own camera VLAN. I only plan a camera at the till after a separate review. In this deliberately local configuration, recordings stay on site. Running costs cover power, maintenance and any optional services; there are no per-camera licence fees.

What the UniFi ecosystem as a whole offers a business, from networking to Wi-Fi, is covered in the overview article UniFi in business. And if cameras are part of a bigger project: as part of my UniFi network planning I plan network, VLAN separation and camera system as one, including access rules and a retention and deletion policy. The legal assessment stays with you as the operator; I do not provide legal advice.