Video surveillance without forced cloud: UniFi Protect and the GDPR
Workplace cameras are quickly bought and quickly run the wrong way. The two decisive questions: where do the recordings live, and who can access them? This article shows why locally stored systems like UniFi Protect greatly simplify the GDPR assessment, what the legal situation is in 2026, and what a clean setup looks like for a shop, workshop or office. As of July 2026.
Published on July 12, 2026 · Daniel Gläser
Why the storage location of recordings is so central
Video surveillance almost always processes personal data, so the GDPR applies in full: legal basis, information duties, deletion concept, technical security. One point decides half the assessment: the storage location. If recordings sit on a recorder in your own building, responsibility and control stay with you. If they land in a provider's cloud, you add processing agreements, sub-processors and, with US providers, the third-country transfer question.
Local does not mean old-fashioned
Local recording today does not mean a VCR in a cupboard with tape changes. Modern systems offer AI detection, smartphone access and central management, just with recordings that never leave the building.
UniFi Protect: local, no subscription, no forced cloud
UniFi Protect is Ubiquiti's camera system and does exactly that: recordings are stored exclusively locally on your own recorder or UniFi console, there is no cloud backup of footage by default, and the AI analysis (person and vehicle detection) runs on the device instead of in a data centre. Ubiquiti officially advertises this with zero license costs, whether 4 or 4,000 cameras.
| Item | UniFi Protect (local) | Typical cloud video service |
|---|---|---|
| Cameras | One-off purchase | One-off purchase or rental |
| Recorder/storage | One-off purchase (entry: UNVR Instant, 199 USD US list price) | Not needed, storage sits with the provider |
| Recurring license per camera | 0 EUR | A monthly or yearly fee per camera is common |
| Storage location of recordings | On your premises | Provider's data centre |
| Data processing agreement required | No, as long as everything stays local | Yes, plus review of sub-processors and third-country transfers |
An honest footnote on Ubiquiti and the cloud
Protect also has optional cloud features such as remote access via Ubiquiti accounts. And Ubiquiti had a confirmed cloud incident in December 2023 in which, per the vendor's statement, the consoles and notifications of 1,216 accounts were briefly visible to other users; per the same statement, only around a dozen accounts were actually accessed. The recordings themselves were and are stored locally. For maximum control, run console and access strictly locally or via your own VPN.
The opposite model: cloud-managed camera systems
Cloud video providers, from Meraki to pure video-as-a-service offerings, move storage or management into their data centres. That is not inherently unlawful, but it shifts the duties: you need a data processing agreement, must know the sub-processor chain and, with US providers, assess the data transfer. Serious providers supply evidence for this; Cisco Meraki, for example, offers an EU cloud with processing in EU data centres, at most 14 months retention of dashboard data and a BSI C5 attestation (retention of the video footage itself is configured separately). Such packages cost recurring money though, usually per camera per year.
The legal situation in 2026: the DPF applies, but is not set in stone
- The EU-US Data Privacy Framework (DPF) is the current basis for transfers to certified US providers. The EU General Court dismissed the challenge against it (Latombe case) on 3 September 2025, so the DPF remains in force.
- An appeal is pending at the Court of Justice (case C-703/25 P). In addition, on 29 June 2026 the US Supreme Court overturned the independence of the FTC in Trump v. Slaughter, one of the pillars the adequacy decision rests on; noyb has since called on the EU Commission to withdraw the decision in an orderly way. A third Schrems scenario is not off the table.
- Practical consequence for SMEs: cloud video with a US nexus is currently legally possible, but rests on a foundation that could tip again. Local storage is simply unaffected by this uncertainty.
GDPR basics for workplace cameras
Regardless of the technology, a few ground rules apply to any workplace video surveillance. The following checklist is an orientation; for the concrete implementation, consult the German DSK's guidance on video surveillance and, in sensitive constellations, a data protection officer:
- Define purpose and legal basis: usually legitimate interest, such as protection against burglary and theft, documented with a balancing test.
- Limit covered areas: entrances, till, warehouse yes; break rooms, sanitary areas and permanent workplace monitoring no. Public space in front of the door only minimally.
- Mark and inform: a clearly visible sign before entering the covered area with the mandatory details, plus the full information under Art. 13 GDPR.
- Keep deletion periods short: retain recordings only as long as the purpose requires, as a rule a few days, and configure the period technically in the recorder.
- Restrict and log access: few named persons, strong passwords, two-factor login, no shared accounts.
- Update the record of processing activities and check whether extensive surveillance requires a data protection impact assessment.
- Audio off: audio recording is legally far more delicate than video and is best left completely disabled in a business setting.
Example setup for a shop or workshop
For a shop or workshop with four cameras, a compact setup is enough: four Protect cameras for entrance, till or counter, warehouse and yard, plus a small recorder such as the UNVR Instant (199 USD US list price) or a UniFi console with Protect support, integrated into the existing network on its own camera VLAN. Running costs: electricity and occasional maintenance, no license fees. Recordings stay on site, access runs through named accounts, and the recorder enforces the deletion period automatically.
What the UniFi ecosystem as a whole offers a business, from networking to Wi-Fi, is covered in the overview article UniFi in business. And if cameras are part of a bigger project: as part of my IT infrastructure services I plan network, VLAN separation and camera system as one, including clean access and deletion concepts.
Sources
- Ubiquiti Help Center: How UniFi Protect Protects Your Data (lokale Speicherung, keine Kamera-Lizenzen)
- Ubiquiti Blog: UNVR Instant (Einstiegs-Recorder)
- Cisco Meraki Documentation: Dashboard Data Storage (EU-Cloud-Speicherorte)
- Cisco Meraki: GDPR (Aufbewahrung von Kundendaten maximal 14 Monate)
- IAPP: EuG weist Latombe-Klage ab, Data Privacy Framework bleibt bestehen (September 2025)
- noyb: US Supreme Court kippt FTC-Unabhängigkeit, Folgen für EU-US-Datentransfers (Juni 2026)
- BleepingComputer: Ubiquiti-Statement zum Cloud-Vorfall Dezember 2023 (Zahlen)
- Datenschutzkonferenz: Orientierungshilfen (u. a. Videoüberwachung)
- The Register: Ubiquiti-Cloud-Vorfall Dezember 2023
This article is carefully researched guidance, not legal or tax advice. For binding information, please consult your tax advisor or lawyer.
Frequently asked questions
Does UniFi Protect need licenses or a subscription?+
No. Protect stores locally on your own recorder and has no per-camera license fees; per Ubiquiti explicitly regardless of whether you run 4 or 4,000 cameras. You only pay for the hardware. As of July 2026.
Where are the recordings stored with UniFi Protect?+
Exclusively locally on the UniFi recorder or console on your premises. There is no cloud backup of footage by default, and the AI analysis runs on the device.
Is cloud video surveillance automatically GDPR-non-compliant?+
No. It is permissible if the homework is done: data processing agreement, clarified sub-processors, and with US providers a valid transfer mechanism such as the Data Privacy Framework, which currently applies but faces a pending appeal at the ECJ. Local storage spares you this entire review chain.
Am I allowed to film my employees?+
Only very restrictively. Permanent monitoring of workplaces is regularly unlawful, break rooms and sanitary areas are off-limits. Purpose-bound areas such as the till or warehouse can be permissible with a documented balancing test. When in doubt, clarify with a data protection officer first; it protects against expensive mistakes.
How long may I keep recordings?+
As short as possible. A few days is the rule of thumb, unless an incident justifies longer retention in the individual case. The concrete period belongs in the deletion concept and, technically, in the recorder so it applies automatically.
What does a 4-camera setup cost to run?+
With a local Protect setup: essentially electricity and occasional maintenance, zero license costs. The investment is one-off for cameras, recorder (entry UNVR Instant, 199 USD US list) and installation. Cloud services, by contrast, usually charge recurring per-camera fees.
Cameras that stand up to data protection
I plan video surveillance for SMEs so that technology and GDPR fit together: local storage, clean VLAN, clear access rules and automatic deletion periods. From Chemnitz for SMEs in Saxony and across Germany.
Daniel Gläser
Owner of Gläser IT-Solutions, Chemnitz
I build software and run IT infrastructure for small and medium businesses, from the first analysis to day-to-day operations. Everything here comes from real projects and is backed by sources.
