CCTV GDPR: Can AI Draft Privacy Notices and Signage for Clients?

Yes, as a draft for the client to adopt, never as the final word. AI can turn the client's confirmed facts into a clear sign and privacy notice, but the client decides purposes and retention, and a legal adviser or the regulator's guidance confirms them. It must never invent retention periods or claim compliance.

This is general information, not legal advice, and rules differ by site. It assumes the GDPR applies, for example because your client operates in the EU. The regulator's own CCTV guidance owns the basics, so what follows adds what that guidance leaves to you: wording to hand over, a checklist for the client's adviser, and the recorder settings that must match what the sign says.

Follow me on Instagram@sagnikteaches

Who owns the notice: the client, not the installer

Under the GDPR the controller is whoever decides why and how personal data is processed. For a shop's cameras that is the shop, and the controller owes people the information that Article 13 lists. You supply and configure the equipment. Two things can pull an installer closer to the data. If you view or hold footage for the client, through remote maintenance, hosting or a monitoring service, Article 28 expects the arrangement to sit under a written contract: you act only on the client's documented instructions, keep staff to confidentiality, apply security measures, and delete or return the data when the service ends, among other terms. That is a contract matter for the client's adviser, not a drafting job for an assistant.

Connect on LinkedInSagnik Bhattacharya

So the pack you hand over has three parts: a decision sheet the client fills in, wording for the sign, and a fuller second-layer notice. The assistant helps with the second and third, using only what the first contains.

Subscribe on YouTube@sagnikteaches

What goes on the sign, and what sits behind it

The EDPB, the EU's data protection board, publishes guidelines on video devices (Guidelines 3/2019) that describe a layered approach. The sign is the first layer. It should carry the most important information: the purposes, the identity of the controller and its contact details, the existence of people's rights, and the processing that affects them most, such as the retention period, live monitoring only, or sharing footage with third parties. It should also say where the fuller second layer is. People should be able to see the sign before they enter the monitored area, at around eye level. If the sign says nothing about recording or third parties, a passer-by is entitled to assume the cameras only show a live picture, so omitting a recording or a retention period is a defect, not tidiness. National rules can add requirements, so the client's adviser still checks.

The second layer holds everything else Article 13 requires, and the guidelines say it should be reachable without entering the monitored area and available in a non-digital form too, such as an information sheet at reception, with a web address or QR code as a convenience. For a shop, Article 13's list translates into a short notice with these headings:

• Who we are and how to contact us, and the data protection officer's contact details if there is one.
• Why we use cameras and the legal basis, including the legitimate interests relied on.
• Who may see the footage: staff roles, a monitoring company, the police or insurers where necessary.
• Any transfer of footage outside the area covered by the GDPR, such as cloud storage on servers elsewhere.
• How long footage is kept, or the criteria used to decide.
• Rights: access, erasure, restriction and objection, and how to ask.
• The right to complain to the data protection regulator.

Article 13 also lists items such as whether providing data is required by law and any automated decision-making, which rarely arise for a simple camera system but belong on the adviser's list. Article 13(4) lifts the duty only where, and as far as, the person already has the information, so do not count on visitors knowing it.

The client decision sheet the assistant must work from

Everything in the notice that is a choice must come from the client, written down before any drafting. Here is the sheet for an illustrative small retail shop with eight cameras. The retention period and its reason are the client's decision, recorded by the client:

Each answer reflects something the EDPB guidelines point to. They suggest documenting incidents as evidence of a real purpose, reviewing the need at intervals such as once a year, and keeping footage no longer than needed. On retention they say footage should in most cases be erased, ideally automatically, after a few days, and that going beyond 72 hours needs more justification. The client's 48 hours stays inside that, with a recorded reason.

The prompt, and what the first draft got wrong

You are helping a CCTV installer draft wording for a client's own use.
Use ONLY the decision sheet below. If a field is blank, write
[CLIENT TO CONFIRM]. Do not invent retention periods, legal bases,
recipients or camera capabilities. Do not say the system or the notice is
compliant. Do not mention audio or face recognition unless the sheet does.
Write: 1) first-layer sign wording of no more than 60 words; 2) a
second-layer notice under these headings: who we are, why we use cameras
and our legal basis, who may see footage, transfers outside the area the
GDPR covers, how long footage is kept, your rights, complaints; 3) a
two-column list of every fact in your draft and the sheet field it came from.
Decision sheet: [paste]

The third item is the useful trick. A trace list of fact against source field lets the adviser, or you, find an invented fact in seconds. A first draft of the sign (illustrative) came back like this:

CCTV in operation for your safety and ours. Images are recorded and
kept for 30 days. This system is fully GDPR-compliant. Contact
[CLIENT TO CONFIRM].

The trace list showed no source field for "30 days" or "fully GDPR-compliant". Both were removed, and the draft also lacked a purpose, any mention of rights and a pointer to the full notice. In the second-layer draft the assistant gave the legal basis as "consent", which the client had not chosen. The EDPB guidelines say consent can serve as the basis for systematic monitoring only in exceptional cases, and that walking into a marked area is not consent. It was replaced with the client's own legitimate interests wording.

The corrected sign and second-layer notice for the shop

After the adviser's pass, the first-layer sign reads as follows (illustrative, with the client's own details in brackets). It names the purpose, the controller, the retention period, the possible sharing, the existence of rights and where the full notice lives:

VIDEO SURVEILLANCE. [Shop name] records images to prevent and detect
theft and damage and for staff safety. Images are deleted after 48 hours
unless an incident needs them kept, and may be shared with the police or
our insurer where necessary. Questions or access requests: [phone or
email]. Full notice: [web address] or ask at the till.

Behind it sits the second layer, kept at the till and online. Notice that two lines stay flagged, because the sheet never settled them:

Video surveillance at [Shop name]

Who we are: [Shop name], [address]. Questions or requests: [phone or
email]. Data protection officer: [CLIENT TO CONFIRM].

Why we use cameras: to prevent and detect theft and damage and for staff
safety. Our legal basis is legitimate interests. Our written assessment
is held by [owner] and reviewed every year.

Who may see footage: the owner and manager, on site only. We may give
footage to the police or our insurer where necessary. There is no
monitoring company and no remote viewing.

Transfers: footage stays on a recorder in the shop. It is not sent to
cloud storage or to any other country.

How long we keep it: 48 hours, then it is deleted automatically.
Footage tied to a logged incident is kept as long as the incident needs.

Your rights: you can ask to see footage of yourself, to have it erased,
to restrict its use or to object to it [ADVISER TO CONFIRM THE FULL
LIST]. Contact us as above. We answer within one month.

Complaints: you can complain to the data protection regulator,
[regulator name and contact].

Change one fact and the wording must change with it. If the owner later adds phone viewing through a monitoring company, the sign gains a line such as "Images may be viewed remotely by [company]", the second layer must name the company as a recipient and say where it works from, and Article 28 expects a written contract with it. The assistant can redraft in a minute once the decision sheet changes. It cannot know the sheet has changed, which is why the sheet is dated and the installer asks about it at every service visit.

The sign says 48 hours; what does the recorder do?

This is the part only an installer can check, and no notice wording fixes it. A sign that promises deletion after 48 hours is false if the recorder keeps footage until the disk fills. Here is the arithmetic for the shop's eight cameras, with a bitrate of 2 Mbps a camera as an illustrative assumption (real figures depend on resolution, codec and scene):

If the installer fits a 4 TB disk and leaves the defaults alone, the shop keeps footage for about 23 days under a sign that says 2. Motion-only recording makes it worse, at nearly two months, because the disk fills more slowly. The disk's size is never the control. The control is a setting that deletes footage after a set period, if the recorder has one, or overwrites on a schedule you can prove. Read the model's manual for what it offers, and if it cannot delete after a fixed time, tell the client, because the alternative is a written manual routine with a named person.

Make this a commissioning step. Set the period to match the decision sheet, then return after three days and look at the oldest clip on the recorder. It should be no older than the period on the sign. Keep a screenshot in the handover pack with the date. CCTV Installation Checklist: Commissioning, Signage and Handover With AI has the surrounding checklist, and this screenshot belongs on it.

The legal-check list for the client's adviser

This list is for the person who gives the client legal advice, and it is mostly drawn from the EDPB guidelines and the articles already named. It is not a legal opinion, and the regulator's own guidance and any national rules come first. Hand it over with the draft so the review covers the right things:

Two rows deserve emphasis for an installer, because they are in your hands. On access requests, ask before you buy a recorder whether it can export a clip and mask other people in it. The EDPB guidelines say controllers should consider technical measures such as masking or scrambling to deal with a request, and they list functions like audio recording and analysis as things to disable if they are not needed. On analytics, the guidelines note that footage is not biometric data in itself unless it has been technically processed to identify someone. The moment a camera product adds face recognition, the drafting stops and the client's adviser starts. AI Camera Software for CCTV Installers: Analytics You Can Sell Clients compares what the analytics do, and it is worth reading before you quote them.

Homes and businesses: where the household exemption stops

The GDPR does not apply to processing by a person in the course of a purely personal or household activity. The EDPB guidelines say this exemption must be read narrowly for video. A system that records constantly and covers even part of a public space is directed outwards from the private setting and cannot count as household activity. Their example of a fenced garden used only by the family sits inside the exemption, but only if the cameras do not reach a public space or a neighbouring property. Cameras inside a home may fall inside it too, depending on factors such as the personal relationship with those filmed, whether the scale suggests a professional activity, and the adverse impact on them.

For an installer, that turns a domestic job into a framing exercise. You cannot decide whether the exemption applies for the customer, but you can control what each camera sees and put it in writing. Here is a handover note an assistant can draft from your survey photos (illustrative), which you then check against what is actually on the screen:

Where your cameras can point
Camera 1 (front door): covers your porch and path. The view is set to
exclude the pavement; the masking is shown in the attached screenshot.
Camera 2 (driveway): covers your drive. Part of the neighbour's gate was
in view and has been masked.

Keep cameras on your own property. A camera that records any part of a
public space or a neighbour's property may fall outside the household
exemption, and data protection duties can then apply to you. If a view
cannot be limited, ask for advice before recording.

Whether a sign is required inside the exemption is for the customer's adviser. Many installers fit one anyway, and it costs little. The wording shrinks to match the facts (illustrative): "CCTV in operation at this property to protect people and property. Images are recorded and deleted after [period]. Contact: [owner's details]."

Workplaces add a layer of their own, since employees do not expect to be monitored by their employer in most settings, and the guidelines are cautious about relying on consent there. AI CCTV Cameras for a Factory: Detection, Cost and Staff Consent goes into that side. For placement that avoids unwanted views from the start, Can AI Plan CCTV Camera Placement From a Floor Plan? is the companion.

Eight defects to hunt for in any AI-drafted notice

• An invented retention period. The most common one. Every number in the draft must trace to the decision sheet.
• A compliance claim. "Fully GDPR-compliant" is a conclusion no draft can reach, and it can mislead people. Delete it wherever it appears, including in product descriptions on your own quote.
• The wrong legal basis. Consent shows up as a default. The client's adviser chooses the basis, and the sheet records it.
• A missing pointer to the full notice. A sign that carries no web address, QR code or "ask at reception" fails the layered approach.
• An incomplete rights list. Video notices usually centre on access, erasure, restriction and objection, but the adviser checks the list against Article 13 and confirms the complaint route.
• Claims the system contradicts. "Footage never leaves the building" is false the day the owner enables a cloud app on their phone. Ask what is switched on, not what is intended.
• Boilerplate from somewhere else. Drafts can carry the name of another regulator or a law that does not apply to this site. Replace them with the client's own.
• The last job's details. When you reuse a template, the previous client's name can survive in a footer. Search the file for it before you send.

Keep real names and addresses out of the prompt in the first place and add them to the final document. The same privacy habit matters for the tool: GDPR and AI Tools: What a Small Business Must Do explains what to look for. And if the client asks why you did not simply generate a policy and be done, ChatGPT Privacy Policy Generator or a Solicitor? What Each Gets You sets out what each route covers.

When drafting stops and the adviser takes over

Some situations are beyond what a drafting aid should touch. Stop and send the client to an adviser when any of these appear:

1. Audio recording of any kind, or cameras that can be remotely steered or zoomed beyond the need.
2. Face recognition or any analytics meant to identify people.
3. A view of a public road, a shared drive or a neighbour's property that cannot be masked.
4. Cameras anywhere staff rest, change or wash, or monitoring of employees' work rather than property.
5. Remote viewing or hosting by a third party, especially one that operates outside the area the GDPR covers.
6. Large-scale monitoring of an area open to the public, where an impact assessment may be required.
7. A request from someone filmed, a complaint, or a demand from the regulator.

For everything else, the routine is short: the client fills in the decision sheet, you draft from it with the trace list, the client's adviser or the regulator's guidance confirms the wording, you set the recorder to match and photograph the oldest clip three days later, and the whole bundle goes into the handover pack. The assistant does the typing in the middle. Everything on either side of it is decided and checked by people.

Questions installers ask about CCTV notices

Does the installer or the client own the CCTV privacy notice?

Usually the client, because the business that decides why the cameras exist and how long footage is kept is the controller and owes the notice. The installer supplies draft wording for the client to adopt. If you also hold or view footage for them, for example through remote maintenance or hosting, you may be a processor, which needs a written contract. Settle that with the client's adviser.

How long can a business keep CCTV footage?

There is no single number to copy. The EDPB guidelines say footage should in most cases be erased, ideally automatically, after a few days, and that keeping it beyond 72 hours needs more justification. The client chooses a period for each purpose and documents why. Your job is to make the recorder's setting match the period on the sign and in the notice.

Do homeowners need CCTV signs?

The household exemption is read narrowly. A camera that covers only the homeowner's own fenced property and family can fall inside it. One that covers even part of a public space or a neighbour's property generally cannot, and then the usual duties, including a notice, may apply. Advise the customer where cameras may point, and suggest advice if the view cannot be limited.

Can AI produce a GDPR-compliant CCTV notice?

It can produce a draft. Compliance depends on facts the assistant does not hold: the client's purposes, legal basis, retention period, recipients and local requirements. Treat any claim of compliance in AI output as a flaw to delete, then have the client check the draft against the regulator's guidance and, where the site is complicated, an adviser.

Further reads

• CCTV Installation Quote Template: A Worked AI-Drafted Walk-Round Quote — Quote the job with scope and exclusions before the notice work.
• CCTV Maintenance Contract: Remote Health Checks and Renewals With AI — Maintenance visits that also confirm retention settings.
• Alarm Installer Quote Template: Zones, Detectors and Monitoring With AI — A parallel quote template for alarm work.
• Alarm Company Software: Monitoring, Service and Billing, and Where AI Helps — Monitoring, service and billing software for installers.
• What to Check in an AI Tool's Privacy Policy and Terms — What to read in an AI tool's privacy terms.
• How to Stop AI Tools Training on Your Business Data — Keep client site details out of AI training.
• AI Footfall Cameras for a Retail Store: What They Count and Privacy — What a footfall camera really counts, how to turn the numbers into a better rota, and the privacy checks and signage to settle before you install one.
• AI Shoplifting Detection for a Small Shop: What It Sees and the Law — Loss sums, false-alarm numbers, privacy duties and a vendor question list for a small shop weighing AI shoplifting detection on its cameras.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: EDPB Guidelines 3/2019 on processing of personal data through video devices (transparency, storage periods, household exemption and DPIA sections), GDPR Articles 13 and 28 as published at gdpr-info.eu. Notice wording, recorder figures and AI outputs in the examples are illustrative and are not legal advice.