Video surveillance at work: technical choices and the law

A well-chosen video surveillance system protects the business, but it needs to be set up correctly on the technical side and follow clear rules under Romanian data protection law. Picking the wrong cameras or skipping the duty to inform employees and visitors can turn a useful investment into a legal problem. Here is what matters at each step.

Resolution and field of view

A minimum resolution of 2 megapixels (Full HD) is the threshold below which useful detail — a license plate, a face at 5 to 6 meters — becomes hard to make out. For main entrances or cash registers, 4 to 5 megapixels give enough detail even when the footage is enlarged later. A wide field of view looks appealing, but a camera with too wide an angle loses detail at the center of the frame — usually several cameras with a normal angle work better than one camera covering 180 degrees.

Placement and night lighting

Cameras are typically mounted 2.5 to 3 meters high, high enough not to be easily blocked by hand, but not so high that the angle distorts faces. Critical areas — entrances, cash registers, stock rooms — take priority over common areas. For night coverage, infrared cameras typically cover 15 to 20 meters in full darkness; for longer distances or larger outdoor areas, you need cameras with extra low-light sensitivity (starlight) or a separate IR floodlight.

NVR and storage duration

A dedicated NVR (network video recorder), not a plain hard drive plugged into an office computer, gives you continuous recording and holds up better under constant writing over time. Storage duration depends on the stated purpose: for most companies, 30 days is a reasonable window, enough to investigate an incident reported with some delay, without holding data for longer than needed. High-risk areas (cash registers, valuable stock) may justify a longer period, but it still needs to be clearly documented. For companies running several cameras or high resolutions, a mirrored disk setup (RAID) reduces the risk of losing all footage to a single disk failure.

Secure remote access

Checking camera footage from a phone or from home is useful, but it exposes the system if set up carelessly — a port opened directly to the internet, an unchanged default password, no two-factor authentication. Remote access should go through an encrypted connection, with a unique password per user and, ideally, the same VPN used for the rest of the company resources, rather than a port forwarded straight to the NVR. A clear log of who connected and when helps a lot if unauthorized access is ever suspected.

Power and cabling

Modern IP cameras use PoE (Power over Ethernet) — a single network cable carries both power and video, which simplifies installation considerably compared to separate power cabling. An uninterruptible power supply (UPS) for the NVR and PoE switch keeps the system running for a few hours even during a power outage, exactly the window when an unmonitored incident is most likely.

The legal side in Romania

Video surveillance in the workplace falls under data protection law. A few basic obligations, without replacing legal advice:

• Notice through a pictogram — a visible sign at the entrance to the monitored area, announcing the presence of cameras.
• Purpose of processing — must be clearly stated (protecting people and assets, for example) and footage cannot be used for another purpose, such as evaluating employee performance.
• Retention period — limited to what the stated purpose requires, documented in an internal policy.
• Banned areas — changing rooms, restrooms and other spaces with a reasonable expectation of privacy cannot be filmed, regardless of the reason.
• Access requests — a person who has been filmed has the right to request access to their own footage or information about the processing, and the company must respond.

These points are a general guide, not legal advice — for full compliance, talk to a data protection specialist or a lawyer.

How to start

A properly sized video surveillance system starts with an assessment of risk areas and can be complemented with access control for sensitive zones. For GDPR compliance, GDPR consulting helps you properly document your surveillance policy. Contact us for an assessment of your space.