VIDEO SURVEILLANCE IN THE PRIVATE SECTOR – LEGAL FRAMEWORK AND KEY CHALLENGES IN THE REPUBLIC OF SERBIA
Video surveillance represents one of the most commonly used measures for the protection of persons, property, and business processes in modern operations. In the private sector of the Republic of Serbia, cameras are now present in almost all types of facilities — from residential buildings and business premises to retail and hospitality venues, as well as privately owned educational and healthcare institutions. Despite the widespread use of this technology, the legal regime governing video surveillance continues to raise significant practical dilemmas, particularly with regard to compliance with personal data protection regulations.
Unlike police and traffic surveillance, which are regulated by specific laws and secondary legislation, video surveillance in the private sector is not comprehensively regulated by a single statute. Although the Personal Data Protection Act (PDPA) does not regulate video surveillance as a separate legal institute, recording through cameras undeniably constitutes the processing of personal data, and therefore the general principles and legal bases under the PDPA apply. At the same time, the technical security aspects of video surveillance systems (design, installation, commissioning, maintenance, and monitoring) are regulated by the Private Security Act (PSA). Consequently, the lawfulness of video surveillance in practice must almost always be assessed through two parallel regulatory regimes: the personal data protection regime (PDPA) and the technical security and licensing regime (PSA).
Such a regulatory framework often leads to situations in which camera systems are perceived primarily as a technical rather than a legal issue, which significantly increases the risk of violating the rights of individuals whose data are processed.
Legal Framework of Video Surveillance in the Private Sector
Video surveillance in a private environment constitutes a form of personal data processing under applicable regulations. As soon as a natural person can be identified directly or indirectly through camera footage, all core principles of data processing must be applied. These include lawfulness, purpose limitation, data minimisation, storage limitation, and the implementation of appropriate technical and organisational safeguards, together with the controller’s obligation to demonstrate compliance (accountability principle).
In practice, the most frequently invoked legal basis for introducing video surveillance is the legitimate interest of the controller. Such interest may exist, particularly in cases involving property protection, access control to premises, or the safety of employees and service users. However, the existence of a legitimate interest alone is not sufficient. The controller must be able to demonstrate that video surveillance is necessary, proportionate, and that no less intrusive measure could achieve the same objective.
Particular importance attaches to conducting a balancing test, which assesses whether the controller’s interests prevail over the rights and freedoms of the individuals being recorded. In the absence of such an assessment, video surveillance systems are frequently considered unlawful in practice, regardless of their intended purpose.
Consent is often incorrectly relied upon as a legal basis in the private sector. In situations where individuals have no genuine freedom of choice — such as building entrances, workplaces, or shared premises — consent cannot be regarded as freely given and therefore does not constitute a valid legal basis for processing.
The subsequent use of video recordings for purposes that were not clearly defined in advance is particularly problematic. The practice of the Serbian Commissioner for Information of Public Importance and Personal Data Protection indicates that it is unlawful to use video recordings for employee attendance monitoring or as evidence in disciplinary proceedings when such purposes were not originally specified and when no explicit legal basis exists under labour or employment record regulations. Such “purpose expansion” typically results in a breach of the purpose limitation and lawfulness principles.
Principle of Proportionality and Limitation of Recording Scope
One of the key issues concerning the legality of video surveillance is compliance with the principle of proportionality. Cameras may be installed only to the extent necessary to achieve a specific purpose. In practice, surveillance systems often cover a significantly wider area than required, including public spaces, neighbouring properties, or private areas belonging to third parties.
Such extension of the camera field of view leads to excessive data processing and frequently constitutes grounds for supervisory proceedings. Recording areas where there is an enhanced expectation of privacy — such as restrooms, changing rooms, or spaces intended for individual work or medical treatment — is particularly problematic. In educational institutions, continuous monitoring of classrooms and offices is generally considered excessive, as the same objectives can be achieved through less intrusive measures.
Conversely, video surveillance is more easily justified at entrances, corridors, access points, and areas with elevated security risks (handling cash, hazardous materials, server rooms, laboratories, etc.), provided that the purpose is clearly defined and measures remain proportionate.
An additional level of risk arises when audio recording is used. Sound recording represents a particularly intrusive form of processing and can only rarely be justified in the private sector, as it significantly interferes with individuals’ privacy.
Transparency and Notification of Individuals
Transparency is one of the fundamental requirements for lawful video surveillance. Individuals present in monitored areas must be clearly, timely, and comprehensibly informed that recording is taking place, as well as about the identity of the controller and the means of exercising their rights.
A video surveillance notice cannot be reduced to a mere formality. In practice, generic or incomplete signage containing only a camera pictogram — without identifying the controller, processing purpose, or basic information about individuals’ rights — is common. Such an approach may undermine the legality of the entire system, even when the surveillance purpose itself is legitimate.
It is recommended to combine visible notices at the entrance to the premises with the availability of more detailed information (for example, on a website or directly from the controller), allowing individuals to fully understand how their data are processed.
Retention Period and Access to Video Recordings
Under the PDPA, there is no universal general retention period for video recordings — data may be stored only for as long as necessary to achieve the purpose of processing. However, where the Private Security Act applies, recordings generated through technical security systems must be retained for at least 30 days, unless extracted for the purposes of proceedings, in which case they are stored until the proceedings are finally concluded.
In the event of an incident, it is permissible to isolate the relevant portion of the recording and retain it during the duration of the relevant procedure, provided that clear procedures and access logs are maintained.
A particular risk arises from inadequate access control to recordings. In practice, multiple individuals often have the ability to view, copy, or share recordings with third parties without formal authorisation or access records. Such organisation of processing significantly increases the risk of misuse and the controller’s liability.
It should therefore be emphasised that, within its scope of application, the Private Security Act prescribes specific rules regarding the storage and use of data collected in the performance of technical security activities, including mandatory retention for at least 30 days and a prohibition on public disclosure or sharing with third parties outside the purpose for which the data were collected.
Video Surveillance and Modern Technologies
The development of modern technologies further complicates the legal framework of video surveillance. The increasing use of “smart” cameras, software analytics, and automated processing systems raises additional risks for the rights of individuals concerned.
Where advanced systems enable profiling, behavioural monitoring, or biometric identification, it is necessary to conduct a Data Protection Impact Assessment (DPIA) and implement stricter safeguards. European regulatory developments in the field of artificial intelligence clearly indicate a trend toward stricter regulation of mass and automated surveillance, which will inevitably affect domestic practice.
Need for a Comprehensive Regulatory Framework
Although video surveillance has become an integral part of everyday business operations, the Republic of Serbia still lacks a single, comprehensive regulation governing this field in the private sector. The existing legal framework is fragmented across multiple statutes and secondary legislation, without a coherent structure or precise rules.
Such a situation creates legal uncertainty both for controllers implementing video surveillance and for individuals whose data are processed. In the absence of clear rules regarding camera deployment conditions, permissible scope of recording, and individuals’ rights, video surveillance remains one of the most sensitive areas of personal data protection in practice.
Until a unified and precise regulatory framework is established, responsibility for lawful implementation remains primarily with controllers, who must approach video surveillance as a legal — rather than purely technical — issue.
Video Surveillance and the Private Security Act – Scope of Application
One of the most common practical questions concerns the application of the Private Security Act in the context of video surveillance. The source of confusion lies in the frequent assumption that this law applies to all uses of cameras, although its scope is more limited.
The Private Security Act does not regulate video surveillance as a form of personal data processing. Its purpose is not privacy protection, but rather the regulation of private security activities and the conditions under which physical and technical security services may be performed as a professional activity.
Accordingly, the Act applies when legal entities or entrepreneurs provide technical security services to third parties on a professional basis. In such cases, the design, installation, commissioning, maintenance, and monitoring of video surveillance systems may be carried out only by licensed entities.
Even when a legal entity uses video surveillance solely for its own purposes, the installation and technical implementation of the system may still fall under the licensing regime of the Private Security Act. However, the mere use of cameras does not make the entity itself a private security provider.
Where the Private Security Act does not apply to the operational use of the system, personal data protection rules continue to apply in full, since the entity operating the cameras acts as a data controller.
A distinction must therefore be made between:
Licensing requirements under the Private Security Act (installation and technical services),
The nature of services (one-time installation vs. ongoing technical security services), and
Data protection obligations (controller–processor relationship under the PDPA).
FAQ – Frequently Asked Questions on Video Surveillance in the Private Sector
Is video surveillance always considered personal data processing?
In most cases, yes. Whenever an individual can be identified directly or indirectly from footage, personal data protection rules apply.
What is the most common legal basis for video surveillance?
Typically, legitimate interest of the controller, supported by necessity and balancing tests.
Can consent be used as a legal basis?
Generally not, particularly where individuals have no genuine choice, such as workplaces or building entrances.
How long may video recordings be retained?
Under the PDPA, only as long as necessary for the processing purpose. Where the Private Security Act applies, recordings must be retained for at least 30 days.
Is audio recording permitted?
Audio surveillance is highly intrusive and can only rarely be justified in the private sector.
Who may access video recordings?
Only authorised persons, with access logs and appropriate technical safeguards.
Is live remote viewing allowed?
Only exceptionally and under strict controls. Broad access to live feeds is typically unlawful.
May footage be publicly disclosed (e.g., notice boards, social media)?
No. Public disclosure generally constitutes unlawful further processing.
Are cameras allowed in offices or classrooms?
Generally not, due to a high expectation of privacy. Surveillance is more justified in entrances and high-risk areas.
When does the Private Security Act apply?
When technical security services (installation, maintenance, monitoring) are provided to third parties as a professional activity.
Is a data processing agreement required with service providers?
Yes, whenever an external provider has access to footage or surveillance systems.
Disclaimer:
This text is of an informational nature only and does not constitute legal advice.
