How to install a video surveillance system in your business?

Today, video surveillance goes far beyond the simple function of a “camera that records”. When properly designed, it becomes a genuine security management tool.

Before choosing any equipment, the project must first be legally defined. This is the stage that many business leaders overlook when under time pressure, yet it is also the one that can expose organisations to the most significant penalties.

Every compliant installation is based on three fundamental principles.

An important distinction must be made: regulations differentiate between video surveillance in private or non-public areas, which mainly falls under GDPR and data protection regulations, and surveillance in certain publicly accessible locations, where additional legal requirements may apply. Confusing these situations can result in legal penalties.

Important point: We regularly see systems challenged not because of the equipment installed, but because information requirements have not been met: missing signs, unreadable notices or signs positioned after people have already entered monitored areas. An A5 notice placed 2.30 metres high behind a plant does not constitute compliant information.

Administrative obligations depend directly on the type of location being monitored.

Once the legal framework has been established, implementation can begin. A well-managed project is structured around six key steps.

This is the most strategic phase of the project and, paradoxically, the one that is often rushed. Before selecting any equipment, take the time to answer three essential questions.

• Which critical areas need to be protected? Entrances, emergency exits, vehicle access points, high-value storage areas, isolated locations or areas where cash or sensitive goods are handled.
• Which risks should be prioritised? External theft, internal theft, night-time intrusion, assaults against employees, vandalism, damage or fraud. Each risk requires a different type of image capture.
• What are your operational objectives? Is the purpose to deter, identify, detect in real time or investigate after an event? The required image quality and camera positioning depend on the answer.

A thorough risk assessment helps avoid unnecessary costs: first investing in an under-sized system, then paying again to expand or replace it.

Two types of technology still coexist on the market, but the choice for new projects is now much clearer.

• Analogue. A cost-effective solution with limited image quality, restricted scalability and transmission via coaxial cable. Still found in older installations, it is no longer recommended for new projects.
• IP (digital). Provides high-definition images (HD, 4K), secure remote access, native integration with a VMS (Video Management System), video analytics features (intrusion detection, counting, line crossing) and simple scalability through the existing network. It is now the professional standard and the foundation of modern video surveillance systems.

The higher initial investment of an IP system is largely offset by its longer lifespan, the quality of usable footage and the ability to integrate additional value-added services such as video verification.

• The recorder. For IP systems, a NVR (Network Video Recorder) is used. Key selection criteria include storage capacity adapted to the required retention period, a sufficient number of channels with room for future expansion and RAID disk redundancy for critical sites.
• Power supply and network. PoE (Power over Ethernet) technology significantly simplifies installation by allowing a single cable to carry both power and data. For large sites, managed PoE switches and a network infrastructure capable of handling the combined data flow generated by all cameras should be planned.

This stage is what separates a system that simply “works” from a system that is genuinely effective.

• Strategic positioning. Installation height, viewing angle, backlight management, anticipation of blind spots and consideration of future environmental changes (such as growing vegetation) are all essential factors. Even the best camera will lose its effectiveness if it is incorrectly positioned.
• Quality of installation. Protected cable routes, waterproof connections, proper grounding and lightning protection on exposed sites are essential. A poorly executed installation quickly results in repeated faults and degraded image quality.
• Certified installer. Using a qualified installer ensures compliance with industry best practices and makes discussions with insurers easier, as they increasingly require recognised standards for high-value sites.

Once the equipment has been installed, the system must be properly configured.

• Functional configuration. This includes setting motion detection zones, applying privacy masking to areas that should not be recorded (workstations, neighbouring windows), configuring alert scenarios and scheduling recording periods. The retention period is also defined at this stage: generally a maximum of 30 days, with the duration justified according to the purpose of the processing.
• Strict access management. Only authorised individuals (management, security managers or the DPO where required) should have access to recordings. Individual user accounts, strong passwords and full access traceability are the foundations of a secure system. Shared accounts such as “admin/admin” remain, even in 2026, one of the most common vulnerabilities identified by our auditors.

A video surveillance system requires continuous management.

• Regular checks to ensure cameras, recordings and access permissions are operating correctly.
• Preventive maintenance, including lens cleaning, checking mounting points and inspecting hard drives.
• Software and firmware updates for cameras, NVRs and the VMS. IP cameras are connected devices and therefore potential targets for cyberattacks. Firmware that has not been updated for several years represents a known security vulnerability.

Important point: Comprehensive maintenance is not limited to an annual visit. It also includes remote monitoring of key indicators (disconnected cameras, available storage space, missing alarms), a gradual replacement plan for end-of-life equipment and an emergency support channel for urgent interventions. This is what makes the difference between an installer and a true security partner.

Video surveillance is a strategic project that combines technology, organisation and regulatory compliance. When properly designed and implemented, it provides long-term protection for your assets, your employees and your business continuity. However, a poorly designed installation can lead to GDPR penalties, employment disputes and a system that fails to deliver when it is needed most.

The balance between security and respect for privacy is not a barrier: it is the key to creating a sustainable and accepted installation. The true value of a video surveillance system is not measured by the number of cameras installed, but by the quality of how they are operated, 24 hours a day, 7 days a week.

To guarantee an efficient, tailored system that fully complies with current regulations, support from a specialist is essential. Contact Scutum security experts to carry out a complete security audit of your business and benefit from the experience of one of Europe’s leading electronic security providers, operating five APSAD P5-certified monitoring centres.

This is strongly discouraged. There are four main reasons.

• Data protection authority guidance. Dummy cameras create a feeling of surveillance without providing any real security benefit. This may raise questions regarding the rights of people who believe they are being monitored.
• The same information requirements apply. Employees and visitors must be informed through appropriate signage, just as they would be for a real system. An unreported dummy camera installed discreetly may also create legal risks.
• Social risks. An employee may raise concerns about the pressure caused by perceived surveillance, even if the camera does not actually work. In such disputes, the company’s intention is not necessarily decisive.
• No operational value. In the event of a real incident, you will have no footage to provide to investigators, your insurer or your legal advisor. The initial saving on equipment may ultimately prove far more expensive.

• General rule: a maximum of 30 days. This is the most commonly used retention period, provided it is justified by the purpose of the processing.
• Principle of proportionality. The retention period must match the intended purpose. For a small retail business, 7 to 15 days is often sufficient. For a sensitive industrial site, 30 days may be justified. Any longer period requires strong justification.
• Mandatory documentation. The chosen retention period must be defined, justified and recorded in the Record of Processing Activities, as well as included in the information provided to monitored individuals.
• Exception in the event of an incident. Footage related to legal proceedings or investigations may be extracted from the system and stored separately for as long as necessary.

No, this is prohibited. Camera positioning must not result in continuous and permanent monitoring of employees.

• Respect for privacy. Permanent surveillance is considered a disproportionate measure and may conflict with employees’ fundamental rights and GDPR principles.
• What is permitted. Monitoring walkways, entrances and exits, storage areas and loading zones is permitted. A workstation may appear within a camera’s wider field of view, but the purpose must not be to specifically monitor an employee.
• Exceptional situations. For positions involving money handling or valuable goods (cash desks, jewellery counters or handling of controlled substances in pharmacies), the camera must focus on the activity area rather than the employee themselves. The viewing angle must be documented and justified.

There is no strict legal obligation, but it is strongly recommended for four main reasons.

• Compliance guarantee. Scutum understands GDPR and data protection requirements and designs installations accordingly: viewing angles, privacy masking, signage and documentation. This helps protect your business from regulatory risks.
• Technical expertise. Choosing the right equipment, correctly sizing the system, optimising camera positioning, eliminating blind spots and obtaining usable footage all make the difference between a genuinely effective system and one that only creates a false sense of security.
• Reliability and cybersecurity. Scutum protects installations against cyber threats through network segmentation, secure configurations, professional password management and regular firmware updates. A maintenance contract also ensures that this level of security is maintained over time.
• Responsibility. In the event of an incorrect installation or non-compliance, a certified installer assumes responsibility for the work carried out. This provides valuable legal protection for your organisation.