Data protection commissioner clarifies surveillance rules and announces inspections

Data Protection Commissioner Maria Christofidou stated on August 24, 2026, that municipal authorities must perform a Data Protection Impact Assessment (DPIA) before installing CCTV in public spaces. This requirement is mandatory under the General Data Protection Regulation (GDPR) and national law. While municipalities are permitted to use cameras for security, civil protection, and the prevention of vandalism or fire, such systems must be proportionate, necessary, and subject to prior approval from the Commissioner’s office. Municipalities are currently submitting these assessments for evaluation.

Separately, on August 26, Commissioner Christofidou announced that her office will launch a series of on-site inspections in September targeting restaurants, entertainment venues, and hotels. This decision follows her personal discovery of illegal cameras installed in private areas, such as restrooms, which are strictly prohibited. While some businesses are complying with data protection regulations, the Commissioner noted that staff shortages have delayed the start of these inspections. Moving forward, the office aims to address these privacy violations through targeted enforcement across the hospitality sector.