Data Protection Commissioner announces audits of surveillance systems in hospitality

The Data Protection Commissioner of Cyprus has officially launched a series of targeted, on-site compliance audits for businesses within the catering and entertainment sectors. Announced on September 8, 2026, these inspections are focused specifically on the installation and operation of closed-circuit television (CCTV) systems to ensure they align with the General Data Protection Regulation (GDPR).

The primary objective of these audits is to evaluate how businesses handle the processing of personal data, as video and audio recordings are considered sensitive personal information under European law. The Commissioner's office confirmed that it frequently receives queries and complaints regarding the legality of cameras in spaces such as restaurants and recreational venues. This initiative follows recent public concerns, including reports of unauthorized camera placements in private areas.

Businesses are being warned that even if data is not stored, the act of recording constitutes a significant processing activity governed by strict legal limitations. The authorities intend to enforce compliance through these inspections to ensure the privacy rights of the public are protected across the hospitality industry.