Under the GDPR, CCTV usage is classified as processing personal data. Organizations must have a lawful basis (e.g., legitimate interest or consent), display clear signage, limit data retention periods, and ensure footage security. Individuals retain rights to access, delete, or …