Answer: Under GDPR, CCTV footage becomes personal data if individuals are identifiable directly (e.g., facial recognition) or indirectly (via context like time/location). Organizations must justify processing under legal bases like legitimate interests, conduct Data Protection Impact Assessments for high-risk monitoring, …