The lawful basis for CCTV usage under GDPR typically relies on legitimate interests, public task, or legal obligations. Businesses often use “legitimate interests” to protect property or ensure safety, while authorities cite “public task” for crime prevention. …