Body cameras for security guards: what GDPR allows in Greece

We searched dpa.gr for the Greek terms for “body cameras”, “portable cameras”, “uniform camera” and “bodycam” (14 October 2026). The only result was Decision 59/2018: after a complaint about a police officer carrying what looked like a camera on his uniform, the Authority could not establish whether anything was filmed and made recommendations to the police on documenting complaint investigations.

One point in the decision applies to any professional: the Authority held that using a camera on duty is not a personal or household activity, even if the employee alone decided to use it. The decision was issued under the old Law 2472/1997 and concerned the police, not a security company.

This may change. Before deploying body cameras, check dpa.gr again for newer guidance or decisions.

Under article 4 of Directive 1/2011, video surveillance systems are those permanently installed in a place and running continuously or at regular intervals. The Authority also notes that hand-held cameras, photo cameras and mobile phones are not considered video surveillance systems. It says nothing about body cameras.

Filming people is still processing of personal data; the Authority stresses that even a live picture with no recording is processing. So the GDPR principles apply. The Directive’s rules on proportionality, retention and audio serve as a benchmark, not as an explicit duty for bodycams.

GDPR article 5(1) requires data to be processed lawfully, fairly and transparently, for specified, explicit and legitimate purposes, limited to what is necessary, and kept no longer than necessary. For a body camera, that means:

• A written purpose: e.g. documenting incidents and protecting the guard and others, not a general record of the shift.
• Record only during an incident: continuous recording for a whole shift is hard to justify as “necessary”.
• Milder means first: Directive 1/2011 (art. 5) asks whether a less intrusive means would achieve the purpose, which is a good question here too.
• Restricted access: who views, who exports, and how it is logged.

For fixed cameras, the Authority names legitimate interest (GDPR art. 6(1)(f)) as the usual legal basis. It has not said the same for body cameras; document the basis in the impact assessment.

The camera also records the guard. For CCTV in workplaces, article 27(7) of Law 4624/2019 says footage may not be used to evaluate employees’ efficiency and that employees must be informed in writing. The law does not say whether this covers bodycams; apply it as a minimum.

GDPR article 13(1) requires information at the time the data are obtained: the controller’s identity and contact details, the purpose and legal basis, the legitimate interest where the basis is art. 6(1)(f), and the recipients. Because the camera moves, a fixed sign at the entrance is not enough on its own. In practice:

• clear marking on the uniform or camera that recording takes place;
• a recording indicator (such as a light) when the camera is recording;
• a spoken notice from the guard before or as recording starts, where the situation allows;
• a full notice on site and on a website, as for fixed cameras.

What a sign for fixed cameras must say is covered in CCTV and GDPR in a business.

Article 6 §5 of the Directive prohibits processing audio for protecting people and property, with an exception only where the Authority finds it absolutely necessary. Many body cameras record sound. If you want audio, justify it specifically in the impact assessment; otherwise switch it off.

The GDPR gives no number of days: data are kept as long as necessary for the purpose (art. 5(1)(e)). For fixed cameras, article 8 of the Directive sets up to 15 working days with no incident, 30 days for an incident against the controller and 3 months when it concerns a third party. More in the guide on CCTV footage retention.

The clip that documents an incident is linked to the incident report; the rest is deleted on the schedule you set.

GDPR article 35 requires an impact assessment before processing that, in particular using new technologies, is likely to result in a high risk (para. 1), and in particular for systematic monitoring of a publicly accessible area on a large scale (para. 3(c)). The Authority’s list (Decision 65/2018, Government Gazette Β΄ 1622/10-5-2019, item 1.5) includes systematic, large-scale monitoring through video surveillance “or any other means” in places open to the public.

Under article 35(7), the assessment contains at least:

1. a systematic description of the processing and its purposes, including the legitimate interest where it applies;
2. an assessment of necessity and proportionality;
3. an assessment of the risks to people’s rights;
4. the measures to address them.

OVIT links security equipment to shift reports in Guardly. If you are considering body cameras, talk to us about where they would add real evidence.