How long can CCTV footage be kept in Greece?

Article 8 §1 of Directive 1/2011 says data are kept for a specific period in view of the purpose and, if no incident arises, are destroyed at the latest within 15 working days. Special rules for certain categories (the Directive mentions casinos) take precedence. The Authority confirms the Directive applies alongside the GDPR.

• No incident: up to 15 working days.
• Incident against the business: 30 days, in a separate file (§2).
• Incident concerning a third party: 3 months (§3).

The other rules — where cameras may go, signs, employees, who is responsible — are in our guide to CCTV and GDPR for businesses.

The distinction in article 8 is who the incident concerns. These are hypothetical examples:

• Goods stolen from your shop: an incident against your property → the clip in a separate file for up to 30 days.
• A night-time break-in at your warehouse: also against you → up to 30 days.
• A customer’s car broken into in your car park: the incident concerns a third party → up to 3 months.
• A passer-by attacked at your entrance: concerns a third party → up to 3 months.
• A quiet week: no incident → the footage is deleted within the 15 working days.

An employee arriving late, or their “performance”, is not an incident: cameras may not be used to check or evaluate employees (art. 27 Law 4624/2019, art. 7 of the Directive).

1. Set a limit in days, not just “overwrite when the disk is full”. With a large disk, “when full” can mean far more days than allowed.
2. Count correctly: the recorder counts calendar days, the rule counts working days. As simple arithmetic, 14 calendar days always contain fewer than 15 working days, so it is a simple, safe setting.
3. Check the oldest recording once a month: if you find footage older than the limit, the setting is not working.
4. Check the recorder’s clock: a wrong time makes an incident hard to find and harder to prove.
5. If someone else runs the system, write into the contract who sets and who checks the retention period.

1. Export at once: the overwrite cycle keeps running. Export only the clip of the incident, not whole days.
2. Separate file: article 8 §2 provides for keeping the incident “in a separate file”.
3. Cover note: camera, date and time, any offset in the recorder’s clock, who exported it and when.
4. Security: article 11 §1 requires access control to the archive and secure transfer; as examples it mentions encrypted storage and digitally signing material that is passed on.
5. Deletion date: note from the start when the 30 days or 3 months run out.

If you think you need the footage beyond these limits, take legal advice before keeping it.

Article 9 of the Directive requires consent for any transfer to third parties, with three exceptions:

• §2: you must transfer to judicial, prosecutorial and police authorities data they lawfully request in the course of their duties;
• §3: you may transfer to them data that may be evidence of a criminal act (e.g. theft, assault) committed on your premises;
• §4: you may give such evidence to the person shown as victim or perpetrator.

In practice: hand over a copy, keep your exported file untouched, and note what you gave, to whom and when. Do not share footage with other third parties, such as neighbours or social media: outside the cases above, the Directive requires consent.

Article 13 §1 of the Directive gives anyone recorded a right of access. The requester must state the exact time and place they were there. Within 15 days the business:

• provides a copy of the relevant segment or printed stills, masking other people (e.g. by blurring); or
• replies in writing that the requester is not shown or that the segment has been destroyed; or
• if the requester agrees, shows them the clip at once — in that case masking others is not required.

A properly set recorder helps here too: if the footage has already been lawfully deleted, the answer is simple. OVIT pairs security equipment with field response, and in Guardly the client sees patrols, incidents and reports in one live picture.