Drones in security: what is allowed and when they make sense

• Open: no prior authorisation or declaration, but only if every condition in article 4 is met: under 25 kg, a safe distance from people and never over assemblies of people, the drone in the pilot’s visual line of sight at all times, within 120 metres of the ground, no dangerous goods and nothing dropped.
• Specific: when any open-category condition is not met. It needs an operational authorisation from the competent authority, backed by a risk assessment, or a declaration when the flight fits a standard scenario (articles 3 and 5).
• Certified: for the highest risk, such as flights over assemblies of people; it needs certification of the drone and the operator (article 6).

In Greece, specific-category declarations and authorisations go through the Hellenic Civil Aviation Authority (ΑΠΑ), as its own drone FAQ explains.

The condition a security flight breaks most often is visual line of sight: on a large site the drone reaches places the pilot cannot see with their own eyes. Under article 5 the operator then needs an authorisation from the competent authority, with a risk assessment and mitigating measures.

• Operator registration: in the open category, the operator registers if the drone weighs 250 g or more or carries a sensor able to capture personal data, which means almost any drone with a camera; in the specific category, for a drone of any weight (article 14).
• Geographical zones: Member States can define zones for safety, security, privacy or environmental reasons, where flights are banned or need an authorisation (article 15). Check your site before any plan.

Before you accept a drone service, ask the provider which category it will fly in, under which authorisation or declaration, and who the registered operator is. If they cannot answer with documents, the service is not ready.

Regulation 2019/947 itself recognises the risk: a camera able to capture personal data is a reason for mandatory operator registration, and privacy is a reason a state may close a zone. As far as we could find on its website, the Hellenic Data Protection Authority has no drone-specific guidance.

• Fly over your own site and point the camera at the boundary, not at neighbouring houses or streets.
• Decide in advance who watches the footage, how long it is kept and who can access it.
• The camera is not used to monitor employees.

For the video-surveillance rules, see the CCTV and GDPR guide and the footage retention guide.

• Large areas: solar parks, industrial zones, ports, agricultural and energy sites.
• Alarm verification: the drone reaches a distant stretch of the perimeter first and shows what is happening before a person goes.
• Irregular sites: construction sites that change every week, where fixed cameras cannot keep up.
• Inspection: checking fences and roofs without anyone climbing.

OVIT offers drone surveillance: scheduled or on-demand flights extend fixed coverage across large or irregular sites and feed the same record as the ground teams. For construction, see also the construction site theft guide.

• A shop, an office or a building already covered by cameras and a guard.
• Public areas, where the distance-from-people conditions make flying difficult or impossible.
• Sites inside a geographical zone that bans or restricts flights.
• Anywhere the drone’s picture is not tied to a person who verifies and responds.

A drone is a tool for the patrol, not a replacement for it. The guard or security system guide explains why detection without a response only informs.

For sites that need it, OVIT offers airspace security: unauthorised drone activity is detected, tracked and handed to a response team as a defined, recorded event. What may lawfully be done beyond detection is outside the scope of this guide.