The General Data Protection Regulation is the European Union rule for personal data, and recorded images of identifiable people count as personal data. It applies to organizations outside the EU that offer goods or services to people there or monitor their behavior, so a US camera system can fall in scope.
Most security work is governed by local law, yet recorded video travels. The GDPR reaches a US business when its cameras or cloud platform handle data about people in the EU.
When the regulation applies
Two triggers bring a company into scope: offering goods or services to people in the EU, or monitoring their behavior, which includes camera surveillance of a premises they visit.
Practical duties for camera systems
Recorded video needs a lawful basis, visible notice, a stated retention period, access controls and a way to answer requests from the people who were filmed.
Related:Commercial security camera systemsGlossary: Video management system