New rules on CCTV monitoring

As of 1 April 2025, companies are no longer required to obtain a permit from the Swedish Authority for Privacy Protection (IMY) for CCTV monitoring.

Instead, companies subject to the rules must apply a legitimate interest assessment. This means that the interest in monitoring must be balanced against the rights of individuals not to be monitored. If the interest in monitoring outweighs the privacy interests, monitoring may be lawful, subject to certain conditions.

Before setting up CCTV monitoring, companies should prepare carefully. Key considerations should include:

• What personal data will we process, if any?
• What is the purpose of setting up the cameras?
• What legal basis are we relying on?
• Does our interest outweigh that of the affected individuals?
• Have we documented our legitimate interest assessment?
• What retention periods do we have in place?
• Do we need to conduct a data protection impact assessment?
• Have we listed the CCTV monitoring in our internal records?

Procedures relating to CCTV monitoring should be reviewed on an ongoing basis.

IUNO’s opinion

Simplified rules and fewer administrative burdens do not necessarily make it easier to set up CCTV monitoring measures. Most do not expect to be monitored, at work or in public, and the use of CCTV is an intrusive measure.

IUNO recommends that companies consider the relevant rules for the current and future use of CCTV monitoring and footage. In addition to the list above, companies may also need to consider information obligations, appropriate safeguards, training, data processing agreements, and more. It is a clear benefit to structure the right routines to ensure focus on the many rights and obligations in play.

We have previously written about the use of CCTV monitoring at the workplace here.