A camera is easy to order; well-thought-out video surveillance isn't. A company that buys a system without first clarifying purpose, areas and responsibilities ends up either with surveillance that captures too much and causes internal debate, or with one that isn't watching the areas that actually matter. Video surveillance also touches sensitive data-protection questions and, where employees work in the covered area, usually the works council's co-determination rights as well, where a works council exists. This guide focuses on the practical preparation steps for commissioning an IT provider — data-protection questions are named as checkpoints for which you should involve the responsible bodies in your company, not as a final legal assessment.
Define purpose and areas
The first question is what the surveillance should actually serve: theft protection at entrances and exits, securing an outdoor site or warehouse, evidence in case of vandalism, or monitoring an area with particular security requirements, such as access control to a server room. The purpose largely determines which areas should be covered at all — and, just as important, which explicitly shouldn't. Changing rooms, sanitary, break and common rooms are off-limits. Permanent workstations shouldn't be in frame either. Put the purpose and areas in writing before approaching a provider — that not only makes the technical planning easier, it's also the basis for the follow-up conversation with the parties responsible for data protection in your company.
Technical requirements: resolution, retention, access
The technical requirements follow directly from the purpose. If a camera needs to record faces or license plates recognizably, it needs significantly higher resolution than a plain overview shot of a site. Also clarify whether night vision, weatherproofing for outdoor areas, or integration with an existing alarm system is needed. On retention: how long recordings are kept isn't purely a technical question — it depends on the purpose and on data-protection requirements. Decide this point together with the responsible parties, rather than choosing a duration purely for technical convenience. Access is just as important: who may view live footage, who may view recorded material, and is every access logged? A system without traceable access logs makes it harder, if it comes to that, to demonstrate how the footage was handled.
Data protection: checkpoints, not legal advice
Video surveillance touches data protection as soon as people are captured recognizably — including outdoors. You should clarify the following points with the responsible bodies in your company before commissioning, rather than treating them as an isolated IT decision:
- If your company has a data protection officer, involve them from the start.
- If employees are affected even at the margins of the covered area, check whether works council involvement is required, where a works council exists.
- If the provider has remote access to the footage, a data processing agreement is usually required.
- If a camera captures even part of a public street, a pavement, or a neighbouring property, clarify that specifically with the responsible bodies — this is usually prohibited or only allowed to a very limited extent.
- Clarify whether the planned system requires a data protection impact assessment.
- Clarify what signage needs to be posted at the monitored areas before the cameras go live.
- Document the purpose, areas and retention period in writing — this makes later questions considerably easier.
This guide deliberately names these points only as checkpoints, not as a final legal assessment: which requirements apply in your specific case depends on your situation and should be clarified with the relevant bodies — internal or external — before the system goes into operation.
Set up operation, access and integration
Decide who administers the system — internally, through the commissioned provider, or jointly — and how remote access for maintenance or troubleshooting is secured. If the video surveillance should connect to an existing access-control or alarm system, mention that in the request itself, since it affects the technical selection. Also clarify what response times are promised for fault cases, and whether a maintenance contract is part of the offer or agreed separately.
Check the provider's experience
Video surveillance combines classic IT topics like networking and storage with structural and security-technology questions — not every IT provider covers both sides equally well. Ask for references for comparable sites, such as similar building types or outdoor areas, and whether the provider has already implemented integration with existing alarm or access-control systems. Also clarify whether installation and later maintenance come from the same provider, or whether multiple trades need to work together — for example, an electrician for the cabling and an IT provider for the software and operation. A clear division of responsibility from the start prevents two providers from passing the blame back and forth in a fault case.
Get and compare offers
Summarize the purpose, areas, technical requirements and the clarified data-protection points in a written scope description before approaching providers — the guide to writing a scope description shows how such a description should be structured. As with other IT projects, get several offers in parallel; the guide to comparing offers explains what to look at besides price. If the video surveillance also depends on a network or WiFi refresh, the guide to a WiFi site survey and network refresh can help.
Checklist
- Purpose and monitored areas defined in writing, excluded areas named
- Requirements for resolution, night vision and weatherproofing described
- Retention period coordinated with the responsible bodies, not decided on technical grounds alone
- Access rights and logging defined
- Data protection officer, works council if applicable, and signage clarified
- Data processing agreement, public street space and data protection impact assessment clarified as checkpoints
- Responsibility for operation, remote access and maintenance agreed
- Experience with comparable sites and responsibilities between trades clarified
If you want to move forward with a video surveillance project, you can describe it on Projektlotse — the purpose, areas and technical points from this guide are enough to get started. Verified IT providers in your region see the request and get in touch with questions and offers. Your exact address and company identity stay confidential until you release them for a specific provider. Use is free during the current start phase.