The Data Protection Authority sets the new rules for video surveillance

The Catalan Data Protection Authority replaces its 2009 instruction with Circular 1/2026, which establishes the rules for the processing of personal data consisting of images and, where applicable, voices captured by cameras for video surveillance purposes. The regulation is published in the Official Gazette of the Generalitat de Catalunya (DOGC) no. 9775, dated October 19, 2026, with the official reference CVE-DOGC-A-26287083-2026. It enters into force twenty days after publication, that is, in early November.

The circular is issued under article 57.2 of Organic Law 3/2018 on the protection of personal data and guarantee of digital rights, article 5.e of Law 32/2010 of the Authority, and article 15.1.e of Decree 48/2003. It was signed in Barcelona on October 14, 2026, by the director Meritxell Borràs Solé. It is structured into six chapters, one additional provision, one transitional provision, one repealing provision, one final provision, and an annex that specifies the information sign.

The text replaces Instruction 1/2009, which had been in force for seventeen years, and adapts it to Regulation (EU) 2016/679 (GDPR), Organic Law 7/2021, and Law 5/2014 on private security. During the processing, Regulation (EU) 2024/1689 on artificial intelligence was approved, which the circular incorporates. The project underwent prior public consultation and public information, with reports from the Department of Interior and Public Security, the Catalan Institute for Women, the Data Protection Advisory Council of Catalonia, and the Legal Advisory Commission.

Scope: administrations, local entities, and linked entities

The circular applies to video surveillance processing by public institutions in Catalonia, the Administration of the Generalitat, local entities, autonomous entities and consortia, public and private universities of the Catalan university system, and public law corporations acting exclusively in Catalonia. It also binds private law entities when the capital, income, or governing bodies depend mostly on these public entities, and those providing public services through any form of management.

Excluded from its scope are video surveillance in the field of private security, domestic images, fake cameras, captures for exclusively journalistic purposes, and driver-assistance cameras that do not record. For the Generalitat Police - Mossos d’Esquadra and local police, the circular applies supplementarily with respect to their specific regulations.

Prohibitions: changing rooms, dining halls, classrooms, and facial recognition

The text declares it unlawful to capture images or voices in several spaces:

• Bathrooms and changing rooms, and worker rest or leisure areas, such as dining rooms and break rooms.
• Rooms in residences, hostels, hotels, and similar establishments.
• Rooms in healthcare centers, unless necessary to protect a vital interest.
• The interior of classrooms, gyms, or student leisure spaces, unless justified by an overriding interest.
• Public roads, except for security forces and bodies, private security companies, incidental capture for monitoring a building, or the protection of strategic infrastructures.

It is also considered inappropriate to use cameras in the workplace for the exclusive purpose of continuously monitoring performance, or to process images on a generalized basis using facial recognition or biometric analysis techniques. An image is not biometric data in itself, but it becomes so when a specific technical process allows for unique identification. Voice recording is only permitted on an exceptional basis, provided it does not involve strictly private conversations and the purpose cannot be achieved through images alone.

One month of retention and mandatory yellow signs

Recordings must be deleted within a maximum period of one month from capture, unless they are needed to prove acts against the integrity of persons, goods, or facilities, to demand accountability, or to address requests for access or limitation. If there are indications of a serious incident, the images must be made available to the competent authorities within a maximum of seventy-two hours.

Information signs shall now have content and design regulated in the annex:

• Yellow background, rectangular shape, and standard dimensions of approximately 21 centimeters wide by 29.7 high.
• The indication “ZONA VIDEOVIGILADA” (VIDEO SURVEILLANCE ZONE) and the text “PROTECCIÓ de DADES” (DATA PROTECTION).
• A camera pictogram inside a white rectangle, which must reflect voice capture when applicable.
• Identification of the controller, reference to the rights of access, rectification, limitation, erasure, and opposition, and a QR code or website address for further information.

Signs must be placed before starting the capture and, in open spaces, less than fifty meters from the outer limit of the monitored area. Existing signs that comply with Instruction 1/2009 may be kept until they need to be replaced through ordinary maintenance.

Prior report, impact assessment, and rights

Before implementing a system, a report must be prepared justifying the lawfulness, the purpose, the location and field of vision of the cameras, the technical characteristics, and the security measures. When video surveillance involves systematic large-scale observation or high risk, the impact assessment replaces this report and, if the risk persists, the Authority must be consulted beforehand.

To exercise these rights, the person must indicate the location, date, and approximate time in intervals not exceeding two hours and provide an image of themselves from that period. If the image does not allow for identification, they have ten business days to correct it; the data protection officer must respond within two months and, if there is no response, a claim can be filed with the Catalan Data Protection Authority.

The additional provision subjects systems with artificial intelligence to Regulation (EU) 2024/1689, especially the prohibited practices of Article 5.1 and the obligations regarding remote biometric identification in real-time and retrospectively in publicly accessible spaces.

The regulation arrives when video surveillance is already massive in streets, transport, and facilities, and it does so with a common criterion for all those subject to the Authority. For citizens, the most visible change will be the standardized signs and the possibility of requesting access to images through a specific procedure; for administrations, the obligation to document each system and justify why the camera is essential.

Source: Official Gazette of the Generalitat de Catalunya, no. 9775, October 19, 2026, Other provisions, pp. 1-17 (official reference: CVE-DOGC-A-26287083-2026).