Workplace CCTV in Poland: 6 mistakes employers make before recording starts 

Companies installing cameras in a Polish warehouse, plant or office must comply with two sets of rules at the same time: Article 22² of the Polish Labour Code (Kodeks pracy) and the GDPR. In our practice the most common finding is not a missing document but the order of events: the cameras are installed and recording first, and the paperwork is meant to follow.

This news explains what Polish law requires, what supervisory authorities in Poland and across the EU have been fining, and what to check before recording starts. It is intended for managing directors, HR and compliance teams of companies operating warehouses and production sites in Poland.

Workplace CCTV in Poland: What the labour code and GDPR require

Under Article 22² of the Labour Code an employer may use CCTV only where it is necessary for employee safety, protection of property, production control or keeping information confidential. Cameras may not cover trade union premises; sanitary rooms, changing rooms, canteens and smoking rooms are excluded as a rule, unless monitoring there is necessary for one of the statutory purposes and does not infringe employees’ dignity (for example through techniques that prevent individuals from being identified), and monitoring of sanitary rooms additionally requires the prior consent of the trade unions or employee representatives.

The purposes, scope and method of monitoring must be set out in a collective agreement, in the work regulations or, where the employer has neither, in a written notice (obwieszczenie). Employees must be informed at least two weeks before the cameras are switched on, every new employee must receive written information before starting work, and the monitored area must be marked no later than one day before launch. Recordings may be kept for a maximum of three months, unless they are evidence in proceedings.

The GDPR applies in parallel. The employer needs a documented legitimate interest assessment (Article 6(1)(f) GDPR), separate information notices for employees and for visitors such as drivers and contractors (Article 13 GDPR), an entry in the record of processing activities, written authorisations for the people who view recordings, a data processing clause with the installer or service company if it can access footage, and security measures for remote access.

The guidance of the Polish supervisory authority (UODO) on video monitoring (2018) and the EDPB Guidelines 3/2019 on video devices add three practical points: CCTV is never necessary by default, recording sound is generally excessive, and any coverage beyond the controller’s own premises (public roads, neighbouring property) must be kept to the strict minimum.

The most common workplace CCTV mistakes in Poland

When we review CCTV systems at warehouses, production sites and offices in Poland, the same problems come back in different combinations. The installer switches the system on the day it is fitted and the employer assumes the formalities can be completed later; the two-week notice period then either starts too late or is skipped. Employees sign a health and safety induction sheet with a line stating that CCTV is in use, and the employer treats it as consent.

Consent, however, is neither required nor valid here: in an employment relationship it is not freely given, and the Labour Code procedure cannot be replaced by a signature. Audio recording is left at the factory default, which is usually on. Cameras on the outside of the building capture a public road, a car park shared with other companies or a neighbour’s yard.

Everyone with a smartphone uses the same administrator login for the recorder’s app, including managers based abroad. The installation contract covers fitting the cameras but says nothing about the service company’s access to footage. None of these issues is expensive to fix before launch; all of them are awkward to explain to UODO afterwards, because each of them is also a breach of a GDPR principle.

CCTV fines in Poland and across the EU: What employers need to know

In Poland, in January 2025 the President of UODO imposed two fines totalling close to PLN 1.15 million on a Kraków medical centre: close to PLN 700,000 for hidden cameras in two neonatal ward rooms of which neither patients nor staff had been informed, and close to PLN 460,000 for failing to secure the memory cards holding the recordings (decision DKN.5131.4.2024, upheld by the Warsaw Regional Administrative Court in 2025). 

In July 2026 UODO imposed its first fine for private CCTV, PLN 26,711, on a private individual who ignored a final order to stop cameras recording image and sound of a public road and neighbouring properties (decision DKE.561.4.2026). Both cases turn on the same points that matter for employers: hidden or unannounced cameras, audio, and coverage beyond the controller’s own premises.

Elsewhere in the EU the amounts are higher. In Germany the Lower Saxony authority fined the retailer notebooksbilliger.de EUR 10.4 million in 2020 for permanent camera surveillance of staff in warehouses, sales floors and break areas with 60-day retention; after five years of litigation (the first-instance court had reduced the fine to EUR 700,000) the Higher Regional Court of Celle set the final fine at EUR 900,000 in December 2025 while confirming the infringements.

In France the CNIL fined Amazon France Logistique EUR 32 million in December 2023 for warehouse employee monitoring, including insufficient information about video surveillance and weak access controls to the CCTV software. In Spain the AEPD fines employers routinely: EUR 26,000 in total for a camera capturing part of a staff rest room (EUR 20,000) and outdated information signs (EUR 6,000; PS/00261/2020), EUR 5,000 for recording sound in a shop (EXP202205820) and EUR 70,000 (reduced to EUR 42,000 for acknowledging liability and voluntary payment) where a supervisor shared footage of an employee’s toilet break in a group chat (EXP202300692).

What employers must check before starting CCTV recording in Poland

• Do the cameras serve one of the four statutory purposes, and can you show why less intrusive measures are not enough?
• Is there a notice or work regulations provision, delivered to employees at least two weeks before launch, and signage in place one day before?
• Are sanitary, changing and social rooms excluded, and do external cameras stop at your own premises (privacy masks)?
• Is audio recording disabled, and is retention set to three months or less?
• Do you have a balancing test, GDPR notices for staff and visitors, a record entry, authorisations, and a processing clause with the installer?
• Who can log in remotely, from where, and with what credentials?

What can happen if your workplace CCTV is non-compliant?

UODO may order the employer to stop recording and may impose a fine of up to EUR 20 million or 4% of worldwide turnover (Article 83(5) GDPR). Recordings obtained in breach of Article 22² may be challenged as evidence in the labour court, and employees or trade unions may raise the matter with the labour inspectorate (PIP). In practice the most common trigger is a complaint from a dismissed employee or a neighbouring business.

Implementing Workplace CCTV in Compliance with Polish Law

Workplace CCTV systems must comply with the Polish Labour Code, the GDPR and applicable data security requirements. Reviewing the system before the cameras are switched on helps reduce the risk of complaints, inspections and fines.

If you are planning to implement CCTV or already use cameras in a warehouse, production plant or office in Poland, our data protection and employment lawyers can comprehensively review your system and prepare all necessary documentation, including the employer’s notice, GDPR information notices, a legitimate interest assessment, record of processing activities entries and authorisations. We also support foreign companies entering the Polish market with compliance relating to workplace monitoring and local HR requirements. Contact us to review your CCTV system before launch or verify an existing installation.