Regulations For Installing Cameras in Workplaces, Shops, and Educational Institutions

The National Authority for the Protection of Personal Data has established specific rules for the use of video surveillance systems in workplaces, emphasising that the installation of such equipment requires prior authorisation from the relevant regional governor, following consultation with the provincial security committee.

The Authority stressed that the purpose of recordings remains limited to securing individuals and property, and that employees and clients must be informed of the presence of cameras, their locations, and the reasons for their use.

This was stated in Memorandum No. 02, dated March 4, 2026, issued by the National Authority for the Protection of Personal Data, which was reviewed by “Echorouk.” The memorandum outlines the rules of conduct and ethics for the use of video surveillance systems in workplaces, given the increasing adoption of these systems in government departments, economic institutions, shops, and even educational institutions.

According to the memorandum, the use of video surveillance equipment without night-vision capability remains subject to prior authorisation from the relevant regional governor, following consultation with the provincial security committee. This excludes the services of the National Defense and Interior Ministries, and is in accordance with the provisions of Law No. 18-07 of June 10, 2018, concerning the protection of natural persons in the processing of personal data, as well as the provisions of Executive Decree No. 09-410 of December 10, 2009, as amended and supplemented by Executive Decree No. 16-61 of February 11, 2016, relating to security regulations applicable to activities involving sensitive equipment.

In the same vein, the Authority stressed that the processing of personal data collected through recordings must be strictly limited to securing individuals and property within workplaces, while ensuring a safe and controlled work environment without infringing on individual rights or violating privacy. According to the memorandum, this necessitates strict adherence to the fundamental principles of personal data protection during the use of these systems.

The memorandum also obligates every natural or legal person, whether public or private, to declare to the National Authority any data processing carried out using video surveillance cameras. This ensures transparency in the use of these technologies and subjects them to oversight by the competent authority, within the framework of protecting individual rights and freedoms related to personal data.

On the other hand, the new regulations emphasise the need to inform employees and clients about the presence of surveillance cameras, their locations, and the purposes of their use. This is to be achieved through clear signage or appropriate internal communication channels, ensuring that individuals are aware of the nature of the processing that may affect their personal data and its purpose.

Regarding privacy protection, the memorandum emphasised the prohibition of installing surveillance cameras in areas where a high level of privacy is expected, such as restrooms, changing rooms, and private spaces. It also explicitly prohibited connecting video surveillance systems belonging to public structures, departments, companies, and institutions to the internet to prevent the risk of hacking or leakage of recorded personal data.

Regarding the use of recordings, the memorandum clarified that access to surveillance camera footage is restricted to authorised personnel designated by the data controller. The relevant authorities are obligated to store these recordings securely for a limited period not exceeding one year, thus ensuring that personal data is not retained for unjustified periods.

In the same context, the National Authority stated the need to respect the rights of persons concerned with the processing of their personal data, especially concerning the right to information, access to data, correction of data or objection to its processing, in accordance with the provisions of Articles 32, 34, 35 and 36 of Law 18-07 relating to the protection of natural persons in the field of processing of personal data.