CCTV monitoring for the company: how to plan a camera system

A conversation about video surveillance usually starts with the question “how many cameras and how much?”. Only later does it turn out that the camera above the entrance shows silhouettes against the light, the recorder overwrites footage after a week, and nobody has told the staff about the monitoring. Each of these can be planned before installation.

Video surveillance is not mandatory equipment for a business. It should have a defined, justified purpose, and the scope of observation must be proportionate to it. Only then do you choose locations, camera views, image quality, retention time and system security.

We describe the technical and organisational side; this is not legal advice. Before you switch on monitoring of employees or of publicly accessible areas, confirm your obligations with a lawyer or a data protection officer.

1. The purpose of CCTV for each zone

A “just in case” purpose is too general. For each observed zone, define what event the system is meant to help detect or explain. Confirming that a person was present needs a different view than recognising a face at the entrance, and reading a number plate needs a different one again.

Example targets include:

• protection of property in a specific zone;
• access control to technical room;
• investigating events at the gate or release counter;
• process observation for people's safety;
• registration of vehicle movement at a designated point.

If the purpose cannot be clearly described, it is impossible to reliably assess whether a camera is needed.

2. CCTV, the GDPR and the Labour Code

An identifiable recording is personal data. The administrator should, among other things, determine the basis, purpose, scope, storage period, recipients and method of exercising people's rights.

Monitoring of workplace premises is also governed by Article 22² of the Labour Code (Kodeks pracy). The key rules:

• the employer may introduce monitoring if it is necessary to ensure employee safety, protect property, control production or keep confidential information whose disclosure could harm the employer;
• monitoring does not cover rooms made available to the workplace trade union;
• as a rule, it also does not cover sanitary facilities, changing rooms, canteens and smoking rooms, with exceptions allowed only where necessary for the purpose and without violating employees' dignity (monitoring of sanitary facilities additionally requires the prior consent of the trade union or employee representatives);
• the purposes, scope and method of monitoring are set out in the collective labour agreement, the work regulations or a notice;
• employees are informed no later than 2 weeks before monitoring starts, and a new employee before being allowed to start work;
• the monitored area is marked with visible signs or audio announcements no later than one day before monitoring starts.

In the design, avoid needlessly covering neighbouring properties, windows, workstations and areas unrelated to the purpose. Privacy masks can help restrict the view, but you need to check that they still work after the camera position is changed.

3. The task and framing of each camera

The plan should indicate for each camera:

• ID and location;
• observed zone;
• expected level of detail;
• typical and difficult lighting conditions;
• permanent and variable obstacles;
• required operating time in the event of a power failure;
• day and night image reception criterion.

A wide angle does not always help. The same image then covers a larger scene, so each object gets less detail. A camera covering the entrance may show a silhouette without footage that allows the person to be identified. We cover camera placement in more detail in our post on blind spots.

4. Matching the camera to the scene and conditions

The shape of the housing does not determine the quality. More important are the lens, sensor size, low light performance, dynamic range, housing resistance, mounting method and compatibility with the recorder.

Resolution is only one of the parameters. More pixels will not fix motion blur, an overexposed face, a dirty housing or the wrong view. Whether the camera meets its purpose has to be confirmed on real footage, including at night, as we describe in our post on camera image quality at night.

A PTZ camera does not observe all directions at once. If it is pointing elsewhere when an incident happens, there may be no footage. That is why in a critical zone a PTZ camera can supplement a fixed view, and should replace it only if this limitation is consciously accepted.

5. Recording and retention

Capacity depends on the number of cameras, actual data stream, frame rate, codec, scene dynamics, recording schedule and storage time. Calculations based solely on resolution may be significantly inaccurate.

The approximate formula for constant flux is:

capacity = sum of camera bitrates × recording time

Add a margin to the result and take into account how disk capacity is calculated and any redundancy. After commissioning, measure actual usage and confirm the oldest available recording date.

The retention period follows from the purpose and the law. There is no universal value of 14 or 30 days. For monitoring of workplace premises, the Labour Code allows footage to be kept for no longer than 3 months from the date of recording, and longer only if it is evidence in proceedings. After that, recordings containing personal data must be destroyed. The data minimisation principle may require a much shorter period: the European Data Protection Board states that in most cases (e.g. detecting vandalism) recordings should be deleted after a few days, and the longer the period (especially beyond 72 hours), the stronger the justification it requires. Details in our post on retention of surveillance recordings.

6. Network, PoE power and UPS for CCTV

IP cameras can use PoE, i.e. data and power over an Ethernet cable. You need to check the standard required by each camera, the power available on the port and the switch's total budget (PoE and power budget). The nominal rating of the power supply is not always fully available to devices.

The monitoring network should be appropriately separated and access rules limited to necessary systems and people. Default passwords should be changed, administrative accounts should be named, and remote access should not involve uncontrolled port redirection from the Internet.

The UPS can support the recorder, switches and cameras, but the operating time must be calculated for the actual load and checked with a test. There is no point in maintaining the recorder itself if the cameras or network devices turn off immediately.

7. Permissions and exporting CCTV footage

Access to the live view does not have to mean permission to play back, export and change the configuration. Roles should be separated according to employees' duties. Log sign-ins and exports if the system allows it.

The export procedure should specify who approves the operation, what format the file is created in, how the media is secured, and to whom the copy is given. You also need to periodically check whether the material can be played outside the recorder.

8. Signing off the CCTV system

Reception should not be limited to checking that all cameras are displaying images. Tests should include:

• day and night scenarios;
• expected detail in each zone;
• save, search and export recordings;
• response to loss of connection or power;
• permissions of individual roles;
• disk, camera and write job failure alerts;
• actual retention after the follow-up period.

As-built documentation should include, at a minimum, the layout plan, camera IDs, connection topology, basic settings, access policies, retention, and test results. Passwords should not be placed in an unsecured document.

9. Maintaining CCTV after deployment

The system requires periodic cleaning of covers, frame checks, disk health checks, updates and export tests. The staff may change after construction works, shelves are moved or vegetation grows.

Updates are planned with a configuration backup and the option to roll back. A “disk healthy” message on its own does not confirm that the system is recording all the required streams and can play footage back.

Frequently asked questions about CCTV in a business

How many cameras does your company need?

As much as results from the tasks and staff described in the project. The area of ​​the facility is not sufficient to determine the number of cameras.

Is a higher resolution camera always better?

Not always. Usefulness also depends on the lens, lighting, frame rate, compression, mounting location and the movement of the observed object.

Can I watch the image from my phone?

Many systems provide a mobile application. Before turning it on, you need to assess how the connection is established, account security, data flow and the possibility of revoking access to a lost device.

Where to start when planning video surveillance

Good video surveillance starts with the purpose and acceptance criteria, not with a camera catalogue. The design has to combine legal requirements, the right view, recording, network, power, permissions and ongoing maintenance. We design and deploy IP video surveillance systems together with the network as part of our service corporate networks.

Sources

• Act of 26 June 1974, the Labour Code, Article 22², consolidated text Journal of Laws (Dz.U.) 2025 item 277 as amended, https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20250000277 (accessed 02/10/2026)
• European Data Protection Board, Guidelines 3/2019 on processing of personal data through video devices, version 2.0, 29.01.2020, https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32019-processing-personal-data-through-video_en (accessed 02/10/2026)

As of 2 October 2026.