As part of the ongoing adoption of sub-legal acts implementing Law No. 124/2024 “On the Protection of Personal Data”, fully aligned with the EU General Data Protection Regulation (GDPR), the Albanian Data Protection Commissioner has approved Instruction No. 3, dated 30 April 2025, “On the Processing of Personal Data through Video Surveillance Systems” (“Instruction”). This Instruction establishes a detailed and binding framework governing the lawful use of CCTV systems by both public and private entities operating in Albania.
The Instruction confirms that any image or sound captured by a CCTV system qualifies as personal data when an individual can be directly or indirectly identified. As a result, all surveillance activities must adhere to the core principles of data protection, lawfulness, necessity, proportionality, and transparency. To be lawful, video surveillance must be based on a valid legal ground. Since obtaining consent is rarely practical in this context, controllers will typically rely on legitimate interest or a legal obligation, provided that no less intrusive means are available to achieve the intended purpose.
Building on these foundational principles, the Instruction introduces strict limitations on the use of CCTV in sensitive environments. It explicitly prohibits surveillance in private spaces such as bathrooms, changing rooms, or other locations where individuals have a heightened expectation of privacy. Furthermore, it bans the live streaming of identifiable images via the internet or electronic communications platforms, unless there is a lawful and proportionate justification for doing so
To promote transparency and accountability, the Instruction requires controllers to prepare internal documentation prior to deploying any surveillance system. This must include detailed information on the purpose of surveillance, the placement and technical specifications of cameras, the legal basis for processing, and the applicable data retention period. In general, footage must not be retained for more than 72 hours, unless specific, documented justifications allow for an extension of up to 30 days, or longer where required by a separate legal provision.
Additional requirements apply to residential buildings, where the installation of CCTV in common areas is permitted only with the consent of at least 75% of co-owners and solely for the protection of persons and property. The Instruction prohibits the sharing of footage with third parties, unless such disclosure is formally requested by competent authorities. It also mandates the use of standardised signage to inform individuals that they are entering a monitored area and reaffirms that all data subject rights must be respected, including the rights to access, object, and request erasure. Importantly, once an access request is submitted, footage must not be deleted until the request is resolved, and any third-party identities must be anonymised before disclosure.
Moreover, the Instruction lays out clear obligations regarding data security, access control, and confidentiality. Only personnel specifically authorised to handle recorded material may access CCTV footage, and such access must be logged and monitored. All authorised staff must receive appropriate training. Confidentiality obligations continue to apply even after the termination of the employment or contractual relationship.
Lastly, beyond setting minimum compliance standards, such Instruction reflects a broader shift toward structured, rights-based governance of surveillance practices. Organisations that rely on CCTV systems, whether for security, operational efficiency, or regulatory compliance, should now take proactive steps to assess their practices, update documentation, and align their internal processes with the new legal requirements.
The information in this document does not constitute legal advice on any particular matter and is provided for general informational purposes only.
