Video Surveillance and Personal Data Protection: How to Preserve Privacy

06.02.2026 | Civil rights

The Bulgarian Chamber of Security and Protection (BCOS) clarifies the legal requirements for video surveillance for security purposes. The focus is on the balance between security and personal data protection, especially in the context of leaked video recordings from beauty salons and medical offices. BCOS emphasizes the importance of GDPR and recommends caution when using video surveillance.

Снимка от Wikideas1, Wikimedia Commons (CC0)

Video surveillance should not be the primary method when other alternatives exist to achieve the set goal, because otherwise there is a risk of changing cultural norms. This is stated by the Bulgarian Chamber for Security and Protection (BCOS), a member of the Bulgarian Chamber of Commerce and Industry.

BCOS emphasizes the distinction between the security industry and video surveillance from the "scandalous incidents" in connection with video recordings from beauty salons and gynecological offices that have leaked to adult websites. The Chamber explains the legal requirements for the application of video surveillance for security purposes.

Pre-trial proceedings have been initiated in Burgas and Kazanlak in connection with leaked video recordings from cosmetic studios. The outgoing Minister of Health, Silvi Kirilov, ordered an investigation into a similar case in Sofia.

Video surveillance is not a licensed activity and the Private Security Act allows its widespread use for security purposes, but in compliance with the requirements for the protection of personal data. Video images fall into the category of biometric data, which is considered sensitive personal information, requiring consent for processing.

The European Committee on Data Protection says that video surveillance is permissible, but guarantees must be provided to avoid unauthorized use. The administrator must take into account the balance between security and personal rights. The installation of cameras in sanitary facilities or places where medical services are provided is inadmissible.

Data administrators must apply reliable security measures, including protection against unauthorized access and compliance with the storage periods of video recordings. The Private Security Act provides for a period of two months for storage.

Professionals in the security industry are familiar with the regulatory requirements. BCOS recommends that visitors be careful and report violations of their personal privacy.