Video and Audio Monitoring:
Rules, Restrictions and Recommendations
14 April, 2025
Anna Bakradze, Lawyer, Attorney, Personal data protection officer
What should you do if you want to implement video monitoring in your office/commercial establishment?
First and foremost, before implementing video monitoring, determine the purpose and legal basis for doing so. The Law of Georgia "on Personal Data Protection" establishes the grounds under which video monitoring may be conducted, including: crime prevention and detection, protection of secret information, safeguarding minors, examination/testing, as well as security and property protection, and etc.
A necessary condition for conducting video monitoring is that it must be adequate and proportionate to the purpose of data processing.
If you implement video monitoring in your office or commercial establishment, you must define in writing: purpose and amount of video monitoring, the duration of the video monitoring and the period of storage of the video recording, the procedure and conditions for accessing, storing and destroying the video recording, and the mechanism for the protection of the rights of the data subject.
It is mandatory to ensure the security of the video monitoring system and video recordings, as well as that any access to the video recordings is recorded, including the time of access and the user’s name.
Additionally, it is essential to place warning signs (so-called "stickers") indicating ongoing video monitoring. These signs must include: an appropriate inscription, a clearly visible image of video monitoring in progress, and the name and contact details of the controller.
A necessary condition for conducting video monitoring is that it must be adequate and proportionate to the purpose of data processing.
If you implement video monitoring in your office or commercial establishment, you must define in writing: purpose and amount of video monitoring, the duration of the video monitoring and the period of storage of the video recording, the procedure and conditions for accessing, storing and destroying the video recording, and the mechanism for the protection of the rights of the data subject.
It is mandatory to ensure the security of the video monitoring system and video recordings, as well as that any access to the video recordings is recorded, including the time of access and the user’s name.
Additionally, it is essential to place warning signs (so-called "stickers") indicating ongoing video monitoring. These signs must include: an appropriate inscription, a clearly visible image of video monitoring in progress, and the name and contact details of the controller.
- Where Is Video Monitoring Prohibited?
Video monitoring is prohibited: in changing rooms, hygiene facilities or other places where a person has a reasonable expectation of privacy and/or where video monitoring is contrary to generally accepted moral standards.
Video monitoring of an employee’s workspace is allowed only in exceptional cases, when achieving the intended purpose is impossible by other means or would require disproportionately great effort.
If such conditions apply and workplace video monitoring is conducted, employees must be notified in writing.
Video monitoring of an employee’s workspace is allowed only in exceptional cases, when achieving the intended purpose is impossible by other means or would require disproportionately great effort.
If such conditions apply and workplace video monitoring is conducted, employees must be notified in writing.
- What Should You Do If You Want to Take Photos or Videos of Employees or Customers and Publish Them on social media or a website?
To obtain permission to take photos or videos of employees or customers, this must either be explicitly defined by Georgian legislation or be based on their consent (a written form is recommended).
Before obtaining consent, it is essential to provide to the data subject with the following information:
The data subject has the right to withdraw their consent at any time. Therefore, if an employee or customer requests to stop the processing of their photo or video or to remove/delete it from social media/website, you, as the controller, must delete the material and stop processing (unless there is another legal basis for processing beyond their consent).
Before obtaining consent, it is essential to provide to the data subject with the following information:
- The purpose of the photo or video recording;
- Where the recorded material will be published;
- Who will receive the recorded material (if applicable);
- How long the photo or video will be stored;
- What rights the data subject has.
The data subject has the right to withdraw their consent at any time. Therefore, if an employee or customer requests to stop the processing of their photo or video or to remove/delete it from social media/website, you, as the controller, must delete the material and stop processing (unless there is another legal basis for processing beyond their consent).
- Under What Conditions Is Audio Monitoring Allowed?
Audio monitoring is permitted if:
If you conduct audio monitoring, you must define in writing: the purpose and amount of audio monitoring, the duration of the audio monitoring, the procedure and conditions for accessing, storing and destroying the audio recording, and the mechanism for the protection of the rights of the data subject.
The data subject must be informed in advance or at the start of the audio monitoring and must be made aware of their right to refuse (if applicable).
As with video monitoring, in relevant cases, a warning sign must be placed. The sign should include: an appropriate inscription, a clearly visible image of video monitoring in progress, and the name and contact details of the controller.
- The data subject has given its consent;
- It is necessary to make a record;
- It is required protect important legitimate interests pursued by the controller, provided that appropriate and specific measures are in place to safeguard the rights and interests of the data subject;
- in other cases, expressly provided for by the legislation of Georgia.
If you conduct audio monitoring, you must define in writing: the purpose and amount of audio monitoring, the duration of the audio monitoring, the procedure and conditions for accessing, storing and destroying the audio recording, and the mechanism for the protection of the rights of the data subject.
The data subject must be informed in advance or at the start of the audio monitoring and must be made aware of their right to refuse (if applicable).
As with video monitoring, in relevant cases, a warning sign must be placed. The sign should include: an appropriate inscription, a clearly visible image of video monitoring in progress, and the name and contact details of the controller.
what is the direct marketing?
The direct marketing is the direct and immediate delivery of information to a data subject by telephone, mail, email or other electronic means to generate and maintain interest in, sell and/or support a natural and/or legal person, product, idea, service, work and/or initiative, as well as image and social issues.
- In What Cases Is the Data Subject’s Consent Not Required for Sending Marketing Messages?
Regardless of the basis for data collection or its availability, sending marketing messages (i.e., processing personal data for direct marketing purposes) is only allowed with the data subject’s consent.
According to the Law of Georgia "on Personal Data Protection", if personal data beyond name, surname, address, phone number, and email address are processed for direct marketing purposes, written consent from the data subject is required.
It is important to note that the responsibility for proving the existence of consent lies with the data controller. Therefore, it is recommended to obtain consent in written form or through another verifiable electronic method.
According to the Law of Georgia "on Personal Data Protection", if personal data beyond name, surname, address, phone number, and email address are processed for direct marketing purposes, written consent from the data subject is required.
It is important to note that the responsibility for proving the existence of consent lies with the data controller. Therefore, it is recommended to obtain consent in written form or through another verifiable electronic method.
Was it helpful? Share your opinion
Do you have a task or a question?
MARIA GUSEINOVA
Leading Manager of Commercial Department
Leading Manager of Commercial Department