CCTV at a Physiotherapy Practice - Is It Legal and How to Implement It

Marta opened a physiotherapy practice on the ground floor of an apartment building, and after two break-ins at neighbouring shops she decided to install cameras. The electrician set up two -- one above the entrance, one in the waiting room, "for extra safety." A few months later, during a data-protection authority inspection, she was asked a question she hadn't expected: where is the CCTV clause in the practice's organisational regulations, and where is the information sign? Nobody told her to take the cameras down -- it turned out that despite good camera placement, the entire monitoring system had been running unlawfully, because the documents that make it legal simply didn't exist.

This is a common scenario. Physiotherapists tend to think of CCTV in purely technical terms -- where to mount the camera, what resolution to choose -- and overlook the legal side that determines whether recording is even allowed in the first place. This article is a guide to the whole topic: where a camera may be placed, where it must never be, what the legal basis for monitoring at a healthcare entity actually is, and which documents must exist before the first camera starts recording. This is a hub article -- it links to detailed pieces on monitoring employees and on sharing recordings, so if you're looking for a specific thread, you'll find it further down.

Where a camera may be, and where it must never be

The first question to ask before installing a camera isn't "is this legal at all," but "which zone of the practice." The law doesn't treat the whole premises the same way -- it splits it into zones where monitoring is permitted and zones under an absolute ban.

Zones where a camera may operate

CCTV at a healthcare entity may cover rooms where no health services are actually provided, as long as the purpose is to ensure the safety of patients and staff or to protect property. In a physiotherapy practice, this typically means:

• the entrance to the premises -- access control, deterring break-ins,
• the waiting room -- safety of people waiting, including children and elderly patients,
• the reception desk -- protecting property, documenting incidents at the till or check-in.

Zones under an absolute ban

The picture is completely different in places where a patient undresses, undergoes treatment, or uses the toilet. Monitoring is excluded there with no exceptions -- it doesn't matter what the practice owner's intention was, and it doesn't matter that "the camera only covers part of the room." The ban covers:

• the treatment room -- where therapy is provided, often requiring the patient to undress,
• the changing room,
• the toilet.

This ban doesn't come from caution or best practice -- it is an explicit statutory exclusion protecting the patient's dignity and privacy. No patient consent, no internal regulation, and no good intentions can override it. A practice that installs a camera in the treatment room "for the therapist's safety" is breaking the law regardless of the motive.

Legal basis -- two provisions working together

CCTV at a physiotherapy practice doesn't rest on a single provision -- it rests on two that overlap depending on who the recording covers.

Article 23a of the Act on Medical Activity is the basis for monitoring run by a healthcare entity -- it regulates which rooms may be covered by cameras, which purposes justify installing them, and what limits apply (including the exclusion of treatment rooms, changing rooms, and toilets). This provision is aimed primarily at the practice-patient relationship.

Article 222 of the Labour Code comes into play when monitoring also covers employees -- a receptionist, an assistant, other therapists employed at the practice. An employer may introduce CCTV to ensure employee safety, protect property, or keep certain information confidential, but must follow a separate procedure -- including informing staff in advance. We cover the employer's obligations toward staff in detail in the article monitoring employees -- employer obligations.

If you employ even one person at the practice and a camera covers their workstation (e.g. reception), both provisions apply at the same time -- you must meet the requirements for a healthcare entity and the requirements for an employer. Missing either one leaves a gap that both the data-protection authority and the labour inspectorate will catch.

The CCTV clause in the organisational regulations -- without it, the camera is unlawful

This is the element most practice owners overlook, and it decides the legality of the whole setup. The fact that cameras hang in permitted locations isn't enough on its own -- monitoring must be formally introduced through a clause in the practice's organisational regulations. Every healthcare entity has to maintain these regulations anyway -- we cover the broader RPWDL registration rules in the article GDPR at a physiotherapy practice.

The CCTV clause in the regulations should set out at minimum: the purpose of monitoring, its scope (which rooms it covers), the retention period for recordings, and how patients and staff are informed about it. A practice that has cameras but no such clause is running monitoring without a formal basis -- even if the cameras are placed correctly and the recordings harm no one. That's exactly the mistake Marta made in the example at the start of this article.

How long recordings are kept

The retention period for CCTV footage isn't arbitrary. The standard rule is a maximum of 3 months from the date of recording -- after that, the footage should be automatically deleted or overwritten by the system. Keeping recordings longer "just in case" breaches the data-minimisation principle and exposes the practice to a claim of processing data beyond what's necessary.

The exception applies when a specific recording is or may become evidence in a case -- e.g. it documents a theft, a break-in, or an incident involving a patient. In that case, the relevant fragment is extracted from the system and kept separately for as long as the proceedings require. We cover the rules for extracting and sharing such recordings -- who is allowed to receive them and on what basis -- in the article sharing CCTV recordings -- who is allowed.

The information sign -- mandatory signage for a monitored zone

Monitoring must be visible to anyone entering a monitored zone -- it can't operate silently. This obligation is met through an information sign placed before the entrance to the monitored zone, not just somewhere inside it.

The sign should include:

• a camera icon -- a clear, recognisable symbol indicating CCTV,
• who the data controller is -- the name of the practice / healthcare entity,
• where to get full information -- e.g. a phone number, address, or a reference to the full information clause available at reception.

The absence of such a sign, even with technically correct camera placement, is a standalone failing -- it means people entering the practice are being recorded without knowing it.

Element	What it covers	Consequence if missing
CCTV clause in the organisational regulations	Purpose, scope, retention period of monitoring	Monitoring with no formal basis -- unlawful even with correctly placed cameras
Monitoring regulations / procedure	Detailed rules for how the system runs, access to recordings	No consistent rules, risk of arbitrary access to recordings
Information sign	Camera icon, controller, where to get information	Recording people without their knowledge
Informing staff (if applicable)	Written notice in advance before the system goes live	Breach of Article 222 of the Labour Code toward employees
Camera placement	Entrance, waiting room, reception -- never the treatment room, changing room, or toilet	Breach of patient dignity and privacy -- absolute ban

The set of documents without which a camera is unlawful

Let's pull it together into one checklist. Before you switch on monitoring at the practice, you need:

1. A clause in the organisational regulations -- the formal basis for the monitoring system.
2. Monitoring regulations / a procedure -- a document describing how the system works day to day: who has access to recordings, how long they're kept, when they get extracted.
3. Information signs before every zone covered by monitoring.
4. Advance notice to staff -- if the cameras cover employee workstations (e.g. reception).

Only the complete set of these four elements makes monitoring lawful -- missing even one is a gap an inspection will catch just as easily as missing cameras at the spot where an incident actually happened.

[SP] Example -- Solo practice: After the data-protection authority's inspection, Marta doesn't take the cameras down -- they were placed correctly, above the entrance and in the waiting room. Instead, she adds a CCTV clause to the organisational regulations, drafts a short procedure (purpose, scope, 3-month retention), and orders two information signs with a camera icon. Since she runs the practice alone, she doesn't have to meet the additional Labour Code requirements -- the whole process takes one afternoon.

[GR] Example -- Group practice: A practice employing four physiotherapists and a receptionist plans to install a camera covering reception. Because the receptionist's workstation will be in frame, the owner must -- on top of the regulations clause and the information sign -- give the whole staff written notice in advance, before the camera starts recording, in line with the requirements for employee monitoring.

Frequently asked questions

Can I install a camera in the treatment room if the patient consents?

No. The ban on monitoring in the treatment room, changing room, and toilet is absolute and stems from protecting the patient's dignity and privacy -- no consent, not even written and voluntary, can override it. This sets the situation apart from most GDPR consents, which in other contexts can make processing lawful.

Does CCTV in the waiting room require patients' consent?

Not as a legal basis -- the basis here is a legitimate interest tied to safety and property protection, not consent. Patients still need to be informed about the monitoring through a sign at the entrance to the monitored zone and must have access to the full information clause.

What happens if a recording is needed as evidence but the 3 months have already passed?

If the recording wasn't extracted from the system before automatic deletion, it can't be recovered once the standard retention period has passed. That's why the monitoring procedure should require that any event that might need evidence -- an incident, a complaint, a suspected theft -- is flagged immediately, before the recording gets overwritten.

Does a solo practice with no employees also need CCTV regulations?

Yes. The obligation to include a clause in the organisational regulations and put up an information sign comes from Article 23a of the Act on Medical Activity and applies to every healthcare entity running CCTV, regardless of whether it employs staff. The Labour Code requirements only apply on top of that when employee workstations appear in the camera's frame.

CTA: Monitoring is just one piece of the compliance puzzle at a physiotherapy practice -- alongside medical records, GDPR, and sanitary requirements. The PREMIUM package from FizjoReady includes the full set of documentation needed to run a practice in line with the regulations, from organisational regulations to complete GDPR documentation. See FizjoReady packages →

Related articles:
- Monitoring employees -- employer obligations
- Sharing CCTV recordings -- who is allowed
- GDPR at a physiotherapy practice -- a practical guide
- Health and safety at a physiotherapy practice -- risk assessment