A leak of video footage from a store, which ended up on a social network, turned into a GDPR sanction. The case published on the ANSPDCP website on 15 June 2026 shows how easily a single employee can trigger a security breach with reputational and financial impact for the entire organisation.
Unauthorised access to a video surveillance room: ANSPDCP fined a processor in the Kaufland supply chain
The National Supervisory Authority for Personal Data Processing (ANSPDCP) completed an investigation in April 2026 into SSG SELECT SOLUTIONS S.R.L., a processor acting on behalf of the controller Kaufland România SCS.
The investigation started from a personal data breach notification submitted by Kaufland România SCS under Article 33 of Regulation (EU) 2016/679. It was found that an employee of SSG SELECT SOLUTIONS S.R.L. allowed a third party to access the video surveillance room inside the store. The third party accessed, recorded and disseminated online, on a social media platform, video footage originating from the store — a breach of the confidentiality of the personal data of individuals.
ANSPDCP found a breach of Article 29 and of Article 32(1)(b), (2) and (4) of Regulation (EU) 2016/679: the processor failed to ensure that persons acting under its authority process data only on the controller's instructions, and failed to implement technical and organisational measures appropriate to the level of confidentiality and security commensurate with the risk.
Sanction applied: a fine of RON 10,200 (the equivalent of EUR 2,000), already paid. In addition, under Article 58(2)(d) of the Regulation, a corrective measure was imposed to implement supplementary measures for controlling and monitoring compliance with internal working procedures and with the instructions established by the controller, in accordance with Article 28 GDPR.
Why this concerns you too
If your company works with processors (security, cleaning, IT or call-centre providers), or is itself a processor for a larger client, this case concerns you directly. GDPR accountability does not stop with the controller: the processor is separately liable for the security of the data it handles. A simple act of negligence by one employee — uncontrolled access granted to a third party — can trigger a fine, mandatory corrective measures, and reputational exposure that is hard to repair. Video surveillance means personal data, and the lack of access control and staff training is exactly what the authority sanctions.
How INFOSHARE Consulting helps you
We help you prevent such incidents through a coherent compliance and security system:
- Outsourced DPO — ongoing oversight of GDPR compliance and the relationship with ANSPDCP.
- GDPR and Law 190/2018 compliance, including DPIA, LIA and ROPA for video surveillance systems.
- ISO/IEC 27001 implementation — physical and logical access controls, monitoring and incident management.
- NIS2 and DORA readiness, where applicable.
- Training & awareness for employees and processors — exactly the human link that failed in this case.
- Review of processing agreements (Article 28 GDPR) and of access-control procedures.
Don't wait for a breach notification to find out where you are exposed. Book an assessment with the INFOSHARE Consulting team and turn compliance into an advantage.
Frequently asked questions
Who is allowed to access CCTV footage?
Only persons expressly authorised by the controller, within the declared purpose and on a genuine need-to-know basis. Processor staff (security, IT) handle the footage solely on the controller's instructions, in line with Article 29 GDPR. Allowing an unauthorised third party into the monitoring room, exactly as in the case sanctioned by ANSPDCP, is a personal data breach.
What access controls should a video surveillance system have?
Article 32 GDPR requires technical and organisational measures appropriate to the risk: restricted physical access to the monitoring room, individual authentication, logging of access events and of footage downloads, staff training and clear working procedures. The lack of access control and training is precisely what the authority sanctioned.
Is CCTV footage personal data?
Yes. Footage that allows a natural person to be identified is personal data, and its processing falls under the GDPR and Law 190/2018. Disseminating such footage online without a legal basis breaches the confidentiality of the data and can trigger both fines and corrective measures.
How can a company avoid a fine for unauthorised access to CCTV?
Through effective control of physical and logical access to the video system, logging of access events, regular training of employees and processors, processing agreements compliant with Article 28 GDPR, and compliance records (DPIA, LIA, ROPA) for video surveillance. The human link is the most exposed, which is why training and clear procedures are decisive.
Check your exposure before a breach appears
We assess your video surveillance systems and processing agreements and tell you clearly what to fix first.