A camera above the front desk, one at the main entrance — job done. That's the approach in a surprising number of hotels. The problem: this gut-feel setup protects neither guests nor the property itself. Where a camera is placed determines not just security, but liability, data protection compliance, and — when something actually goes wrong — whether the footage is legally usable at all.

Professional CCTV planning follows a logic. Not a hunch. This guide breaks down which areas must be covered, which ones are worth adding, and where a hotel operator is treading on very thin legal ice.

Mandatory zones: no room for compromise

Certain hotel areas are non-negotiable from a security and insurance standpoint. Leaving them unmonitored isn't cost-saving — it's a calculated risk that rarely pays off.

• The lobby and main entrance: These are the primary control points — for guests, but also for anyone who shouldn't be there. A wide-angle dome camera covers the general area; a PTZ (pan-tilt-zoom) unit adds the ability to zoom in on faces or license plates when it matters. Both together make a meaningful difference.
• Car parks and outdoor areas: Statistically, these are among the highest-risk zones in any hospitality property. Vehicle damage, theft, and altercations happen here more often than inside the building. Poor lighting compounds every problem. Infrared-capable cameras or models with Wide Dynamic Range (WDR) aren't an upgrade — they're the baseline.
• Emergency exits and secondary entrances: These tend to be overlooked. But they're precisely the entry points that go unnoticed and unguarded. A well-monitored front door means little if the service entrance is a blind spot.

Recommended zones: gaps worth closing

There is no legal obligation here — but any security manager who ignores these areas will spend a lot of time explaining themselves when something does happen.

• Hotel corridors: They sit in a legal grey zone. Guests have a genuine privacy interest; at the same time, corridors are where break-ins, property damage, and incidents occur. The solution is precise camera positioning: cover the corridor itself, not the area directly in front of room doors. That's technically achievable and legally defensible — provided the mandatory signage is in place.
• Delivery zones and service entrances: These are classic blind spots. Inventory shrinkage, unauthorized access, liability disputes over damaged deliveries — a single camera in these areas resolves all three, and it's not a zone that inconveniences any guest.
• Server rooms and technical infrastructure: These spaces often house critical systems. No camera coverage here means accepting physical access risk to data — with direct GDPR implications if something goes wrong.

Off-limits areas: hands off

As clear as the mandatory zones are, the prohibited ones are equally unambiguous. Installing cameras in certain areas is simply unlawful — regardless of intent.

• Guest rooms — no exceptions, no grey areas.
• Changing rooms, saunas, wellness areas — the right to privacy here is especially protected.
• Bathrooms and restrooms — self-explanatory.
• Employee spaces — areas where employees would be monitored without a legal basis or works agreement in place.

Warning: Violations here don't just attract significant GDPR fines. In serious cases, they carry criminal liability. And the reputational damage — once it surfaces on review platforms — tends to outlast any legal proceeding.

Camera types: the right tool for the right spot

Not every camera suits every location. That sounds obvious, but in practice, it gets ignored constantly.

• Dome cameras: Discreet, wide-angle, and well-suited for indoor spaces like lobbies, corridors, and reception areas. Use vandal-resistant housings for public-facing installations.
• PTZ cameras (Pan-Tilt-Zoom): Motorized and zoomable. They are ideal for large outdoor areas and car parks where coverage flexibility matters more than fixed framing.
• Fisheye cameras: Provide 360-degree coverage and are often underestimated. One device can cover an entire room, reducing both hardware costs and installation complexity. Detail quality drops at a distance, so they work best in confined spaces.
• IR and WDR cameras: Essential for poorly lit exteriors, underground car parks, and overnight operation. Without this technology, footage in low-light conditions is essentially useless.

Planning logic: angles, overlap, light

A solid CCTV concept isn't something you buy off the shelf — it's something you design. Three parameters determine whether it works or doesn't.

• Field of view: Every camera has a defined capture range. Too wide, and detail resolution suffers. Too narrow, and dead zones appear. For facial recognition to hold up in legal proceedings, you need a high enough pixel density per metre of image width. That has direct implications for where each camera goes.
• Overlap: Critical transition zones — stairwells, doorways, choke points — should always be covered by at least two cameras. Not for redundancy's sake, but because anyone with bad intentions knows how to stay in a single camera's blind spot.
• Lighting conditions: Backlighting at entrances is a classic failure point. A camera facing east in the morning produces silhouettes, not identifiable faces. WDR technology compensates — but only if it's factored into the planning from the start.

FAQ: hotel CCTV planning

Which hotel areas must legally have CCTV coverage?

There is no statutory requirement in Germany mandating CCTV in specific hotel areas. However, there is a duty of care toward guests and staff — and from an insurance and liability perspective, the main entrance, lobby, car parks, and emergency exits should always be covered. Many insurers now make functioning surveillance a condition of certain types of coverage.

Can a hotel install cameras in guest corridors?

Yes, under specific conditions. Corridor cameras are permissible if they are not directed at room doors, if guests are clearly informed via visible signage, and if recordings are stored only for a defined period — typically 72 hours. If any of these conditions aren't met, the operator faces legal exposure.

How long can hotels retain CCTV footage?

GDPR doesn't prescribe a fixed retention period, but it does require data minimisation. In practice, 48 to 72 hours has become the accepted standard — unless a specific incident justifies longer retention. Once an incident is reported, footage relevant to that case can be preserved for the duration of the investigation or proceedings.

What does professional CCTV planning cost for a hotel?

Costs vary significantly based on property size, the number of cameras required, and the chosen system. An 80-room hotel with a properly scoped concept typically lands between €15,000 and €30,000 — including installation and video management system configuration. Cheaper solutions exist, but they rarely hold up when it counts. A camera that doesn't produce usable footage in an incident isn't a security system. It's a liability.

Conclusion

Hotel CCTV isn't a product you install and forget — it's a security concept that brings together technology, legal compliance, and operational logic. Done right, it protects guests, staff, and the property itself. Done halfway, it leaves you without evidence or insurance coverage when you need both most.

If you'd like to assess what makes sense for your property, DaPhi works with hotel operators throughout the entire planning and implementation process — from the initial site review to ongoing system management.