Home CCTV and Doorbell Cameras in Ireland: The Law in 2026

A home security camera or a video doorbell is one of the few pieces of consumer technology that can put an ordinary householder under the full weight of the GDPR. Point it at your own front door and data protection law does not apply to you at all. Point it slightly further, so that it takes in the footpath or your neighbour's driveway, and you become a data controller.

That boundary is the whole subject, and the Data Protection Commission sets it out in domestic CCTV guidance whose current version is dated May 2026. This page covers where the line sits, what a video doorbell does differently, and what a neighbour on the wrong end of a camera can achieve.

Information last verified on 20 July 2026. This page is general legal information for the Republic of Ireland, not legal advice.

Where the household exemption starts and stops

Article 2(2)(c) of the GDPR says the regulation does not apply to processing by a natural person in the course of a purely personal or household activity. That is the provision every home camera owner relies on, usually without knowing it.

The DPC applies it in one sentence: a domestic CCTV system should only operate to capture images within the perimeter of the operator's own property, including their garden and/or driveway, and systems which operate that way fall within the household exemption and are not subject to data protection law.

The exemption ends at your boundary, and the DPC's wording covers sound as well as picture. If your system captures images and/or sounds beyond your perimeter, for example of other people in their homes, gardens, on public footpaths or streets, the exemption will not apply and you will be bound to comply with all data protection obligations under the GDPR.

Two consequences surprise people. The first concerns neighbours: the DPC states that it is not acceptable to operate a system in a manner that captures images of your neighbours in their homes, gardens or driveways, and that focusing your cameras into those private spaces violates your neighbours' data protection rights.

The second concerns your own car. Asked whether a householder can monitor a vehicle parked in front of the house on a public road, the DPC's answer is no: you cannot rely on the household exemption to continually monitor public roads and footpaths to prevent theft of or damage to parked vehicles. That is the most common reason an Irish home camera falls outside the exemption. Dummy cameras, by contrast, raise no data protection issues at all.

None of this is an Irish invention: it comes from the CJEU's ruling in Ryneš (Case C-212/13) that a home camera which also monitors a public space is not a purely personal or household activity.

Is a video doorbell treated differently?

Yes, and the difference turns on a single word that most coverage drops.

The DPC's position is that a smart doorbell is likely to fall within the domestic exemption provided it only records the private area within the perimeter of your home. It then states the Ryneš rule in these terms: a domestic CCTV system which continuously records any public space beyond the perimeter of the homeowner's property will fall within the scope of data protection law and the GDPR.

The conclusion follows directly. If a smart doorbell is not recording, or is not continuously recording, then the domestic exemption is likely to apply, although homeowners should still take care that the doorbell does not intrude on areas belonging to anyone else.

That matters, because most video doorbells sold in Ireland are motion triggered rather than always on. A doorbell that wakes when someone walks up your path, records the caller and goes back to sleep is a materially different case from a camera streaming the street to a hard drive all day. The DPC adds a point on identifiability: a doorbell captures a clear image of the person at the door, but might be positioned so that images of people on a public street are obscured or too low quality to identify anyone.

So the honest answer is not that any doorbell able to see a footpath is unlawful. Continuous recording of public space is what breaks the exemption.

What about audio?

Video doorbells almost all have a microphone, and this is an area to be careful about what gets attributed to the regulator.

The DPC's domestic guidance says the exemption is lost where a system captures images and/or sounds beyond your perimeter, so audio crossing your boundary defeats the exemption exactly as images do. Its guidance on video recording confirms that data protection law may apply to those who record video and/or audio information about identifiable persons, and that simply recording or storing that data can be processing.

What the DPC does not appear to say anywhere is that audio is inherently more intrusive than video, that it is harder to justify, or that it should normally be disabled. Treat any Irish guide that puts those words in the DPC's mouth with caution.

Our own suggestion, as a recommendation rather than regulator guidance, is that switching the microphone off is the simplest way to stay inside the exemption. A doorbell microphone typically reaches further than the lens usefully resolves: it can pick up a footpath conversation between people the camera would never identify, and that is capture beyond your perimeter.

A neighbour's camera is a data protection problem, not a criminal offence

Readers often assume an over-reaching home camera must be a criminal surveillance offence. In Ireland it generally is not.

Section 98 of the Postal and Telecommunications Services Act 1983 creates an offence of intercepting telecommunications messages being transmitted by the company, which bites on messages in transmission across a network, not on a doorbell recording a caller at a front door. The Criminal Justice (Surveillance) Act 2009 binds State agencies: its powers run to senior members of An Garda Siochana, the Defence Forces, the Revenue Commissioners and the CCPC applying to a judge, its only offence concerns confidentiality about authorisations, and its definition of a surveillance device excludes cameras to a stated extent.

So a neighbour's misaimed camera is a data protection matter. The exception the DPC flags is children: if you feel a person is recording your child inappropriately, contact An Garda Siochana. For consent-to-record questions generally, see our page on Irish recording law.

What you become once the camera crosses the boundary

Losing the exemption is not a technicality. Under Article 4(7) a controller is the person who determines the purposes and means of processing, and a householder outside the exemption is that person, individually, with the full obligation set.

You need a lawful basis, and for a home camera that means legitimate interests under Article 6(1)(f), which applies only where your interests are not overridden by the rights and freedoms of the people recorded. The DPC's view of that balance is not encouraging: where your system captures people in shared or public spaces such as common areas, streets, roadways or footpaths, it is unlikely that your purposes will outweigh the rights of those people who may have their day-to-day activities recorded.

Data minimisation under Article 5(1)(c) means what you capture must be adequate, relevant and limited to what is necessary. Covert recording is a further trap: the DPC states that obtaining data without an individual's knowledge is generally unlawful.

The access request nobody expects

A person whose identifiable image your system recorded can make an access request and ask you for a copy of the footage. The DPC puts it plainly: this applies to any individual whose identifiable image has been recorded, and a controller receiving such a request must normally respond within one month. The footage should not be deleted until the request has been fulfilled, and other people appearing in it may need to be pixelated rather than the request refused. In short, the neighbour you have been recording can require you to hand over what you recorded of them.

How long can you keep the footage?

There is a persistent myth that Irish law prescribes a 30 day retention period. It does not. The DPC's guidance for data controllers says the law does not define specific retention periods, that a controller must be able to justify a defined period, and that data may not be kept on a just-in-case basis.

It then reasons from section 8 of the Civil Liability and Courts Act 2004, under which a letter of claim in a personal injuries action is served a month after the accident, that a 30 day period may be reasonable and proportionate for footage kept to defend such a claim, and that for a normal security system it would be difficult to justify retention beyond one month. The exception is footage identifying a specific issue such as a break-in.

Signage, once you are outside the exemption

Signage is a transparency requirement for systems inside the scope of data protection law, and is not needed for a camera safely within the household exemption. The DPC says notification can usually be achieved by placing easily read and well lit signs in prominent positions, and that a sign at all entrances will normally suffice, indicating the purpose of the system and the identity and contact details of the controller.

Cameras in apartment blocks and OMC common areas

In a multi-unit development the common areas are owned and controlled by the Owners' Management Company. The DPC accepts that an OMC may wish to install CCTV to conduct security surveillance of common areas such as car parks and bicycle storage sheds, and highlights the obligation to control access to footage and to avoid disclosing personal data in a way that disproportionately affects residents' rights and expectations of privacy. Where a property management agent processes data about members or residents, the DPC's view is that it usually does so as a processor acting for the OMC, which is the controller, under an Article 28 agreement.

The guidance does not say whether an individual apartment owner may install their own camera covering a common area. Our inference, and it is an inference rather than DPC guidance, is that a common area sits outside the owner's private perimeter, so the household exemption is unlikely to apply. Raising it with the OMC first is the sensible route.

What can I actually do about my neighbour's camera?

There are three steps, and it is worth being honest about what each delivers.

Step one is to talk. The DPC suggests this itself: start by contacting the CCTV owner to explain your concerns, and ask to see what they are recording, because the footage captured may not be as intrusive as you think. Many disputes end here, because the fix is often a privacy zone or a few degrees of angle.

Step two is a complaint to the DPC, with realistic expectations. The DPC will write to the owner explaining the rules around domestic CCTV. But its own guidance states that the DPC cannot order a private individual to remove or dismantle their domestic CCTV cameras, and if the household exemption does apply, the operators are not data controllers and the DPC has no role to play at all. During 2024 it received 157 complaints from individuals about recording devices such as domestic CCTV systems and smart doorbells.

Procedurally, section 108 of the Data Protection Act 2018 requires the DPC to acknowledge a complaint in writing and to inform the complainant within three months on progress or outcome. Section 109, not section 108, is the amicable resolution provision: where the DPC sees a reasonable likelihood of the parties reaching an amicable resolution within a reasonable time it may take such steps as it considers appropriate to facilitate one, and a complaint resolved that way is deemed withdrawn. If that fails, section 109(5) allows advice, an enforcement notice, a reprimand or an inquiry. Our guide to complaining to the DPC walks through the mechanics.

Step three is court, and it is the step that can actually move a camera. Section 117 of the Data Protection Act 2018 lets a data subject bring a data protection action against a controller, and section 117(2) deems it to be founded on tort. Section 117(4) provides for relief by way of injunction or declaration, or compensation for damage, and section 117(10) confirms that damage includes non-material damage and that injunction includes interim, interlocutory and indefinite injunctions.

The jurisdiction point changed recently and is often reported wrongly. As substituted with effect from 11 January 2024, section 117(3) gives the District Court, and the Circuit Court, jurisdiction concurrently with the High Court. It is all three courts, which brings a modest neighbour dispute within reach of a far cheaper venue.

On value, the benchmark is Kaminski v Ballymaguire Foods Ltd [2023] IECC 5, the first written Irish judgment awarding non-material damages under Article 82 of the GDPR. The Circuit Court assessed the appropriate award at €2,000, where CCTV footage of the plaintiff was shown at an internal training meeting. Irish awards sit in the low thousands, so the injunction rather than the money is usually the reason to go.

Fixing your own camera in ten minutes

The DPC sets out the fix directly, advising householders to operate their devices so that they only capture images within the perimeter of their own property. Two steps are named: use your device's privacy zone feature to block public areas from the view of your CCTV or doorbell camera with black boxes or bars, and adjust the angle of the camera so that public areas are not captured.

A third point applies whatever your camera sees. The DPC advises individuals not to publish CCTV footage online, as they are unlikely to have a lawful basis to do so, and confirms that if you post such images online you will be considered a data controller. Posting a clip of a suspected parcel thief to a local social media group is the most common way an otherwise exempt home camera becomes a data protection problem.

The DPC's own 2024 summary is the sentence to keep: if you are operating a domestic CCTV system you should ensure that it is not capturing public footpaths or roadways, and under no circumstances should cameras be able to view the homes or gardens of neighbours. For wider context, see our overview of Ireland's data privacy laws and the Ireland legal guides hub.

This page is general information about home CCTV and doorbell cameras in the Republic of Ireland and is not legal advice. Complaints about recording devices are handled by the Data Protection Commission, which cannot order a camera to be removed, and compensation or injunctive relief is a matter for the District, Circuit or High Court. Speak to a solicitor before issuing a data protection action, or if you have received a complaint about your own system.