For whoever owns the cameras when the analytics are switched on

Paste your camera list. See the privacy laws at every camera.

CCTV Privacy Law Mapper reads your camera list line by line and maps the CCTV privacy laws that apply at each site. Paste your camera list, one line per camera: site, what it covers, the analytics switched on, audio, where the footage is kept and for how long. Every camera comes back with the privacy and surveillance laws that apply at its site, each clause cited: which need an assessment, signage, a shorter retention period, a written release or processor terms, and which analytics a workplace may not run at all.

Map your own listEight lines free, no account.

Paste a list, never a connection. One line per camera, or per group of identical cameras, from the spreadsheet your security team keeps. Nothing connects to your cameras or your recorder, and nothing leaves your browser until you save.
No floor plans, no footage, no camera positions. Site names can be your own codes; the country or state is what the laws key on.
Every line shows the clause behind it and the date we last read that law. Laws we do not hold in full are named, not quoted, and the page says so.
It never rules on a camera. Every finding is a question for your privacy lead or your lawyer, with the clause to open.

Specimen, 4 of 26 schedule linesan invented retail and distribution group

CHI-E01, E02 x2 entrance or exit, face matching or face recognition

Illinois: BIPA

1face matching5retention6no signage8processor terms14disclosures

CGN-B01, B02 x2 loading bay or yard, behaviour or emotion alerts

Germany: GDPR, EU AI Act

2may infer emotion

SYD-B01 staff break room or canteen, none or recording only

New South Wales: APP

11private area

DUB-C04 car park, demographic estimation

Ireland: GDPR, EU AI Act

3demographic estimation4no assessment6no signage7stored abroad

36 cameras across 7 sites, 5 running face matching or behaviour alerts, 11 with no assessment recorded.

14 of 14 findings raised, 36 of 36 cameras placed in a jurisdiction, 35 of 36 coverage types read.

A warehouse manager in a padded vest reading a tablet in a racked aisle, a handheld scanner in his other hand — Go into the analytics roll-out, the works council meeting or the regulator's letter with each camera already tied to the clause its site puts on it, and the date that law was last read. It works from the list your security team already keeps, in your browser, without access to a single camera, recorder or cloud account.

Paste the list as your team keeps it

One camera, or one group of identical cameras, per row: camera | site | country or state | covers at least, or a header row with any of count, analytics, audio, stored at, storage country, retention days, signage, assessment done, who can view, owner, lawful basis, processor terms, disclosures logged and notes. The column names recorder and VMS exports use are read too.

Read the schedule site by site

Each site is a sheet: its jurisdiction, the laws placed there and why, the laws named but not quoted, and the date we last read them. Under it every camera sits on one line with what it covers, what it runs, how long it keeps footage and the numbered findings it raises.

Take the questions to the right person

Fourteen findings in a fixed order, from face matching to disclosures to the police, each naming its cameras, the clause from GDPR, UK GDPR, the EU AI Act, BIPA, the CCPA, the APPs or ISO/IEC 27001, and the question to put to your privacy lead or your lawyer. The review sheet is where you record what you decided.

One camera per row: Camera | Site | Country or state | Covers, or a header row with any of Count, Analytics, Audio, Stored at, Storage country, Retention days, Signage, Assessment done, Who can view, Owner, Lawful basis, Processor terms, Disclosures logged. Tabs, pipes, commas or double spaces. First lines such as maximum retention: 31 days or ccpa thresholds met: yes set the options below.

Nothing is sent anywhere until you choose to save.

What you tell it (first lines of a paste set these too); nothing else is assumedYour maximum retention daysThe business meets the CCPA thresholds The Australian Privacy Act applies to us ISO/IEC 27001 in scope

Where every line on this page comes fromNothing here is written while you wait. We hold the text of GDPR (the EU General Data Protection Regulation), UK GDPR, EU AI Act, Illinois Biometric Information Privacy Act (BIPA), California Consumer Privacy Act (CCPA, as amended by the CPRA), Australian Privacy Principles (APPs) and ISO/IEC 27001 (information security management), read clause by clause and checked against the copy we hold; every obligation CCTV Privacy Law Mapper attaches is that text, cited to its clause. Where we do not hold a regime in full, the page names the obligation and says the text is not quoted. CCTV Privacy Law Mapper does arithmetic on your own rows and quotes the obligation; it never rules on you. What each one attaches here. How this is built. Open the standards themselves.

Why a list, and not a connection to the cameras

The question a regulator, a claimant's lawyer or a works council asks first is not about pixels. It is: which cameras do you run, where, over whom, with what analytics switched on, kept for how long, and which law says what about each. The answer sits in the camera list your security or facilities team already keeps. That is what this reads, in your browser, site by site, against the law of the place each camera stands in.

The dictionary is ours and published in full: the laws in each jurisdiction with the date we last read them, every coverage type, every analytics type, the fourteen findings, each regime and the clauses cited, what the texts say about retention, about signage, about workplace cameras and the CCTV register template. It reads the list only; a finding is a question for your privacy lead or your lawyer, never a ruling on a camera.