Monaco CCTV Rules: What's Coming

If your Monaco business has cameras pointed at a shop floor, a hotel lobby, a restaurant terrace or a stock room, the text that will govern them is about to be adopted. On 16 September 2026, the APDP, Monaco's data protection authority, published its opinion (Deliberation 2026-17) on the draft Ministerial Order implementing articles 83 to 85 of Law No. 1.565 of 3 December 2024 — the section of Monaco's data protection law dedicated to video surveillance. The Order is not yet in force, but the government has told the APDP it wants it quickly, because "very many users" currently have to base their requests on it.

One caveat: this summarises a draft and an advisory opinion, not final law. Details may change, so verify the final text with the APDP or your legal counsel.

Why a Ministerial Order, and why now

Law 1.565 replaced Monaco's 1993 data protection law and the CCIN with the APDP. It also brought video surveillance into the data protection framework: Chapter VII, Section IV covers "processing relating to video surveillance", and article 86 leaves the practical rules to a Ministerial Order. Until that Order exists, anyone installing or renewing cameras is working in a grey zone. The Minister of State referred the draft to the APDP on 20 July 2026 and asked for an opinion "as soon as possible" to close that gap.

Two regimes: authorisation and declaration

Cameras filming places open to the public — a boutique, a hotel lobby, a dining room, a customer car park — require an authorisation from the Minister of State. The request is filed with the Director of Public Security (DSP) and must describe the places covered and the reasons for the system. Article 3 sets a stricter file for cameras that also capture "the surroundings of public roads, spaces open to the public or to public traffic". As drafted, the authorisation is unlimited in time.

Cameras in places not open to the public — back offices, stock rooms, staff-only corridors — are subject to a declaration to the APDP, which under article 10 would issue a receipt within ten days. The APDP notes it has offered a declaration form for almost two years and would rather handle this through its own internal rules.

Crucially, article 7 of the draft states that a ministerial authorisation "does not exempt the controller from complying with Law 1.565", whose enforcement belongs to the APDP. The permit is the beginning, not the end. Your system still needs a lawful purpose, proportionate coverage, a justifiable retention period, secured access and proper information for the people filmed. That is the substance of APDP data protection compliance; cameras are one more processing activity inside it.

Existing cameras will need a new authorisation

This will surprise most established businesses. Articles 4 and 7 cover organisations that held a CCIN authorisation before Law 1.565 and have not changed their system since. The APDP's reading is that the legality of these legacy systems "will be subject to obtaining a new authorisation from the Minister of State". The procedure looks light — contact details plus a sworn statement that the system was lawfully implemented before the law and runs unchanged — but it is a formality you will have to complete.

The APDP has two reservations. It questions the word "notably", which suggests the Minister could apply criteria beyond the sworn statement. And it warns that authorising systems on declaration alone, when they may no longer meet current security standards, is itself a security problem. Its fix: authorisations limited to five years, renewable and revocable, with legacy systems presumed compliant for five years from 3 December 2024. If that is followed, every camera system in Monaco goes onto a renewal cycle.

What the APDP wants tightened

• Purpose written into the Order. Cameras should serve only the security of persons and property against assault or theft. The APDP says it is "frequently contacted" by controllers wanting to police "incivilities" — a misuse it could sanction during an inspection.
• Security checks in the file. The draft asks nothing about storage, access or system protection. The APDP points to the French procedure, which requires a description of security measures, retention justification and access-right arrangements. Expect a more demanding file in the final version.
• Restrictions on filming the public road. Footage of your premises' surroundings should be viewable only by public authorities after an actual incident, never by the business, and reserved for defined controllers exposed to real risk. Under the current wording a private individual or residential building could theoretically apply, which the APDP considers inappropriate.
• Clearer definitions. "Spaces open to the public or to public traffic" is undefined; the APDP asks whether a shopping gallery such as Fontvieille's counts. Vague terms, it says, create legal insecurity for the very businesses the Order should help.

A practical checklist for Monaco businesses

Most of the work is the same under any version of the text:

1. Inventory every camera: location, field of view, whether it captures a public area, the road or staff-only space.
2. Locate your CCIN authorisation and note whether the system has changed. CCIN deliberations are published on the APDP website, so sworn statements will be checkable.
3. Write the purpose in one sentence. If it goes beyond protecting people and property from theft or assault, rethink it.
4. Fix retention and access: how long footage is kept, who can view it, how access is logged. If you run AI analytics on feeds, note that Monaco is separately preparing a law on remote biometric identification, and AI-driven analysis of images raises stricter questions of its own.
5. Update your information notices: signage on site and the privacy section of your website. Hotels and restaurants should check that the privacy policy on their hospitality website mentions video surveillance in every language they serve.
6. Add cameras to your register of processing activities and, where the thresholds in Ministerial Order 2025-361 are met, to your impact-assessment plan.

Where this fits in your wider compliance picture

This Order is one of a series of implementing texts turning Law 1.565 from principle into procedure, alongside the July 2025 Sovereign Ordinance, the impact-assessment Order and the adequate-countries list. The APDP showed this month, with its first public formal notice, that it will enforce them, and businesses that run data protection as one documented programme absorb each new text far more easily. If you are unsure where cameras sit in your digital strategy and compliance roadmap, now is the moment to map it.

The Order is coming and the direction is clear. If you would like help auditing your website's privacy information or structuring your compliance documentation, get in touch.