Security cameras, video doorbells and baby monitors

• Directive 2014/53/EU — Radio Equipment
• Delegated Regulation (EU) 2022/30 — cybersecurity
• Regulation (EU) 2024/2847 — Cyber Resilience Act
• Regulation (EU) 2016/679 — GDPR, Articles 27 and 5

Who has to appoint one

Manufacturers outside the Union selling connected cameras to EU users. Two obligations arise together: the product placed on the market, and the personal data processed through the vendor's cloud, which for a camera includes images of identifiable people and often audio.

Thresholds and exemptions

No threshold for either. Even a single camera sold to a consumer triggers the product obligations, and any cloud storage of footage from EU users triggers Article 3(2) GDPR.

What must appear on the label

CE marking, manufacturer and EU representative details, model and serial number, frequency bands and transmitted power, the WEEE symbol, and from December 2027 the CRA support period and vulnerability contact point. In the app and privacy notice, the Article 27 representative's identity and contact details.

Marketplace fields

Marketplaces require the EU responsible person and the declaration of conformity on challenge. Cameras with hardcoded default passwords or unencrypted streams have been removed following coordinated enforcement, and the RED cybersecurity requirements since August 2025 have raised the bar further.

Documentation you must hold

EU declaration of conformity, technical file, radio and safety test reports, cybersecurity documentation under EN 18031, and from 2026 the CRA vulnerability handling process and SBOM. On the data side: the Article 30 record, the Article 27 designation, a data protection impact assessment, retention rules for footage, and the transfer mechanism where recordings leave the Union.

Standards and testing

EN 300 328 and related radio standards, EN IEC 62368-1 for safety, EN 55032 and EN 55035 for EMC, and EN 18031 for the network protection, data protection and fraud prevention requirements. Penetration testing is not mandatory but is the practical way to evidence the cybersecurity requirements.

Language requirements

Instructions and warnings in the national language, and the privacy information in the language of the users concerned.

When it applies

Product documentation before placing on the market. Cybersecurity requirements applicable since 1 August 2025. CRA vulnerability reporting from 11 September 2026, full CRA from 11 December 2027. The GDPR representative before EU users' footage is processed.

How long records are kept

Ten years for technical documentation, or the CRA support period if longer. Footage must not be retained longer than necessary, and an unlimited default retention is itself an infringement.

What happens if you do not comply

On the product side, withdrawal, customs refusal and marketplace removal. On the data side, up to €20 million or 4% of turnover, and data protection authorities have fined camera vendors over insecure streams, excessive retention and default cloud upload. A breach exposing footage triggers Article 33 notification within 72 hours.

Who enforces it

Market surveillance authorities and radio regulators for the device, CSIRTs for CRA reporting, and data protection authorities for the footage.

Where the boundary lies

Baby monitors and doorbells raise an additional issue the vendor cannot control but must design for: the user's own processing of images of neighbours and visitors, which authorities have addressed through guidance on domestic camera use. Vendors that default to cloud upload, or that make local storage impossible, have been criticised precisely because the design choice removes the user's ability to comply.

Questions we are asked

Do we need both an Article 4 operator and a GDPR representative?

For a connected camera, yes. One covers the device placed on the market, the other the processing of footage of people in the Union.

What changed for cameras in August 2025?

The RED delegated Regulation made network protection, personal data protection and fraud prevention essential requirements. Default passwords and unencrypted streams no longer pass.