Data Security: Robots with Cameras and the GDPR

A humanoid or mobile robot moving around a production hall, warehouse or reception area carries cameras, microphones and sensors — and that means that, alongside its main job, it is continuously collecting data about the people around it. From the GDPR's point of view it makes no difference that the device is called a "robot" rather than a "surveillance camera" — if it records images of identifiable people, it falls under the same rules as any other video system. (In Poland the GDPR is known as RODO, and enforcement lies with the data protection authority, UODO.)

The robot as a system that processes personal data

The GDPR defines personal data broadly: any information relating to an identified or identifiable person (Article 4(1)), including their likeness. A robot's cameras — needed for navigation, object recognition or interaction with people — as a rule also capture the faces of employees and customers in their field of view. The mere processing of this image, even without permanent storage, is already subject to the rules.

The entity that deploys the robot — most often the employer or the owner of the premises, not the robot's manufacturer — becomes the controller of this data and takes on full responsibility for GDPR compliance: the legal basis for processing, the information duty, the retention period and protection of the data against access by unauthorized persons.

Which legal basis applies

In practice, companies most often base monitoring — including monitoring carried out by a robot — on the controller's so-called legitimate interest (Article 6(1)(f) GDPR), such as protecting property, employee safety or supervising the production process. For monitoring in a workplace, the Labour Code (Article 22²) also contains specific rules. This basis does not require the consent of each person recorded individually, but it does require that the controller's interest genuinely outweighs the recorded person's right to privacy, and that the purpose can be achieved by the means least intrusive on privacy.

That last condition matters in practice for robots: if a robot has cameras watching its surroundings through 360 degrees the whole time it works, and needs a much narrower field of view for navigation alone, it will be harder to justify processing the full video stream as "necessary." In its Guidelines 3/2019 on video devices the European Data Protection Board states that video surveillance is not by default a necessity when there are other means to achieve the purpose — the same reasoning applies to robots.

Sound is a separate, higher bar

Many humanoid robots have microphones for recognizing voice commands. Here the bar is higher than for the image alone: the European Data Protection Board treats audio-visual recording as a greater interference with privacy than video alone, and in its guidance for employers the Polish UODO states that monitoring concerns image recording and that systems recording sound may violate privacy and amount to excessive processing. In a 2022 decision UODO fined an institution PLN 10,000 (≈ EUR 2,290 at NBP rate 4.3641 of 21 October 2026) for recording audio in its surveillance system without a legal basis. It is therefore safer to switch off default audio recording, or to give it a separate, explicit legal basis limited to a specific, justified purpose (for example, recognizing the operator's own voice commands rather than continuously listening to the environment). Before deploying a robot with an active microphone, it is worth consulting a data protection officer on this question.

The information duty: what a recorded person must know

People within reach of a robot's cameras must be informed before their data is processed. In practice this means:

• clear marking of the monitored zone — ideally both at the entrance to the room and on the robot itself, because, unlike a fixed camera, a robot changes its position;
• a full privacy notice (Article 13 GDPR; UODO allows layered information, with a first layer on the warning sign and further details available elsewhere) available, for example, on a notice board, a website or in the workplace rules — stating the data controller, the purpose and legal basis of processing, the retention period of recordings, and contact details for the data protection officer, if one has been appointed;
• information about the recorded person's rights: access to data, rectification and, in certain situations, erasure or objection to processing.

Data minimization and the retention period

The GDPR gives no single universal number of days for keeping recordings — the key is the principle of data minimization and storage limitation (Article 5(1)(c) and (e)): data is kept only as long as necessary to achieve the purpose. In Guidelines 3/2019 the European Data Protection Board says a few days is usually sufficient and that storage beyond 72 hours calls for stronger justification. The Labour Code sets an upper limit of 3 months from the recording for monitoring in a workplace, extended when a recording is evidence in proceedings — that is a ceiling, not a period to adopt automatically. It is worth setting this rule in an internal procedure before switching the robot on, not only at the first inspection.

Data going to the manufacturer's cloud

Many humanoid robots — especially models built on VLA models that keep learning from recordings of their surroundings — send part of the data they capture to the manufacturer's cloud for further training of artificial-intelligence systems. This is a separate, often overlooked strand of GDPR compliance: a company deploying the robot should check in its supplier contract whether and which data leaves its infrastructure, where it is processed, and whether the manufacturer guarantees adequate mechanisms for transferring data outside the European Economic Area (for example, standard contractual clauses, Chapter V of the GDPR) if the servers are outside the EU — and with Chinese and American manufacturers that is more the rule than the exception. Without such a clause in the contract, the company as data controller bears responsibility for the transfer, even if it did not have full knowledge of how the robot works.

Who is responsible for compliance — manufacturer or user

In practice, the roles are split differently depending on the setup. The robot's manufacturer usually acts as a processor within the meaning of the GDPR (Article 28) if data reaches its servers solely for service purposes defined by the customer. If, however, the manufacturer uses the same data for its own purposes — for example, training AI models later sold to other customers — it may be regarded as a joint controller (Article 26) or a separate controller, which changes the whole structure of responsibility and requires a separate legal basis. This distinction is worth settling in writing with the supplier before signing the contract, not only when a UODO inspection comes.

Checklist before deploying a robot with cameras

A company planning to deploy a robot with cameras in Poland should check the following before going live:

1. Whether the data controller and the legal basis for processing the image have been determined (and, separately, for sound, if the robot has a microphone).
2. Whether a privacy notice and monitored-zone markings have been prepared and made available.
3. Whether the data from the robot's cameras is technically secured (encrypted transmission, restricted access to recordings, including on the robot manufacturer's side if the data goes to its cloud).
4. Whether the contract with the robot supplier clearly states who has access to the recordings, where they are stored (including whether outside the European Economic Area) and for how long — this is especially important with robots from Chinese and American manufacturers, where data may by default go to servers outside the EU.
5. Whether a data protection impact assessment (DPIA, Article 35 GDPR) has been carried out, if the scale of monitoring or the use of facial recognition justifies such an obligation — Article 35(3)(c) requires one, among other cases, for systematic monitoring of a publicly accessible area on a large scale.

Deploying a robot with cameras without going through this process is not automatically illegal, but it exposes the company to the risk of a UODO inspection and administrative fines — and in practice the most common mistake is not a missing consent to processing, but missing clear information for the people being recorded and a missing documented legal basis. More on robots' compliance with regulations is in our article on robot safety standards.