Distribution · GDPR

Retail — GDPR: loyalty programmes, CRM and video surveillance

The retailer processes loyalty, CRM and point-of-sale data, and deploys video surveillance across its outlets. The GDPR governs profiling, direct marketing and monitoring. This guide details these processing activities and a tailored compliance roadmap.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: GDPR.
  • All retailers processing customer data and deploying video surveillance are concerned.
  • Regulate loyalty.
  • Framing prospecting.
  • Proportioning video surveillance.
  • Fines of up to €20M or 4% of global turnover.

Regulatory deadlines

The key dates of this regulation.

May 2018

Entry into application

In force

What does GDPR cover?

GDPR governs customer data (loyalty programmes, CRM), marketing profiling and prospecting. In-store video surveillance protects assets but must not subject employees to unjustified continuous monitoring.

Each purpose requires its own legal basis and retention period.

Is the 'Distribution' sector concerned?

All distributors processing customer data and deploying video surveillance are concerned. Service providers (CRM, loyalty, e-commerce) are processors.

Large-scale retail processes significant volumes and is subject to heightened requirements.

Detailed obligations

Govern loyalty schemes

Legal basis, information and governance of loyalty programme profiling.

Frame prospecting

Consent or framed legitimate interest, with a simple opt-out.

Scaling video surveillance proportionately

Information, proportionality, limited filmed areas, and short retention periods.

Secure

Security of client data and images.

Limit retention periods

Retention periods tailored by purpose (loyalty, images, CRM).

Sanctions & risks

Fines of up to €20M or 4% of global turnover. Disproportionate video surveillance and non-compliant prospecting are recurring grounds for sanctions.

Common mistakes in the sector

  • 1Opaque loyalty. Profiling without information.
  • 2Prospecting without a legal basis. Sending offers without a legal basis.
  • 3Excessive video surveillance. Continuously filming employees.
  • 4Excessive retention. Retain images and data for too long.

Practical case

A retailer was retaining CCTV footage without any time limit and processing loyalty data without informing individuals. The remediation restricts filmed areas, defines retention periods, informs customers and employees, and governs profiling.

Compliance roadmap

  1. 1

    Map. Map loyalty programmes, CRM, checkout, and video surveillance.

  2. 2

    Frame. Legal bases and profiling.

  3. 3

    Video surveillance. Proportionate and inform.

  4. 4

    Secure. Customer data and images.

  5. 5

    Durations. Define by purpose.

Frequently asked questions

A short and justified retention period, except in proceedings.

Back to the Distribution guideDistribution & AI Act

Take action on GDPR

Free assessment or a chat with an expert dedicated to distribution.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the distribution sector secured their compliance with DCO.

See testimonials