Installing an IP camera, a video doorbell, or a digital peephole brings two distinct risks that every owner should understand before the first clip is recorded. The technical risk is unauthorized access: a stranger slipping into your camera feed. The legal risk is capturing footage you have no right to record. Inside your own home, data protection rules generally do not apply. The moment a lens points at the street, a shared building area, or someone who works in your household, they do.
- Secure the device first: Change factory credentials, enable two-factor authentication, keep firmware patched, and isolate cameras on a separate network.
- Know the legal boundaries: Filming the public street is only allowed to the minimum extent necessary for security, while shared hallways require agreement from the building’s owners’ association.
- Domestic workers change the rules: When a caregiver or housekeeper works in the home, cameras must be disclosed in advance and cannot be used for continuous workplace surveillance.
Step One: Make the Camera Yours Alone
Breaking into someone else’s camera does not require elite hacking skills when the password is still the factory default or the account is poorly protected. Spain’s national cybersecurity institute, INCIBE, lays out the baseline measures in its guide to connected devices: replace default credentials with a strong password, keep both the camera firmware and the mobile app updated, disable remote administration if you do not need it, and isolate connected devices on a separate network such as the router’s guest network. Reviewing app permissions and switching off anything unnecessary rounds out the checklist.
Add two-factor authentication to the manufacturer account, preferably through an authenticator app or a passkey rather than SMS. The Spanish Data Protection Agency, known as the AEPD, also asks in its practical guidance on home surveillance cameras that internet access be restricted with a username and password known only to those who need to view the footage. It recommends changing the password after installation and avoiding easily guessed combinations.
One frequently overlooked step is auditing shared access inside the app. A former partner or a previous tenant who still holds access is just as dangerous as an unknown intruder.
Can the Manufacturer Watch Your Videos?
The answer hinges on whether footage is stored with end-to-end encryption. When that option is active, not even the manufacturer can view the recordings. Some brands offer it as a toggle. Ring, for instance, explains in its support documentation that enabling end-to-end encryption means videos are encrypted with keys controlled solely by the user, viewable only on enrolled phones, and inaccessible to anyone else, Ring included.
There are trade-offs. Encrypted videos can no longer be viewed through Alexa, Fire TV, or the Ring website, and the company cannot help recover them if you lose the twelve-word passphrase and cloud backups fail. The sensible approach is to switch it on for indoor cameras, where privacy stakes are highest.
Filming the Street, the Hallway, or a Neighbor’s Door
The street may only be captured to the minimum strip strictly necessary for security. Shared landings and other common areas require agreement from the building’s owners’ association. A neighbor’s home is off limits entirely. Article 22.2 of Spain’s organic data protection law establishes that public roadway images may only be captured insofar as they are indispensable for security purposes.
The AEPD guide distinguishes three scenarios. Inside your own dwelling, surveillance counts as personal or domestic activity and data protection rules do not apply; the law expressly excludes processing images that only capture the interior of the home. Outside a detached house, if the camera can capture people at entrances, facades, or boundary walls, the GDPR applies, which means a visible information sign, a record of processing activities, and limiting the frame to your property plus a minimal strip of the access point. In common areas of a building such as the lobby, staircase, or landing, a resolution from the owners’ association is required under the horizontal property law, and the community itself becomes the data controller.
If a camera can be rotated or has zoom, the AEPD requires privacy masks that block public roads and neighboring homes. Recordings must be deleted within one month at most, unless they serve to document acts against people, property, or installations, in which case they must be made available to authorities within 72 hours under Article 22.3 of the law.
The domestic exemption does not cover publishing images to an indeterminate audience. Uploading a video of a delivery driver or a neighbor to social media takes you outside it.
Video Doorbells and Digital Peepholes
A video intercom or digital peephole used only to see who is calling falls outside data protection rules. If it records or does more than a traditional device, it does not. That is the AEPD’s stated criterion. Modern smart doorbells often detect motion, record clips, and upload them to the cloud, which brings them closer to an outdoor camera. In an apartment, their field of view typically covers the landing, a shared area. Configure detection so it captures your door and little else.
When a Housekeeper or Caregiver Works in the Home
The camera stops being a purely domestic matter. The AEPD made this clear in its June 2026 guidance on video cameras in homes of older people: when an employee is present, data protection obligations apply. The agency sets three rules. Workers must be informed expressly and clearly about the cameras before they are switched on. Cameras cannot be used as a mechanism for continuous workplace surveillance. And they cannot be placed in especially sensitive spaces such as bathrooms or, where applicable, the worker’s bedroom.
This aligns with Article 89 of the organic law, which requires any employer to give prior notice and prohibits cameras and sound recording in rest areas such as changing rooms, bathrooms, or dining rooms. On audio, the AEPD reminds that capturing conversations is a far more intense intrusion into privacy and should generally be avoided absent a specially justified need.
For the home camera, technical and legal security point the same way: the less it records, the less it exposes. A field of view trimmed to your own property, a hardened account, and transparency before plugging in when someone works in the home. A hidden camera to “see what the caregiver does” is not security. It is buying one problem to avoid another.