Security guides & advice

Video surveillance: what the CNIL says

Video surveillance is not prohibited, but it is regulated. The principle of minimisation requires filming only what is necessary, for a specific purpose, for a proportionate duration. In practice, images must be kept for a limited period — often a few days to a month depending on the context — then deleted automatically.

Informing people is also mandatory: clear signage at the entrance to filmed areas, mention of the data controller and of access rights. Finally, access to images must be restricted and logged in a register. A system properly configured from the design stage avoids formal notices and preserves the evidential value of the images.

Our support integrates these requirements: signage, retention-period configuration, access-rights management and access logs.

CNAPS authorisation: why it is mandatory

Since the sector reform, exercising private security activities — including the installation of alarm and video surveillance systems, and remote monitoring — is subject to prior authorisation from the CNAPS. Without authorisation, the activity is illegal: the contract may be voided and the operator exposes its clients to legal and insurance risks.

The authorisation covers a precise scope of activities and must be renewed. Staff, for their part, hold a professional card. For a client, checking a provider's authorisation number is a basic reflex — it is in fact one of the first checks carried out by banks and insurers.

At BULDING PROTECT SÉCURITÉ, the CNAPS authorisation is displayed and verified: see the CNAPS Approval page.

APSAD R31 & R81: understanding the standards

The APSAD rules, published by the CNPP, define the technical and organisational requirements for intrusion detection (R31) and video surveillance (R81). A certified installation guarantees a recognised level of effectiveness and quality — and is often required by insurers to cover the risks.

Beyond the equipment, certification also covers the service: operational maintenance, upkeep and traceability. This is why we align our services with these standards and target the corresponding certifications, a mark of trust for demanding clients.

Intrusion detection: perimeter or volumetric?

Perimeter detection aims to intercept intrusion as early as possible, at the fence or its approaches: infrared barriers, fence sensors, radars, video analytics. It allows action before the break-in, but requires fine tuning to limit false alerts linked to the environment.

Interior volumetric detection protects sensitive areas once the perimeter is breached: motion detectors, anti-masking, pet-immune. The two approaches are complementary and must be sized according to the value of the goods, the site's geography and the dominant risk scenario. Our audit determines the right combination.

Verification: the heart of remote monitoring

An alarm is only useful if someone analyses it. Verification consists, for an operator at the remote monitoring centre, in checking visually and remotely whether the event is real before triggering a response. This step drastically reduces false alerts and travel costs, while speeding up the response when the intrusion is confirmed.

In practice: the operator consults the relevant cameras, cross-checks with the other sensors, then decides — dispatching an agent, calling the police, or simply logging the event. This demand for responsiveness and discernment is at the heart of our 24/7 centre.

Badges & biometrics: what the GDPR allows

Access control processes personal data: identifiers, badges, and sometimes biometrics. The GDPR requires a proportionality analysis: biometrics is only justified for highly sensitive areas, and generally requires a reinforced level of protection.

In most cases, badges and visitor management are sufficient, provided the retention period of the logs is limited, access rights are restricted and users are informed. We design systems that secure access while respecting these principles — and we document the compliance.