Most digital signage never touches personal data, and the paperwork takes an afternoon. When it does, the GDPR applies in full. Answer the nine questions below: each “no” or “not sure” is a step to read in detail.
This is practical guidance from a signage company in the EU, not legal advice. For health data, children, biometrics or anything like workplace monitoring, take proper legal advice too.
The checklist at a glance
1. Do you know if your screens show personal data?
Prices and opening hours: no. Names, faces or queue numbers tied to a person: yes. Write the answer down.
2. Do you know where the system runs?
Get the company, its country, and the country of the server and its backups, in writing.
3. Do you upload only what the screen needs?
First names and scores, not full staff records. Clear out old photos and lists on a schedule.
4. Have you thought about screen pictures and play records?
A picture of a screen showing names contains those names. Decide who may take one and how long records stay.
5. Have you written down how long you keep things?
Photos of people, lists of names, screen pictures, play records. Pick a period for each and stick to it.
6. Do you have a DPA, and do you need a DPIA?
A Data Processing Agreement before personal data goes in. A full impact assessment only for cameras, health data or children.
7. Does any data leave the EU?
If yes, you need a transfer mechanism. With EU hosting the question disappears.
8. Does each person have their own login?
One shared password across a team fails accountability. Named logins need the right plan.
9. Are the players themselves safe?
Encrypted, outbound-only connections, locked enclosures, and old screens removed from your account when retired.
Our own answers, in one line: EU company, hosting in Germany, encrypted player traffic, screens claimed before they get anything, DPA on request, no certifications claimed. The detail is on security, GDPR and where your data lives.
Step 1: does your signage show personal data?
The answer decides how much of the rest applies. If a person could be identified from the screen, or from a file behind it, it is personal data.
| Set-up | Personal data? | What follows |
|---|---|---|
| Menu board: prices, photos, allergens | No | Normal supplier checks |
| Notice board: KPIs, weather, notices | Usually no | Check figures are totals, not per person |
| Team board: names, photos, birthdays | Yes | A lawful basis and a staff notice |
| Visitor welcome with names | Yes | Keep the display window short |
| Waiting-room screen tied to a person | Yes, in healthcare often special category | Use non-identifying numbers |
| Named shift rota | Yes | Employment context, so consent is rarely the right basis |
| Camera measuring age, gender or dwell time | Yes, the hardest case | Almost certainly a DPIA and signs at the entrance |
easyCMS has no camera and no audience measurement. A camera installed next to a screen is a separate product from a separate supplier, and somebody has to own it in writing.
Step 2: where the system lives, and under whose law
Ask two questions. Which company do we contract with, and where is it established? In which country does the system run, including its backups?
Our answers: DynamicDigital sp. z o.o., Warsaw, Poland, EU VAT PL5213678094, in digital signage since 2010 and running easyCMS since 2016. The CMS runs at Hetzner in Falkenstein, Germany. We will put both in writing for procurement. EU hosting removes the transfer question; on its own it does not make anything compliant.
Step 3: what you upload is the bigger risk
In most set-ups the risk is the library, not the vendor. People upload a staff photo directory or a guest list because it was the quickest way onto a screen, and each one becomes a processing activity you own.
Two habits fix most of it. Import only what the screen shows: first names and scores, not staff numbers and emails. And review the library regularly; storage and uploads covers clearing it out.
Step 4: screen pictures and play records
Take a new picture in Studio shows what a screen is playing right now. It captures the screen’s output only, never the room. A picture of a menu is a picture of a menu; a picture of a visitor list contains those names. See display monitoring.
Play records (Analytics in Studio) say what played, when and on which screen. That is data about screens, not people, unless one screen belongs to one named person, or you join the records to something that identifies people. More in proof of play for digital signage.
Good to know Ask what the record would reveal if it leaked. “Design 14 played 96 times on screen 7” reveals nothing. A picture of a waiting-room screen might reveal who was waiting.
Step 5: how long you keep things
Auditors ask about retention because nothing sets it for you. Decide, write it down, stick to it.
| Data | A sensible starting point |
|---|---|
| Photos of identifiable people | Delete when the campaign ends; review the library every 6 months |
| Lists holding names | Refresh from the source; keep no rows the screen does not show |
| Screen pictures | Take one to check a fault, then delete it |
| Play records | As long as your reporting needs, and no longer |
| Support emails | Your normal correspondence policy |
These are suggestions, not settings you can change. easyCMS customers do not run the server, so if an audit needs the platform’s own periods in writing, email info@myeasycms.com.
Step 6: the DPA, and when a DPIA applies
If personal data goes through the system, you are the controller and the vendor is your processor. Article 28 requires a written contract, the Data Processing Agreement, before the data goes in. For easyCMS, email info@myeasycms.com, Monday to Friday, 09:00 to 17:00 CET. Even with no personal data, most data protection officers want one on file.
A DPIA (Article 35) is only for likely high risk. Ordinary signage does not reach it. These four things push you towards one:
- A camera monitoring a public area
- Special category data, usually health; healthcare screens deserve their own review
- Vulnerable people: children, patients, and in some readings employees
- Large-scale processing of anything identifying
Watch out If a supplier offers “audience analytics” as a small extra, treat it as a new project with its own assessment. It changes the whole installation.
Step 7: data leaving the EU
If the system, its backups or a sub-processor sits outside the EEA, you need a transfer mechanism and documents to match. That is a task, not a scandal: a US company running a proper EU region can be fully compliant. Ask every vendor where your data, backups and sub-processors are, in writing. Our CMS runs in Germany under a contract with a Polish company, so there is no transfer to assess.
Step 8: one shared login
The most common finding has nothing to do with the vendor. One password shared by marketing, two site managers and an agency, kept in a chat thread. Nobody knows who published the wrong price list, and when someone leaves, nothing is revoked. Article 32 asks for appropriate measures, and that fails it.
Our limit: named users, groups and roles come with Enterprise, 1,290€ a year. The 49€ and 299€ accounts have one login, which suits a single café or reception, not a dozen people across sites. easyCMS has no single sign-on and holds no SOC 2 or ISO 27001 certificate. See users and permissions and the pricing page.
Step 9: the players on the wall
Player traffic is encrypted, players accept no inbound connections, and a new screen gets nothing until it is claimed for your account. Details are in network requirements and display licences and authorisation.
The rest is yours. Lock the enclosure in a public corridor, leave no keyboard behind the reception screen, and when a screen is retired, sold or stolen, ask us to remove it from your account straight away. And remember everyone in the room can read a screen that shows names.
The questions to send any vendor
Copy this into an email. A good vendor answers all of it without a call.
- Which company would we contract with, and where is it established?
- In which country does the system run, and where are the backups?
- Who are your sub-processors, and where is the list?
- Do you offer a Data Processing Agreement? Send it before we buy.
- If any data leaves the EEA, which transfer mechanism do you use?
- How long do you keep screen pictures, play records and monitoring data? In writing, please.
- Are screen pictures limited to the screen’s output, or can a camera or microphone be switched on?
- Is player traffic encrypted, and do we need to open any inbound port?
- Can we have separate user accounts with roles, and on which plan?
- Do you support SSO or SAML?
- Which certifications do you hold? Send them, or say you have none.
- How fast will you tell us about a personal data breach, given our 72-hour obligation?
- If we leave, how do we export our content, and how fast is our data deleted?
Our answers are in this article or one email away at info@myeasycms.com. A vendor who is vague on questions 2, 3 and 11 has told you something already.
Related reading: digital signage for healthcare, screens for internal communication and getting help and support options.