Because Malta is an EU member state, any business placing cameras at a workplace or building exterior can be considered a data controller under GDPR. In practice, this means it isn't enough for the camera to simply "work" — the area it covers, how long footage is retained, and who can access those recordings all need to be documented too.
A few practical points worth keeping in mind: avoid unnecessarily covering neighbouring property or public space, put up clear signage about recording, keep the retention period limited, and restrict access to a small number of staff.
Building these considerations into the design from the start is far easier than retrofitting them later. At Securetech, we offer general guidance on this during system design; for a definitive legal assessment, we recommend consulting a legal advisor.