Hidden cameras in hotels: legal liability in the Netherlands

Update 14 April 2026: article reviewed; legal framework (art. 139f Sr, art. 6:162/6:170 BW, GDPR art. 33) remains fully current.

The discovery of a hidden camera in a hotel room has far-reaching legal consequences — both for the perpetrator and for the hotelier. In the Netherlands, covertly filming people in an enclosed space is a criminal offence. But the hotelier can also be held liable if it turns out that insufficient preventive measures were taken.

What does the law say about hidden cameras in hotels?

Article 139f of the Dutch Criminal Code prohibits the covert recording of persons in places where they can reasonably expect not to be observed. A hotel room falls explicitly within this definition. The maximum penalty is one year imprisonment or a fourth-category fine (maximum €25,750 in 2026).

This is a complaint offence — a report by the victim is required for criminal prosecution. Alongside criminal proceedings, the hotelier can be held civilly liable for damages including psychological harm, reputational damage and costs.

The hotelier’s duty of care

In the Netherlands, a hotel has a statutory duty of care towards guests. This obligation is enshrined in:

• Articles 7:290 et seq. of the Dutch Civil Code (rental law — temporary letting of space)
• The general tort provision (Art. 6:162 DCC)
• The GDPR — the hotel processes personal data of guests and is responsible for the security of that data

The key question in determining liability is: did the hotel do everything that could reasonably be expected of it to prevent guests from becoming victims of a privacy violation?

When a court determines that the hotel had no or insufficient preventive measures in place — such as periodic TSCM inspections or staff training — this can be classified as negligence.

When is the hotelier liable?

The hotelier is not automatically liable for the actions of a guest who places a camera. But liability can arise if:

1. The hotel knew or should have known that a camera was present
2. The hotel had no preventive inspection protocol
3. A report from a guest was not taken seriously
4. The camera was placed by a member of staff

In the latter case, employer liability under Art. 6:170 DCC applies.

What must a hotel do when a report is made?

1. Immediate action: Seal the room and move the guest to a different room
2. Do not touch: Preserve the camera as evidence — fingerprints are essential for police investigation
3. Report: Involve the police and file a report under Art. 139f Sr
4. Professional inspection: Engage SAJ Recherche for evidence preservation and a full TSCM report
5. GDPR notification: If personal data has been leaked, notification to the Dutch Data Protection Authority is mandatory within 72 hours (Art. 33 GDPR)

The role of the Dutch Data Protection Authority

Covert video recording in a hotel room constitutes a data breach under the GDPR: unauthorised access to personal data (footage of guests). The hotelier who becomes aware of this is obliged to report it to the Dutch Data Protection Authority (AP) within 72 hours. Failure to do so can result in a GDPR fine of up to €20 million or 4% of global annual turnover.

Prevention: what does a court expect from hotels?

To limit liability and comply with the duty of care, hotels are expected to:

• Conduct periodic TSCM inspections of hotel rooms, in particular suites and VIP rooms
• Provide staff awareness training so employees can recognise suspicious objects
• Have a reporting protocol for guests and staff
• Contractually regulate the responsibility for detection with cleaning and maintenance personnel
• Maintain a compliance report of inspections carried out

SAJ Recherche provides a written compliance report with each periodic inspection that can serve as evidence of proactive action in legal proceedings.

Practical advice for guests

If you suspect or discover a hidden camera in your hotel room:

• Do not touch the camera
• Photograph the location with your phone
• Leave the room and close the door
• Inform hotel management
• File a report with the police
• Contact SAJ Recherche for an independent inspection report

---

Official sources:

• Dutch Criminal Code, Art. 139f — wetten.overheid.nl
• Dutch Data Protection Authority — autoriteitpersoonsgegevens.nl
• GDPR Art. 33 (data breach notification) — eur-lex.europa.eu

Read also

• Hotel privacy inspection checklist
• Hidden cameras in hotels: reputation damage
• Liability insurance hidden cameras hotels

Related services: TSCM inspection · Hospitality Privacy & Security · Rates private detective

---

SAJ Recherche B.V. holds POB licence 8779 (Ministry of Justice). This article is for informational purposes and does not constitute legal advice. Consult a lawyer for your specific situation.