An audit trail is the tamper-resistant log of who did what in a surveillance system — who viewed which camera, who searched for whom, who exported a clip, who changed a setting, and when. It is what turns access from invisible to accountable: without it, a system that holds sensitive footage has no way to show whether that footage was used properly or abused, and no way to detect an insider misusing their access.
It is both a security control and a legal expectation. GDPR's accountability principle (Article 5(2)) requires an operator to be able to demonstrate compliance, and an audit trail is a primary way to show that access was appropriate and to investigate when it was not — the difference between knowing an officer looked up an ex-partner's footage and having no idea. Good audit logging records views, searches, exports, configuration changes, and failed access attempts, and protects the log itself from edits by the people it monitors.
The pitfall is logging that is incomplete, unprotected, or never reviewed. A trail that captures logins but not who watched which footage misses the abuse that matters; a log an administrator can quietly edit cannot be trusted as evidence; and a log no one ever looks at deters no one and catches nothing. Audit data is also itself sensitive and subject to retention rules. Log the meaningful actions (especially viewing and export), protect the log from tampering, review it for anomalies, and retain it appropriately — accountability only works if the record is complete, trustworthy, and actually used. This is engineering guidance, not legal advice.
The handbook · 7 volumes
Fora Soft Video Engineering Handbook
An audit trail proves who viewed, searched or exported footage, and without one a surveillance system cannot show lawful handling to a regulator or court. We wrote seven volumes covering the whole video stack, and for audit trail design start with Volume 7: compliance with the EU AI Act, biometrics rules, C2PA provenance and vertical playbooks. Written by Nikolay Sapunov, CEO at Fora Soft.
Need an audit trail for footage access that stands up to regulators?
We will review your VMS and access model and deliver an audit trail specification with logged events, tamper protection and retention rules. 250+ video products shipped since 2005.
