Successful protection of company data assets requires strong technological support. As many security incidents still occur from within, security technologies often include elements to monitor the behaviour of employees. As those security systems are considered as privacy-intrusive, they are hard to align with the privacy and data protection rights of the employees of the company. Even though there is currently no legal obligation for developers to embed privacy and data protection in security systems, by taking privacy-friendly design decisions, developers can play a significant role in the protection of employees. Especially since privacy by design is gaining momentum in Europe, but nonetheless, because privacy and data protection law results in several obligations for companies, and the non-compliance with data protection law is increasingly under fire, the need for companies to deploy privacy-friendly security systems, is growing. Hence, developers will also increasingly benefit from designing privacy-friendly security systems. In this paper the MUSES RT2AE was studied as an example of privacy-friendly development of a security system. The MUSES developers used four privacy and data protection guidelines in order to make privacy-friendly design choices. Besides several limitations on the type of information which is processed by MUSES, MUSES technically facilitates companies to modify the privacy-friendliness of the system according to the specific needs of the company. Nevertheless, the road to privacy-friendly security technologies is long and hard to pave, but step by step, all of us will get there.