Keeping things for tax purposes requires no consent, same for anything you are legally required to keep record off. Video cameras most certainly fall under legitimate interest (as long as you follow the law about using surveillance in your country).

From what I recall on the info I've seen locally is that you don't need a DPO until you hit 250 employees.