the GDPR does apply to a camera in a bar. As long as it is used exclusively for security and data purged regularly, it can be claimed to be required.

Certainly the bar owner cannot distribute the videos without explicit consent. And yes, that can be problematic in many cases (for examples, capturing faces of people in a concert).