CCTV and GDPR: what UK businesses need to get right

This is general guidance, not legal advice. The ICO says its CCTV guidance is under review following the Data (Use and Access) Act 2025, so check the ICO’s current guidance before relying on any detail.

If your cameras capture people who can be identified, the footage is personal data. Your business is the controller and has to comply with UK GDPR and the Data Protection Act 2018. That’s true whether you have two cameras on a shop door or two hundred across a site.

In practice, most of the work is deciding why you have cameras, writing it down, and setting the system up to match.

Start with the purpose

Decide what problem the cameras are there to solve before they go up. The ICO’s checklist names the usual purposes: preventing or detecting crime, keeping people safe, and securing the premises. Write the purpose down and review it regularly. Using footage for something unrelated later, such as monitoring staff performance, needs its own justification.

Your lawful basis

For most businesses the lawful basis is legitimate interests: you have a real reason to protect your premises, staff and stock, and the cameras are a proportionate way to do it. Record that reasoning. A short legitimate interests assessment does the job and feeds straight into your DPIA.

Do you need a DPIA?

A Data Protection Impact Assessment is required where processing is likely to be high risk to people. The ICO’s view is that most surveillance falls into that category, so plan on doing one, and do it before the cameras go live. It should cover:

• what you’re trying to achieve, and why cameras are the right way to do it
• what each camera can see, and who could be affected
• how long you keep footage and who can view it
• what you’re doing to reduce the intrusion

Signs

People must be clearly aware they’re being recorded. Signs should:

• be visible and readable for the setting: larger for drivers, at eye level for people on foot
• appear before people enter the recorded area
• say who operates the system, why, and how to contact them (a phone number, email or web address)

A privacy notice on your website helps, but on its own it isn’t enough. Our guide to what CCTV signs must say covers the wording, positions and common mistakes.

Where cameras shouldn’t point

Position cameras so they cover your property, not your neighbours’ or the street beyond what you need. The ICO’s checklist specifically warns against capturing private land or people who aren’t visiting your premises. Keep cameras out of places where people expect privacy, such as toilets and changing areas.

Staff areas need particular care. Covering a cash office or a stockroom door is easy to justify; watching a staff room isn’t. Our guide to CCTV in the workplace covers what to tell staff, covert cameras and using footage in disciplinary cases.

Audio: the ICO says CCTV shouldn’t normally record conversations. Keep audio switched off unless you have a specific, evidenced need that less intrusive options can’t meet. If you do record sound, you have to tell people.

How long to keep footage

There’s no fixed legal retention period. The rule is to keep footage for the shortest time that serves your purpose. “The recorder holds 60 days” isn’t a reason; storage capacity and manufacturer defaults don’t justify keeping footage longer.

Many businesses settle on around 30 days: long enough to notice and review an incident, short enough to be easy to defend. Set the period in your policy, and size the system’s storage to it rather than the other way round. Keep specific clips longer when there’s a reason, such as a police investigation or an insurance claim. Our guide to how long to keep CCTV footage explains how to choose the period and make the recorder stick to it.

Requests for footage

Subject access requests. Anyone recorded can ask for a copy of footage of themselves. You normally have one month to respond. You can extend by up to two further months if the request is complex, but you must tell the person within the first month. If you need clarification from them, the clock pauses until they reply. Before releasing footage, blur or redact other people who can be identified.

The police and insurers. You can usually share footage to help prevent or detect crime. Record what was shared, with whom and why, and keep an audit trail if it may be used as evidence. The system should be able to export clear footage in a form that shows it hasn’t been altered.

Keep the system secure

CCTV recorders and cameras sit on your network, so they’re a target like any other device. The ICO expects footage to be stored securely, with access limited to the people who need it, and encryption where possible. When we design a system, that means:

• cameras and recorders on a segregated network, where your IT team provides one
• no direct internet access from cameras or recorders, and encrypted connections between sites
• default passwords removed, firmware kept up to date, and access set by role
• viewing and export logged, so you can see who looked at what

Regular maintenance keeps this true after installation, not just on the day it’s commissioned.

ANPR and facial recognition

Number plate recognition at a vehicle gate is common and usually easy to justify. You still need to cover it in your DPIA and signage, and set a retention period for plate records.

Facial recognition is a different matter. It processes biometric data, which carries extra legal conditions, and the ICO has published specific guidance on it. Some camera platforms include it as a feature. We don’t switch it on without a DPIA and a clear lawful basis.

Other things businesses ask about

• Registration: if you process personal data, including CCTV footage of identifiable people, you’ll usually need to register with the ICO and pay the data protection fee.
• The Surveillance Camera Code of Practice is binding on police forces and local authorities, not private businesses. Businesses are encouraged to follow its principles voluntarily, and it’s a useful benchmark.
• One named person should be responsible for the system day to day.

A quick checklist

• The purpose is written down and reviewed regularly
• A lawful basis is recorded, usually legitimate interests
• A DPIA was done before the cameras went live
• Signs are up before the recorded area, with who, why and contact details
• Cameras are positioned to avoid neighbours and private spaces
• Audio is off unless there’s a justified need
• A retention period is set, and the system deletes automatically
• Access to footage is limited, logged and secure
• There’s a process for subject access requests and police requests
• The organisation is registered with the ICO

The ICO publishes a checklist for limited CCTV systems that’s worth working through once a year.

Getting the design right

Most compliance problems start at installation: cameras that see too much, storage set to “keep everything”, or a recorder open to the internet. We design commercial CCTV around the purpose you’ve written down: coverage where it’s needed, retention set to your policy, and a network your IT team will sign off. Our guide to choosing a commercial CCTV system goes through those decisions. The privacy questions come up most at schools, hospitals and warehouses, and each of those pages covers what we fit there.