CCTV in the workplace: monitoring staff lawfully

This is general guidance, not legal advice. The ICO has said its guidance on monitoring workers is under review following the Data (Use and Access) Act 2025, so check its website for updates.

Security cameras rarely capture only intruders. A camera on a loading bay, a reception desk or a stockroom door also records the people who work there, and in law that’s monitoring workers. The ICO’s guidance on monitoring workers applies on top of the general CCTV rules.

None of this stops employers using CCTV. It means being clear about why the cameras are there, telling staff, and not using footage in ways they wouldn’t expect. This guide is written for the employer or facilities manager. For the wider rules on business CCTV, see our guide to CCTV and GDPR.

When monitoring staff is lawful

UK GDPR needs a lawful basis for any processing, and the ICO’s guidance makes three points about CCTV that captures staff:

• Consent usually isn’t the right basis. Consent has to be freely given, and the ICO says it’s not usually appropriate at work, because staff may feel they can’t say no.
• Legitimate interests is the usual basis. It’s the most flexible, but it comes with a balancing test: your reasons for the cameras against the effect on staff privacy. It doesn’t fit monitoring that staff don’t understand or wouldn’t reasonably expect.
• Use the least intrusive option. The ICO says that because a form of monitoring is available doesn’t mean it’s the best way to meet your aim. A camera on the stockroom door may meet the same purpose as one watching the whole sales floor all day.

Typical purposes that hold up well are preventing and detecting crime, protecting staff and visitors, and health and safety. “Keeping an eye on productivity” is much harder to justify with cameras, and staff are entitled to find continuous filming of their work intrusive.

Do a DPIA first

A DPIA (data protection impact assessment) sets out what the cameras are for, what they can see, the risks to staff and what you’re doing to reduce them.

The ICO says you must do one before any monitoring likely to be high risk, and should do one even when it isn’t. If you decide not to, write down why. In practice, a DPIA is the easiest way to show you thought about necessity and proportionality before the cameras went up, and it’s the document you’ll want if a member of staff or the ICO asks.

The ICO also suggests asking staff, or their representatives, for their views, and recording what they said.

Tell staff before the cameras go live

Apart from very exceptional covert cases, staff must be told about monitoring before it starts, in a way that’s easy to understand. That usually means three things:

1. A CCTV or monitoring policy that says what the cameras are for, where they are, who can view footage, how long it’s kept and whether it may be used in disciplinary matters.
2. Privacy information in your staff privacy notice, covering the same points.
3. Signs at the entrances to recorded areas, as for visitors. See our guide to what CCTV signs must say.

If the monitoring is there to enforce a particular policy, such as cash handling or site safety rules, make sure that policy is written down and staff know it.

Places cameras shouldn’t go

The ICO is clear that cameras shouldn’t film workers where they would reasonably expect privacy, and names toilets and changing rooms. Its own example is an employer who solves a problem by filming the door outside a changing room rather than inside it.

Staff rooms, rest areas and prayer or quiet rooms aren’t named in the guidance, but they’re places where people reasonably expect some privacy. A camera there needs a much stronger reason than one on an entrance, and the DPIA should say what it is.

When we design a system, we plan coverage around the purpose you’ve written down: entrances, perimeters, stores, cash points and vehicle areas. Where a camera’s view would take in somewhere it shouldn’t, most modern cameras can black out that part of the image with a privacy mask.

Audio recording

Recording sound is far more intrusive than recording images. The ICO’s CCTV guidance says audio should normally be switched off and used only where there’s a clear need that less intrusive methods can’t meet. Many modern cameras have a microphone built in, so check it’s disabled unless you’ve decided otherwise.

If you do have a reason, such as a trigger button at a reception counter where staff face abuse, record only when it’s pressed, cover it in the DPIA, and tell staff and visitors specifically that sound is recorded.

Covert monitoring: the narrow exception

Hidden cameras are only justified in exceptional cases. The ICO’s conditions:

• there are grounds to suspect criminal activity or gross misconduct
• telling staff would prejudice the investigation
• senior management authorises it
• it’s covered by a DPIA
• it targets the specific problem, for as short a time as possible, and stops when the investigation ends
• it’s never used in toilets, changing rooms or other places where people expect privacy
• the footage is used only for that investigation, and anything unrelated is disregarded and deleted

Covert monitoring isn’t a way to avoid telling staff about a normal system.

Using footage in disciplinary cases

Data protection law has a principle called purpose limitation: information collected for one purpose shouldn’t be reused for an unrelated one without a compatible reason or a new lawful basis.

So if your cameras are there for security and you may also rely on footage in disciplinary cases, say so in the policy before you need to. Then:

• use footage that’s relevant to a specific allegation, rather than trawling through recordings to find something
• let the employee see the footage you rely on and respond to it
• export and keep the relevant clip for the life of the process, and let the rest overwrite on its normal cycle (see how long to keep CCTV footage)
• keep a record of who viewed and exported it

When staff ask for their footage

Footage of an identifiable member of staff is their personal data, so they can make a subject access request for it. You normally have one month to respond, extendable by two months for complex requests.

Other people in the clip may need to be blurred or removed before you hand it over. Your recorder or video management software should be able to find and export footage by time and camera quickly, which matters when the clock is running. Once a request arrives, don’t delete the footage, even if it’s due to overwrite.

Do and don’t

Planning cameras for a workplace, or reviewing what an existing system can see? We design commercial CCTV around the purpose in your DPIA, and access control that logs entry without filming people. Talk to us about CCTV.