What are the legal requirements for CCTV?

Installing CCTV at a commercial property involves more than choosing cameras, positioning them around the site and recording footage.

If a CCTV system captures identifiable people, the images it records will generally be treated as personal information. This means businesses need to consider how the system is used, why footage is being recorded, who can access it and how long it is kept.

For businesses considering a new commercial CCTV system, or reviewing and existing one, understanding these responsibilities should form part of the planning process.

The rules around CCTV sit within wider UK data protection law, including the UK GDPR and Data Protection Act 2018. The Information Commissioner's Office (ICO) provides detailed guidance for organisations using CCTV and other video surveillance systems.

This article provides a practical overview of the key areas businesses should consider. It is intended as general information rather than legal advice, and requirements can change over time. Businesses should refer to the latest guidance from the ICO and GOV.UK and see appropriate professional advice where necessary.

Why does data protection apply to commercial CCTV?

CCTV is designed to capture images, but those images can also identify individuals.

A person walking through a reception area, entering a building, driving through a gate or working within a monitored area may all be captured by a commercial CCTV system. Where individuals can be identified, the footage will generally be considered personal data.

This means a business has responsibilities for how that information is collected, stored, accessed and used.

Installing CCTV does not mean a businesses can simply record everything and keep it indefinitely. The system should have a clear purpose, and the way it is operated should be appropriate for that purpose.

For example, a business may install CCTV to help protect its premises, monitor access and investigate security incidents. That does not automatically mean the same footage should then be used for an unrelated purpose.

The ICO describes this as the principle of purpose limitation. Businesses should be clear about why they are collecting personal information and use it consistently with that purpose.

Do businesses need to tell people they are being recorded?

In most circumstances, yes.

People should be made aware that CCTV is operating and understand who is responsible for the system and why it is being used.

The most obvious way of doing this is through clearly visible CCTV signage. The ICO recommends that information about surveillance is provided before people enter the area being monitored, with further information available within the area where appropriate. Signs should explain that surveillance is taking place, the purpose of the system and who people can contact about its use.

GOV.UK also states that businesses using CCTV should put up signs telling people that CCTV is being used and why.

The signage therefore forms part of how the business explains its use of CCTV to customers, visitors, staff and other people entering the site.

The wider privacy information provided by the business should also reflect the use of CCTV.

This is why CCTV should be considered alongside the business' wider data protection arrangements rather than treated simply as a piece of security equipment.

Does a business need a reason for using CCTV?

Yes. A commercial CCTV system should have a clear and justifiable purpose.

The purpose might include protecting buildings and equipment, helping prevent or investigate crime, controlling access or improving security across a site.

Businesses should consider whether CCTV is necessary and proportionate for the purpose they have identified. The ICO advises organisations to consider less intrusive alternatives where appropriate and to limit the personal information collected to what is necessary for the intended purpose.

This is particularly relevant when deciding where cameras should be positioned. A camera should be installed because it serves a defined security requirement. For example, a camera covering a main entrance may be appropriate where the purpose is to monitor access. A camera positioned to capture areas that do not need to be monitored could create unnecessary privacy concerns.

Good CCTV design therefore considers both security and privacy from the beginning.

How long should CCTV footage be kept?

There is no single retention period that applies to every commercial CCTV system.

This is an important point because businesses sometimes assume that footage should automatically be kept for a particular number of days.

The ICO states that UK GDPR and the Data Protection Act 2018 do not prescribe a specific minimum or maximum retention period for surveillance systems. Instead, the purpose of the processing should determine how long information needs to be retained. The organisation should use the shortest period that is necessary for that purpose.

In practical terms, a business should consider how long it reasonably needs the footage and avoid keeping it simply because the storage system allows it.

The appropriate period will depend on the circumstances. A site where incidents may not be discovered immediately could have different requirements from a smaller premises where incidents are identified quickly.

Whatever retention period is chosen, it should be considered, documented and reviewed rather than simply left at a manufacturer's default setting.

There may also be circumstances where particular footage needs to be retained for longer, such as when it is relevant to an active investigation.

Who should have access to CCTV footage?

CCTV footage should not be freely available to everyone within a business.

Access should be limited to people who need it for a legitimate reason, with appropriate controls in place to protect the information.

This becomes increasingly important as commercial CCTV systems become more sophisticated.  Modern systems may allow footage to be accessed from control rooms, computers, mobile devices or remotely through secure networks.

The convenience of being able to access CCTV from different locations also creates a responsibility to control who can view, export or otherwise handle recordings.

The ICO advises organisations to store recorded information securely and ensure appropriate technical and organisational measures are in place to protect it.

A properly designed commercial CCTV system should therefore consider not only what the cameras record, but how that information is stored, accessed and protected.

Can someone ask to see CCTV footage of themselves?

Yes. 

People have rights to access personal information held about them, which can include CCTV footage in which they are identifiable.

GOV.UK states that individuals can ask to see images recorded of them and that, in most circumstances, businesses should provide the footage within one calendar month. There are circumstances and exemptions that can affect how such requests are handled, so businesses should refer to the latest ICO guidance when dealing with an actual request.

This is another reason why a CCTV system should make footage reasonably straightforward to find and retrieve.

If a business cannot identify when and where an incident occurred, searching through large volumes of recordings can become difficult. Accurate time and date information, sensible storage arrangements and appropriate system controls can all help.

The security system therefore needs to support the business operationally as well as providing protection. 

What about recording audio?

Many modern CCTV camera have the technical ability to record sound. That does not mean audio recording should automatically be enabled.

The ICO considers audio recording to be more intrusive than visual surveillance and says it will usually require stronger justification. Its guidance recommends that audio capabilities are switched off by default unless there is a specific and evidenced need for them.

For many commercial environments, the security requirement can be met through video alone.

If audio is being considered, the business should assess why it is needed, whether there are less intrusive alternatives and how people will be informed that audio is being recorded.

This is a good example of why selecting a camera based purely on its technical specification can create unnecessary complications. A feature being available does not mean it needs to be used.

What about CCTV in areas where employees work?

Workplace CCTV needs particular consideration because employees may be monitored as part of their normal working environment.

A system installed to protect a building or investigate security incidents should not automatically become a tool for employee performance.

GOV.UK specifically notes that CCTV should be used for the purpose it was intended for. For example, if a system was installed to detect crime, it should not simply be used to monitor how much work employees are doing.

The location of cameras is also important. CCTV should be carefully considered in areas where people would reasonably expect privacy, such as toilets and changing rooms. The ICO advises organisations to consider whether surveillance is appropriate and proportionate in the circumstances.

The principle is straightforward: security requirements should be balanced with people's reasonable expectations of privacy.

Does a business need to register with the ICO?

Businesses using CCTV that processes personal data may need to register with the ICO and pay a data protection fee, unless an exemption applies.

GOV.UK states that businesses using CCTV must register with the ICO and pay the relevant data protection fee unless they are exempt.

The ICO also provides guidance on the responsibilities of organisations using surveillance systems and the circumstances in which registration and the data protection fee apply.

Because exemptions and requirements can depend on the circumstances, businesses should check their current position directly with the ICO rather than relying on a general rule.

What does this mean when installing a commercial CCTV system?

The legal and data protection consideration should be part of the CCTV design from the beginning.

That means understanding why the system is being installed, deciding which areas genuinely need to be monitored, considering privacy, providing appropriate information to people being recorded and ensuring footage can be stored, protected and retrieved properly.

It also means considering the system's capabilities before installation.

For example, if a camera can record audio, that does not necessarily mean audio should be enabled. If a camera can monitor a much wider area than required, its position may need to be considered carefully. If footage can be accessed remotely, appropriate controls need to be in place.

Good CCTV design therefore considers how the system will operate and how the information it produces will be managed.

The physical design of the system can also help support these responsibilities. Camera positioning, image quality, recording settings, access permissions and storage arrangements all contribute to how effectively the system can be operated.

A practical approach to commercial CCTV

At DJ Byers, we believe good commercial CCTV starts with understanding the site, the security requirement and how the system will be used.

Our role is to design and install a CCTV solution that provides the visibility a business needs while taking into account the environment in which the system operates.

That includes considering camera positioning, coverage, recording requirements, access to footage and how CCTV can work alongside other security systems such as access control, automated entry and remote monitoring.

It is important to remember that installing a CCTV system does not, by itself, make a business compliant with data protection law. The business using the system remains responsible for how the footage is collected and managed, and requirements can depend on the circumstances.

The regulations and official guidance can also change over time. The ICO's current surveillance guidance is itself subject to review following changes introduced by the Date (Use and Access) Act. Businesses should therefore check that latest information from the ICO and GOV.UK and seek appropriate legal or data protection advice where required.

The purpose of a well-designed CCTV system is to provide useful security information while respecting the rights and privacy of the people captured by it.

When the technology, site requirements and wider responsibilities are considered together, CCTV can provide effective protection while giving the business greater control over how its security system operates.

If you are reviewing and existing commercial CCTV system or planning a new installation, the DJ Byers team can help you understand the current legal, regulatory and security requirements of your site and design a solution around them.