Installing cameras is the easy part. Running a CCTV system lawfully takes a little paperwork and some good habits. This guide covers the main points that UK businesses ask about. It is a general overview rather than legal advice, so check the Information Commissioner’s Office (ICO) website for the current rules that apply to you.
Which laws apply?
If your cameras record people, you are processing personal data. That brings in the UK GDPR and the Data Protection Act 2018. In practice, that means you should be able to explain why you have the cameras, only record what you need, look after the footage and let people see it when they are entitled to.
Do I need to register with the ICO?
Most organisations that process personal data, including through CCTV, must pay an annual data protection fee to the ICO unless they are exempt. The amount depends on the size of the organisation. The ICO has a short self-assessment on its website that tells you whether you need to pay and how much. Failing to pay can lead to a penalty, so it is worth checking.
What signs do I need?
People have a right to know they are being recorded. Your signs should:
- make it clear that CCTV is in operation;
- say who is responsible for the system;
- explain why the cameras are there (for example, crime prevention and staff safety);
- give a contact point for more information;
- be placed where people see them before they enter the camera area, and be large enough to read.
How long can I keep the footage?
There is no legal minimum or maximum for commercial CCTV. The principle is that you keep it for no longer than needed. Many businesses settle on about 30 days, which is long enough to spot an incident and review it, and short enough to stay proportionate. Choose a period, write it down and let the recorder overwrite automatically.
What if someone asks for their footage?
Anyone captured on your cameras can ask for a copy of footage of themselves. This is called a subject access request. You normally have one month to respond and cannot usually charge. If other people appear in the footage you may need to blur them before releasing it. Decide in advance who in your business handles these requests and make sure your recorder can export clips easily.
Where should cameras not point?
- Toilets, changing rooms and similar private areas.
- Neighbouring homes or gardens.
- Public spaces, unless it is genuinely necessary and justified.
Recording audio is considered more intrusive than video, so it needs a strong reason and is usually best avoided.
Good practice that makes compliance easy
- Write down why you have each camera and what it covers.
- Carry out a short impact assessment before installing or making big changes.
- Limit who can view and export footage, and use strong passwords.
- Keep the recorder in a secure place and keep the software up to date.
- Review your system once a year to check it is still needed and still positioned correctly.
A properly designed system makes all of this simpler, because the cameras are placed with a clear purpose from day one. Read our guide to what business CCTV costs, or speak to us about a compliant CCTV installation for your premises.
Frequently asked questions
How long can a business keep CCTV footage?
There is no fixed legal period. You should keep footage no longer than you need for the purpose it was recorded for. Many businesses choose around 30 days, then set the system to overwrite automatically.
Do I have to put up CCTV signs?
Yes. People should be told that CCTV is operating before they enter the area, who is responsible for it and how to contact them. Signs need to be clear and readable at the point of entry.
Can staff ask to see CCTV of themselves?
Yes. Anyone recorded can make a subject access request. You normally have one month to respond and may need to blur other people in the footage.