Is Your CCTV GDPR Compliant? A Guide for Businesses

CCTV helps businesses protect premises, investigate incidents and improve security. However, when cameras capture identifiable people, the images are personal data. This brings responsibilities under the UK GDPR and the Data Protection Act 2018.

CCTV GDPR compliance involves how your system is configured, operated and managed. Camera coverage, signage, access permissions and footage retention all need consideration.

Understanding GDPR and CCTV requirements helps you protect your premises while respecting the privacy of employees, customers and visitors. Here are the main areas your business should review.

Understanding GDPR and CCTV: Does Your System Need to Comply?

Data protection law will generally apply when business CCTV captures identifiable people. This includes employees, customers, delivery drivers and passers-by. Live viewing can also involve processing personal data, even without recording.

The organisation deciding why and how surveillance is used is normally the data controller. Appointing an installer or monitoring provider does not remove its responsibilities.

Assign someone responsibility for the system and document its purpose. Monitoring a stockroom entrance to investigate theft, for example, provides a clearer justification than a general statement about security.

GDPR CCTV Rules: What Businesses Need to Check

The GDPR rules for CCTV require a lawful, fair and transparent approach to surveillance. Businesses must collect only the information they need, protect it appropriately and avoid retaining it for longer than necessary.

These principles should guide both the technical setup and your day-to-day procedures.

Establish a Lawful Basis for CCTV

Identify an appropriate lawful basis before using CCTV to process personal data. Legitimate interests may be suitable for many private businesses, but this requires a documented assessment.

Consider:

• What specific problem does the surveillance address?
• Is CCTV necessary, or could a less intrusive measure work?
• How will recording affect people’s privacy?
• What safeguards will reduce that impact?

Consent is often unsuitable for routine surveillance, particularly where people have little meaningful choice about being recorded. A CCTV sign informs people about monitoring; it does not automatically establish their consent.

GDPR and CCTV in Public Places

Recording a publicly accessible area does not remove your data protection responsibilities. Shops, reception areas and customer car parks can all capture identifiable members of the public.

Keep coverage proportionate to your security purpose. Check whether cameras unnecessarily record neighbouring properties, private gardens or unrelated areas of the street. Adjust camera angles or use privacy masking where appropriate.

Large-scale systematic monitoring of publicly accessible areas requires a data protection impact assessment. Assess privacy risks before deployment rather than waiting until someone raises a concern.

GDPR and CCTV at Work

Workplace CCTV needs a clear purpose and careful consideration of employees’ privacy. Explain where cameras operate, why monitoring is necessary and how footage will be used.

Cameras installed for security should not automatically be repurposed to monitor productivity. Any proposed change requires a fresh assessment of lawfulness, fairness and transparency.

Avoid surveillance in areas where people reasonably expect a high degree of privacy, such as toilets and changing rooms. Audio recording is particularly intrusive and needs separate justification. Leave microphones disabled unless their use is necessary and lawful.

What Should GDPR Compliant CCTV Signage Include?

Clear signage helps people understand that surveillance is taking place before they enter the monitored area.

To support GDPR compliance, CCTV signage should communicate:

• That CCTV is operating
• The purpose of the surveillance
• Who is responsible for the system
• Contact details where these are not otherwise obvious
• Where further privacy information is available

Support signage with an accessible CCTV privacy notice explaining matters such as retention, sharing and individuals’ rights. Signs alone do not make a system compliant.

Check that notices remain visible and readable when entrances, layouts or camera positions change.

How Long Can You Keep CCTV Footage Under GDPR?

There is no universal GDPR rule requiring CCTV footage to be kept for 30 days. Your retention period must reflect the purpose of recording and the time genuinely needed to fulfil it.

Choose the shortest suitable period, document your reasoning and configure deletion or overwriting accordingly. Storage capacity and manufacturer defaults should not determine how long footage is kept.

Recordings connected to a specific incident may need preserving for longer. Document the reason and review whether continued retention remains necessary.

The guidance on CCTV footage retention explains this purpose-based approach.

Protect CCTV Footage and Restrict Access

Under GDPR, CCTV footage containing personal data needs appropriate protection against unauthorised access, loss and disclosure.

Practical safeguards include:

• Individual accounts with permissions matched to each role
• Strong passwords and multi-factor authentication where available
• Removing access when staff leave or change responsibilities
• Keeping equipment and software appropriately updated
• Securing recording equipment against physical access
• Controlling downloads, exports and remote viewing

Where a provider processes recordings on your behalf, establish the required contractual arrangements. Cloud services also require consideration of storage locations and any applicable international transfer requirements.

Prepare for Requests to Access CCTV Footage

Individuals can request access to CCTV footage containing their personal data. Your business needs a process for recognising requests, locating recordings and responding within the applicable statutory timeframe.

Preserve relevant footage against routine deletion while handling the request. Before disclosure, consider whether other people’s identities need to be obscured.

Sharing recordings with police or other third parties also requires a justified, documented approach. Do not assume that footage can be published online simply because it shows a suspected incident.

Review CCTV GDPR Compliance Regularly

Review your arrangements when cameras, premises, users or recording purposes change. Keep your policies and staff procedures aligned with how the system actually operates.

Check whether your organisation must pay the ICO data protection fee. Businesses using CCTV to process personal data generally need to pay unless exempt.

Assess whether a data protection impact assessment is required before deployment or significant changes. The CCTV accountability guidance explains these responsibilities.

Discuss Your Business CCTV With Advance Fire & Security

Advance Fire & Security provides commercial CCTV solutions for businesses looking to install or improve their surveillance systems.

Appropriate camera positioning, recording settings and access controls can support CCTV GDPR compliance. These technical measures need to work alongside your organisation’s lawful decisions, privacy information and footage-handling procedures.

Contact BDi Advance Fire & Security to discuss your CCTV requirements.