CCTV and GDPR: Using Cameras Lawfully in Your Business

Your CCTV is covered by data protection law

If your business uses CCTV and it captures images of people who can be identified, you are processing personal data — and that means the UK GDPR and the Data Protection Act 2018 apply. If your cameras can identify a person, the UK GDPR applies — the size of your business doesn’t change that. A corner shop with one camera is in the same legal territory as a large retailer, just on a smaller scale.

(There’s a narrow exemption for purely household use, but it falls away as soon as cameras cover public space or are used for business, so don’t rely on it at work.)

The good news: complying is mostly common sense, documented properly. Here’s what matters.

Have a clear, specific purpose

Before you install anything, be able to answer one question: why? “Preventing and detecting crime” and “protecting staff and customer safety” are common, legitimate reasons. “Because it seems sensible” is not.

• Write your purpose down, and don’t drift beyond it — cameras installed for security shouldn’t quietly become a tool for monitoring how long staff take on breaks.
• Most businesses rely on legitimate interests as their lawful basis. That means balancing your need against people’s privacy and being able to show you did.
• For anything intrusive — covering a public area, monitoring staff, or systematic large-scale surveillance — you should carry out a Data Protection Impact Assessment (DPIA) first. It’s a short structured document that forces you to think through the risks.
• Audio recording is far harder to justify than video and is usually considered too intrusive for general CCTV. Turn it off unless you have a strong, specific reason.

Put up proper signs

People have a right to know they’re being filmed. Clear, visible signage is the simplest and most important step:

• Place signs where people can see them before they enter the area covered.
• Say that CCTV is in operation, who operates it, why, and how to get in touch (or where to find the full privacy information).
• Make sure the wording is legible and the signs are well positioned — not a faded A4 print tucked behind a shelf.

Your website or a notice on request should carry the fuller detail: retention, rights, and how to make a footage request.

Keep footage only as long as you need it

The UK GDPR doesn’t set a fixed retention period for CCTV — but it does require you to keep footage no longer than necessary for your purpose.

• Decide a retention period that fits your reason for filming and write it down. Many businesses land somewhere around a month, but the right figure is the one you can justify, not a number copied from someone else.
• Let recordings delete automatically once the period passes, unless a specific incident means you need to keep a clip longer (for the police or an insurer, say).
• Store footage securely — access limited to people who genuinely need it, protected against tampering and theft. Treat it like any other sensitive data.

Handling requests for footage

Anyone captured on your CCTV can ask for a copy of the footage of themselves — this is a subject access request (SAR), and it applies to video just as it does to paperwork.

• You normally have one calendar month to respond, and you can’t charge a fee in most cases.
• The person is entitled to footage of themselves, not of other people. Where others appear, you’ll usually need to blur or otherwise redact them.
• Ask for enough detail to find the footage — roughly when and where they were on camera — and remember your short retention period means people need to ask promptly.
• You can refuse a request that is manifestly unfounded or excessive, but you must be able to justify that decision.

Our guide on how to handle a subject access request walks through the process in more detail.

Point your cameras responsibly

Where you aim your cameras matters as much as why you installed them:

• Capture only what you need. Cameras that sweep across a neighbour’s garden, a public pavement or a shared car park raise real concerns and may need extra justification.
• If you can’t avoid overlooking areas beyond your property, consider privacy masking to block out those zones.
• Be especially careful about sensitive areas — you should never have cameras in places like toilets or changing rooms.

What the ICO expects

The Information Commissioner’s Office publishes clear guidance on video surveillance, and its expectations are consistent:

• A clear, documented purpose and lawful basis.
• A DPIA where the surveillance is likely to be high risk.
• Transparency through signage and privacy information.
• Sensible, justified retention and secure storage.
• A working process for responding to footage requests.
• Only collecting what’s necessary — no more intrusive than it needs to be.

Meet those points and you’re most of the way there. None of it requires expensive kit or legal jargon — just a bit of thought written down and applied consistently.

Need a hand?

CCTV usually sits alongside your wider IT and security setup — cameras, storage, access controls and backups all need to be secure. If you’d like help making sure your footage is stored safely and your paperwork stacks up, get in touch. You can also see how we approach cyber security and managed IT support for small businesses across Leeds and Yorkshire.