The rules for CCTV for businesses in the UK – what are the requirements?

Looking for commercial CCTV? Get a free quote today

Clearway is a leader in CCTV installation, serving businesses all over the United Kingdom. If you’re looking for CCTV for your business, get a quote from Clearway today.

Get a CCTV quote

First name*

Last name*

Email address*

Contact number

Please summarise your enquiry*

Send

This field should be left blank

CCTV is a crucial asset in commercial security. It has multiple applications across many different business sectors from deterring break-ins to capturing high definition footage of suspicious activity. However, company managers do have a responsibility to adhere to UK laws around how they use CCTV.

There are several CCTV rules and regulations in the UK, from informing staff about live video recording to deciding how to store and use data collected.

Key Takeaways

• Businesses can use CCTV in the UK, as long as it’s lawful, necessary, and handled securely.
• You must be transparent, with clear signage and a defined purpose for recording.
• Access to footage must be restricted to authorised people, and sharing has to be controlled. People can request footage of themselves via a Subject Access Request, and you usually need to respond within one month.

The Rules of Commercial CCTV Usage

Let’s run through the essential laws for UK CCTV, what they mean for your commercial CCTV, and how to ensure you remain compliant.

What data protection laws should I follow for CCTV?

We’re all likely aware of UK GDPR and the Data Protection Act 1998, and how businesses must inform people about the data we collect about them, how it is processed, where it is stored, and for what purposes.

Imagery and information about people’s movements captured through CCTV are considered personal data if identified as relevant to a named individual. Therefore, it is vital to clarify whether you are filming the workforce, or whether your CCTV is only activated outside of working hours. For example, if you have CCTV in your car park and are capturing details about private number plates, this might be considered personal data.

To ensure you use your CCTV responsibly, you must inform relevant personnel when your CCTV is live and if you will record their movements. Likewise, people have the right to request access to information that identifies them and request it be destroyed. The right to know if you are being filmed at work is a requirement of the Human Rights Act 1998.

What are the CCTV Filming Rules I need to know?

In a nutshell, you cannot secretly film people. If you have a CCTV system, it makes sense to erect signage in key positions, to harness the potential of surveillance as a criminal deterrent. Such signage is also a lawful requirement. Visitors, passers-by, authorised pedestrians, and workforce members must be aware if live CCTV recording is taking place. You may not record private conversations unless in exceptional circumstances, and must not install CCTV in inappropriate places, such as in a restroom.

Can I Share CCTV Footage?

There needs to be a named individual responsible for the management of any CCTV footage you collect. That could be a member of your security team, a manager, or a business owner. You need to register this person as your nominated Data Controller with the Information Commissioner’s Office.

It is important to select somebody with the appropriate level of authority, and ensure this is not a team member who should not have access to information about staff movements. For instance, a junior staff member would not be considered suitably authorised to make data capture decisions. CCTV operators may not share any footage that identifies individuals on any form of public media.

Footage should only be transferred if requested by the police, and in that scenario, the imagery remains subject to the rules of the Data Protection Act. You should safely store it without allowing access to any unauthorised viewers.

Can I Capture Footage of Other Properties?

In most cases, CCTV only ever captures movements on your own premises. However, in some cases, a camera might pan out to capture a triggered sensor or focus on a neighbouring property or piece of land. Should this occur, or be possible, you need to make sure you are compliant with data protection rules.

That means making sure neighbouring businesses know that CCTV is in operation, having visible signs around the areas under surveillance, and ensuring that your cameras do not surreptitiously or intentionally capture any imagery outside of the purposes of your CCTV as set out in your policy.

What about DPA Compliance for CCTV?

Remaining compliant with the Data Protection Act is vital for the lawful, ongoing use of CCTV. The key measures are to erect signs to inform any people accessing your site, or neighbouring properties, that you have live CCTV recording facilities.  You should also open a dialogue with any nearby businesses or properties to explain when your CCTV is in operation, the scope of the surveillance, and how data captured is stored, managed and processed.

How Long Can CCTV Footage Be Kept For In The UK?

There are no specific rules about how long you can retain CCTV footage since this depends on what footage you have captured, and for what purpose.

• Generally, 30 or 31 days is seen as the recommended standard.
• Suppose you have captured an incident that requires investigation or reporting to the authorities. In that case, you should keep this for at least 14 days to give sufficient time for the police or another service to review the footage.
• You should set out how long your video footage is stored for in a company policy, in line with your surveillance reasons.
• In general, you should always expect to store footage for no longer than six months unless in specific circumstances, such as a more extended investigation.

During any period of storage, you still need to be mindful about protecting the privacy of any individuals captured in that footage. It must not be shared, uploaded to any public networks, or disseminated in any format unless required for appropriate action to be taken. Your appointed Data Controller must implement sufficient security measures to keep video captures free from tampering and only accessible to suitably authorised personnel.

Who can view CCTV footage in the UK?

In the UK, access to CCTV footage is strictly regulated to protect privacy and comply with data protection laws such as the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Here’s who can view CCTV footage at work and under what circumstances:

1. CCTV Owners

• Private CCTV Owners (e.g., businesses, organisations, or individuals with CCTV installed on their property) can view the footage for legitimate purposes such as:
  • Monitoring property security.
  • Investigating incidents such as theft or vandalism.
  • Supporting legal proceedings.

Note: CCTV owners must ensure that footage is only used for its intended purpose, as specified when the system was installed.

2. Data Subjects (Individuals Recorded by the CCTV)

• Anyone who has been captured on CCTV footage has the right to request access to the footage where they are identifiable. This is called a Subject Access Request (SAR) under the UK GDPR.
  • The request must include the date, time, and location of the recording.
  • The CCTV owner has one month to respond.
  • The requester may not see footage of other identifiable individuals unless it’s blurred or consent has been obtained from those individuals.

3. Law Enforcement and Authorities

• Police and Security Services can request access to CCTV footage for criminal investigations or public safety concerns.
  • CCTV owners are obligated to cooperate with law enforcement and may provide footage without the recorded individual’s consent if required for crime prevention or detection.

4. Employees (in Workplace CCTV Systems)

• If CCTV is installed in a workplace, employees may request to view footage involving them, especially if they suspect misuse or monitoring outside of agreed policies.
• Employers must inform employees about the CCTV system (via signage and policies) and its purpose, such as for security or health and safety.

5. Legal Representatives

Lawyers acting on behalf of clients involved in disputes or claims may request CCTV footage. This often applies in cases of:

• • Workplace incidents.
  • Personal injury claims.
  • Insurance disputes.

6. Insurance Companies

• Insurers may request footage following an incident (e.g., a car accident or property damage) as part of their investigation.

7. The Public (Limited Circumstances)

• CCTV footage is not typically available to the general public.
• However, if an incident occurs in a public space (e.g., a shopping centre), individuals can request footage from the relevant authority or business for personal use or to assist with a police investigation.

Key Rules for CCTV Owners

• Inform individuals they are being recorded: Clear signage must be displayed where CCTV is in operation.
• Limit access: Only authorised personnel should view footage.
• Store securely: Footage must be stored safely and only retained for as long as necessary.
• Comply with data protection laws: Improper use or disclosure of CCTV footage can lead to legal penalties.

Who Cannot View CCTV Footage?

Random third parties or the general public cannot access footage unless it is legally justified or anonymised (e.g., for public interest broadcasting or crime appeals).

If you believe your footage is being misused or accessed unlawfully, you can report the issue to the Information Commissioner’s Office (ICO).

The Safe Usage of CCTV in the Workplace

While it might feel that there are lots of rules and regulations around CCTV usage, in reality, these measures are all simple to achieve with clear oversight about what your CCTV system is intended to capture, and why. Installing signage, informing staff about when and how CCTV is in operation, and implementing a company policy covering your surveillance strategies is essential. If in any doubt about your data protection obligations, you can access more information from the ICO explaining the role of a Data Controller, and how to ensure you get the maximum benefit from your CCTV while being mindful of information security. For more help with the safe installation of CCTV, get in touch with the Clearway security team for independent advice about the ideal solutions to protect your business.

FAQs

Is it illegal to share CCTV footage in the UK?

Sharing CCTV footage in the UK is regulated under the UK GDPR and the Data Protection Act 2018. If the footage identifies individuals, it is considered personal data and must be handled lawfully. Generally, businesses and organisations should not share CCTV footage unless there is a legitimate reason, such as a legal request from law enforcement or for security purposes. Unauthorised sharing could lead to legal consequences, including fines from the Information Commissioner’s Office (ICO).

Can you post CCTV footage on social media in the UK?

Posting CCTV footage on social media can be risky and may breach data protection laws if it includes identifiable individuals. Businesses and organisations must have a lawful basis for sharing footage, such as public interest or crime prevention. Private individuals who capture footage on their own property may have more leeway, but they should still consider privacy rights. If the footage involves a crime, it is advisable to report it to the police rather than sharing it online.

Can I give CCTV footage to someone outside of work?

CCTV footage recorded in a workplace is usually controlled by the employer and falls under data protection regulations. Employees should not share footage without authorisation from the data controller (usually the employer or security provider). If there is a legitimate request—such as from the police or a legal authority—proper procedures must be followed. Giving CCTV footage to an unauthorised third party could result in disciplinary action or legal consequences.

Can I request CCTV footage of someone else?

Generally, no. Under UK GDPR, you can only request CCTV footage that includes you and where you are clearly identifiable. If other people appear in the footage, the CCTV owner must blur or mask them before releasing it, unless those individuals give consent. Footage showing only someone else will not normally be released for privacy reasons.

Can I request CCTV footage of an accident?

Yes, if you were involved in the accident or appear in the footage. You can request it through a Subject Access Request (SAR) by providing the date, time and location. If other identifiable individuals are in the footage, they may need to be blurred. If the matter is under police investigation, the police may request the footage directly.

Can you request CCTV footage from a car park?

Yes. You can request footage that includes you or your vehicle by submitting a SAR to the car park operator. You will usually need the date, time, location and your vehicle registration. If you are not in the footage yourself, or if others are clearly identifiable, the operator may refuse or provide blurred footage in line with UK GDPR.

Obtaining CCTV footage for an insurance claim

Yes, it is common to request CCTV footage for insurance claims involving accidents, theft, injuries or property damage. You can request the footage yourself, or your insurer can request it with your consent. Make the request quickly, as many systems overwrite footage within days or weeks. Footage may be edited to blur individuals not involved in your claim.

Related Reading:

• The history of CCTV in the UK 
• How much does CCTV cost? 
• Why is CCTV important for business?
• How long should I keep CCTV footage for?