CCTV in the Workplace: Essential Employee Rights & UK Employer Rules 2026

In the UK, employers can use CCTV in the workplace if they have a lawful, necessary and proportionate reason, such as security, health and safety, theft prevention or protecting staff. Staff must be told that CCTV is in use, why, who can see the footage and how long it is kept. Secret (covert) recording is allowed only in exceptional cases, such as a specific investigation into suspected crime.

This article is general guidance, not legal advice. It follows the ICO’s guidance on monitoring workers, its guidance on video surveillance, UK GDPR and the Data Protection Act 2018. Both ICO pages say they are under review after the Data (Use and Access) Act 2025, so check them before you rely on a detail. If you are planning office CCTV installation, the rules below shape where the cameras go.

CCTV in the Workplace

Most workplace CCTV is ordinary and lawful: cameras on doors, car parks, stockrooms and reception. Problems start when cameras are used for something staff were not told about, or point at places where people expect privacy.

UK law tries to balance two things. A business has a right to protect its people, premises and stock. Its staff have a right to privacy and to be treated fairly. This guide sets out what each side can expect, and what an employer has to do before the cameras go up.

Why Are CCTV Cameras Used in Workplaces?

The law accepts that a business can protect its legitimate interests. For CCTV, the common ones are:

• Protecting staff from assault and harassment, for example at reception or on a shop floor.
• Deterring theft and vandalism, and giving the police and insurers evidence if something happens.
• Checking that health and safety rules are followed, for example in loading bays or near machinery.
• Controlling who comes in. Cameras at entrances are often linked to access control so a door event can be matched to a picture.

Some businesses also use cameras to see how spaces are used, such as busy areas or queues. Each of these is a separate purpose. You need to name every purpose you rely on, because footage collected for security cannot simply be reused to check how hard someone is working.

Commercial CCTV installation in an office is usually a mix: entrances, reception, stores and the car park, with no cameras over desks.

Can Employees Request Access to CCTV Footage?

Yes. Anyone filmed can ask for a copy of footage that shows them through a subject access request (SAR). It is free in most cases, and you must answer within one calendar month. A request does not have to use the words “subject access request”. It can be spoken or in an email.

Other people in the footage have rights too. You may need to blur or crop them before you release it. That is a reason to choose a system that can export a clip quickly and mask other faces.

Staff also have the right to be told about the monitoring, the right to object where you rely on legitimate interests, and in some cases the right to have footage deleted.

How Long is CCTV Footage Kept in the UK?

There is no fixed period in law. Footage must not be kept longer than you need it for its purpose. Many businesses keep it for about 30 days, then let the recorder overwrite it. Keep a clip longer only when it is needed, for example for an investigation, insurance claim, complaint, disciplinary process or legal claim.

Set the default period in your policy and on the recorder, so it happens automatically. Record who accessed footage, why, and how each request was handled.

Who Else Can Be Given Access to CCTV Footage?

The police can ask for footage where there is a lawful reason, for example to investigate a crime. Insurers, legal advisers and regulators may also have a lawful reason. Do not share footage widely or casually. Before you release it, decide whether you can justify the disclosure and whether other people in it need to be blurred.

How Long Can CCTV Data Be Retained for?

Data protection law does not set a number. It says images should not be kept longer than needed for the purpose of the system, and must be deleted once the retention period ends.

Choose a default period that suits your risks, write it in your policy and set the recorder to match. Thirty days is common. You can keep a specific clip for longer, for example while an investigation runs, but store it securely, away from routine recordings, with tight access.

How and Why Should Employers Protect Employee Rights?

Every employment contract carries an implied term of trust and confidence. Monitoring that is unreasonable or unexplained can damage that trust, and in serious cases support a claim for constructive dismissal. Getting the rules right also protects the business. Footage collected properly is far easier to rely on in an investigation or a tribunal.

What to do:

1. Carry out a DPIA before installing cameras, and again when you add, move or upgrade cameras, or add features such as face recognition. The ICO says you must do one before using video or audio to monitor workers. A DPIA sets out the problem, why CCTV is the right answer, what the risks to staff are and how you reduce them. The government publishes a DPIA template for surveillance cameras.
2. Write a CCTV policy and share it. Say what is monitored, why, where the cameras are, who sees footage, how long it is kept and how to ask for a copy.
3. Tell staff before the monitoring starts, and again when it changes.
4. Keep cameras out of private areas such as toilets and changing rooms. If there is a problem near one, a camera on the door outside, with signs, is the kind of option the ICO suggests.
5. Be careful with biometrics. Face recognition and fingerprint systems use special category data. In February 2024 the ICO ordered Serco Leisure to stop using face recognition and fingerprints to check staff attendance at 38 leisure centres, because staff were not offered a real alternative.

Do you have to display signs if you have CCTV in the workplace?

Yes. Signs are the most common way to tell people that CCTV is in use, and the ICO expects them where cameras operate, apart from justified covert monitoring. A sign should be clearly visible and readable, say who runs the system, and give contact details or point to where people can find out more.