Estimated Reading Time: 13 minute(s)

CCTV laws UK businesses need to follow are more straightforward than most people expect, but they do need to be understood before cameras go in. Most businesses installing commercial CCTV know the basics. What is less well understood is the legal framework behind it and what the ICO now expects from businesses operating surveillance systems.

CCTV that records identifiable people is collecting personal data. That brings it under UK GDPR and the Data Protection Act 2018, regardless of how many cameras you have, how small your business is or how routine the installation seems. This guide explains the key legislation, what it means in practice, and where businesses most commonly get it wrong.

If you are specifically looking for a pre-installation checklist, our guide to CCTV rules and regulations for businesses covers the practical steps before cameras go in.

What CCTV Laws UK Businesses Need to Follow

The legal framework for business CCTV sits across four pieces of legislation that work together rather than in isolation.

The Data Protection Act 2018 and UK GDPR are the primary framework. They govern how personal data, including footage of identifiable individuals, must be collected, stored, accessed and deleted. Businesses operating CCTV are classed as data controllers and carry the full responsibilities that brings, including the obligation to document their purposes, manage access to footage, respond to subject access requests and delete recordings when they are no longer needed.

The Protection of Freedoms Act 2012 introduced the Surveillance Camera Code of Practice and established the Surveillance Camera Commissioner. The code sets out twelve principles for organisations using surveillance systems. It is not a legal act in itself, but the ICO treats it as the standard against which commercial CCTV should be measured, and compliance with it is the clearest way to demonstrate that a system is lawful and proportionate.

The Human Rights Act 1998 underpins the right to privacy that all CCTV legislation is designed to protect. It is the reason proportionality sits at the centre of every compliance decision, from deciding where to position cameras and how long to keep footage, to whether monitoring in a specific area can be justified at all.

0333 900 0101 sales@network-data-cabling.co.uk Contact us

Who does this apply to?

Any business using CCTV that records identifiable people is covered. There is no minimum size, no turnover threshold and no sector exemption. The only systems that fall outside these requirements are purely domestic CCTV that stays entirely within the boundaries of a private home and captures no public space or neighbouring property.

If your cameras cover a shared car park, a public pavement, a communal entrance or any area beyond your own property boundary, the full requirements apply.

What the ICO expects from businesses

The Information Commissioner’s Office enforcement focus is consistent. Understanding where businesses are most commonly found non-compliant is the most useful starting point.

Lack of documented purpose is the most frequent issue. The ICO requires that every camera has a defined operational reason. A camera covering the main entrance to monitor who is entering the building is a documented purpose. A camera pointing at a staff work area because it seemed useful at the time is not. Businesses should be able to justify each camera in writing before installation.

Inadequate signage remains a persistent problem. Signs must be clearly visible before a person enters a surveilled area. They should confirm that CCTV is in operation and identify who is responsible for the system. Signs that are missing, too small or poorly positioned are a straightforward compliance failure with no mitigation.

Excessive footage retention is a regular enforcement trigger. The requirement under UK GDPR is that footage is kept only for as long as it is needed for the purpose it was collected. Footage that accumulates indefinitely because automatic deletion has not been set up is both a compliance failure and a data security risk.

Uncontrolled access to recordings is increasingly scrutinised. Who can view live feeds, who can export footage, how remote access is managed and what happens when police or insurers request recordings should all be defined and documented before the system goes live.

Failure to complete a Data Protection Impact Assessment where one is required. Where CCTV is likely to have a significant privacy impact, particularly where staff are monitored in working areas, a DPIA is required under UK GDPR before installation. It cannot be completed after the fact to satisfy an investigation.

Staff monitoring and CCTV

Using CCTV to monitor employees is one of the areas where businesses most frequently overstep.

Security CCTV covering entrances, exits, warehouses, loading bays, stock rooms and common areas is generally straightforward to justify. Using those same cameras to track staff behaviour, monitor productivity or record individuals without clear justification is a different matter and requires a much stronger documented purpose.

The starting point is transparency. Staff should be told that CCTV is in use, where cameras are located, why they are there and what the footage may be used for. That communication should happen before the system goes live, not as an afterthought once cameras are already installed.

Where CCTV is likely to have a significant impact on staff privacy, a Data Protection Impact Assessment is required. Covert monitoring is possible in very limited circumstances, such as where there is a specific and genuine suspicion of serious wrongdoing, but it carries significant legal risk and should only be considered with proper legal advice.

Signage requirements

CCTV signage is a legal requirement. Signs must be in place before a person enters a surveilled area. They should confirm that CCTV is in operation, explain who is responsible for the system and provide a way to find out more.

The Information Commissioner’s Office does not prescribe a specific format, but signs should be clearly visible, readable at the point of entry into the surveilled space, and not obscured or positioned where they are unlikely to be noticed.

Footage retention

There is no legally mandated retention period for commercial CCTV in the UK. The requirement is that footage is kept for no longer than is necessary for the purpose it was collected.

For most commercial sites, 30 days is the working standard. It gives enough of a window to identify and investigate incidents without retaining footage that serves no ongoing purpose. Some businesses have good reasons to keep footage for longer, such as sites that are unoccupied for extended periods. Others will find a shorter period is appropriate.

A retention period should be set, applied automatically and reviewed periodically to confirm it remains proportionate.

Subject access requests

Anyone recorded on your CCTV has the right to request a copy of footage featuring them under UK GDPR. Businesses must respond within one month at no cost to the person requesting it.

In practice this means having a named person responsible for handling requests, a process for locating and exporting the relevant footage, and a way to manage situations where the footage also contains images of third parties. In those cases, footage of other individuals will typically need to be redacted before release.

Registering with the ICO

Most businesses operating CCTV must register with the ICO as a data controller and pay the annual data protection fee. Fees start at £40 per year for small organisations and £60 for medium and large organisations. Failure to register when required is a criminal offence.

0333 900 0101 sales@network-data-cabling.co.uk Contact us

Documentation and audit trails

Demonstrating compliance over time is nearly impossible without a basic set of internal documentation. For smaller businesses this does not need to be complex. At a minimum it should include a record of the purpose for each camera, who is responsible for the system, what the retention period is, how access is controlled and how subject access requests are handled.

Larger businesses with more cameras, more staff or higher-risk environments will typically need more. This includes an initial Data Protection Impact Assessment, an internal CCTV policy document that staff can access, and periodic reviews of whether the system remains proportionate and fit for purpose. Where CCTV is part of a wider IP security infrastructure covering access control and intercoms, that documentation should reflect the whole system rather than treating each element in isolation.

Maintaining this documentation is not just a compliance exercise. It is also the most effective way to demonstrate to the ICO, to insurers and to staff that the system is being managed responsibly.

What happens if you get it wrong

Non-compliance with UK GDPR carries serious consequences. For the most serious breaches the ICO can issue fines of up to £17.5 million or four percent of global annual turnover, whichever is higher. For smaller infractions the fines are lower but still significant, and the ICO publishes enforcement notices publicly, which means reputational damage often outlasts the financial penalty.

Beyond ICO enforcement, businesses that handle footage carelessly can face civil claims from individuals whose data has been misused, as well as strained relationships with staff and neighbouring businesses. The most common enforcement actions arise not from deliberate wrongdoing but from systems that were never properly set up in the first place, no documented purpose, no retention policy, no access controls, no signage.

Getting it right at the point of installation is significantly easier and less costly than correcting it after a complaint has been made.

What a compliant installation looks like in practice

A professionally installed commercial CCTV system is not just about camera positions and recording equipment. From day one it should be accompanied by a documented operational purpose for each camera, a defined and automatically applied retention period, a clear access policy covering who can view live footage and who can export recordings, appropriate signage at every entry point to a surveilled area, and a Data Protection Impact Assessment where one is required.

These are not administrative extras. They are the difference between a system that is genuinely compliant and one that is simply installed. A good commercial CCTV installer should help you think through all of these questions before a single camera goes up, not leave them for you to work out afterwards.

If you are reviewing an older system or checking whether your CCTV setup is still appropriate this year, read our UK CCTV compliance 2026 guide.

How CCTV connects to your wider security infrastructure

CCTV rarely operates in isolation. On most commercial sites it sits alongside access control systems, entry phones, data cabling and network infrastructure. IP CCTV systems run over your data network, which means cabling and switching infrastructure needs to support them before cameras are positioned or recording equipment is specified.

Planning CCTV alongside access control and entry phones from the outset is significantly more efficient than treating them as separate projects. It reduces disruption, avoids duplicate cable runs and ensures the whole system is designed to work together properly from day one.

A free site survey before installation gives you an accurate picture of what your building can support, where cameras can realistically be positioned, and how the system can be documented to meet ICO requirements from the start.

Planning a commercial CCTV installation?

We can survey your site, advise on camera placement and compliance, and install a system that meets ICO requirements and integrates with your access control and network infrastructure.

Book a free site survey

0333 900 0101 sales@network-data-cabling.co.uk Contact us

FAQs

Q. What CCTV laws UK businesses need to comply with?

A. Business CCTV in the UK is governed primarily by UK GDPR and the Data Protection Act 2018, which cover how personal data including footage of identifiable people must be collected, stored and managed. The Protection of Freedoms Act 2012 introduced the Surveillance Camera Code of Practice, which sets out the principles organisations should follow when operating surveillance systems. The Human Rights Act 1998 underpins the right to privacy that all of this legislation is designed to protect.

Q. Do small businesses need to comply with UK CCTV laws?

A. Yes. There is no size threshold or exemption. Any business whose CCTV records identifiable people is collecting personal data and must comply with UK GDPR and the Data Protection Act 2018. The full requirements apply regardless of how many cameras you have or how straightforward the installation is.

Q. Do businesses need to register with the ICO for CCTV?

A. Most businesses operating CCTV will need to register with the Information Commissioner’s Office as a data controller and pay the annual data protection fee. Fees start at £40 per year for small organisations. Failing to register when required is a criminal offence. You can check whether registration applies to your business on the ICO website.

Q. Can an employer use CCTV to monitor staff at work?

A. Yes, but it needs to be handled carefully and the purpose must be clearly justified. CCTV used for security, covering entrances, exits and secure areas, is generally straightforward. Using cameras to monitor staff behaviour or productivity requires a much stronger documented reason. Employees must be told that CCTV is in use, where cameras are located and what the footage may be used for, before the system goes live. Where monitoring is likely to have a significant privacy impact, a Data Protection Impact Assessment is required under UK GDPR.

Q. How long can a business keep CCTV footage?

A. There is no fixed legal retention period for commercial CCTV in the UK. The requirement under UK GDPR is that footage is kept only for as long as it is needed for the purpose it was collected. For most businesses 30 days is the standard, but the key point is that a retention period should be defined, applied automatically and reviewed regularly. Footage should not accumulate indefinitely.

Q. What are the consequences of not complying with UK CCTV laws?

A. The ICO can issue fines of up to £17.5 million or four percent of global annual turnover for serious breaches of UK GDPR. Enforcement notices are published publicly, which means reputational damage often follows financial penalties. Businesses can also face civil claims from individuals whose data has been mishandled. The most common enforcement actions arise from systems that were never properly set up, with no documented purpose, no retention policy and no access controls in place.

Q. What is a Data Protection Impact Assessment and when is it needed for CCTV?

A. A Data Protection Impact Assessment is a documented process that identifies and assesses the privacy risks of a surveillance system before it goes live. Under UK GDPR it is required where CCTV is likely to have a significant impact on the privacy of individuals, particularly where staff are monitored in working areas or where cameras cover sensitive spaces. It cannot be completed retrospectively to satisfy an ICO investigation and should be in place before installation begins.

Get in touch today

Have a no-obligation chat with one of our data cabling experts, who can recommend a solution to suit your requirements and budget.

0333 900 0101 sales@network-data-cabling.co.uk Contact us

Active Communication Company Ltd, trading as ACCL · Commercial data cabling and network infrastructure specialists