Start by defining why you need it
Before deciding where cameras go, it is worth being clear about what the system is actually for. This is one of the most important parts of the CCTV rules and regulations UK businesses need to think through, because each camera should have a clear purpose.
That might sound obvious, but it matters for compliance and it matters practically when someone asks you to justify a camera in a particular location.
Common reasons businesses install CCTV include protecting entrances and exits, monitoring loading bays and stock rooms, improving safety in car parks, deterring theft or vandalism, and supporting investigations after incidents. These are all legitimate purposes. What they have in common is that they are specific.
A camera pointed at the main entrance because people need to be able to identify who is coming in is a defined operational requirement. A camera pointed at a desk because someone once thought it might be useful is not. The ICO expects businesses to document why surveillance is needed in each location. Doing that exercise properly also makes it much easier to decide which cameras are necessary and which are not.
Think carefully about camera placement
The question of where cameras can go is less about whether it is physically possible to install one and more about whether it is proportionate and justified given the purpose. That is why camera placement sits at the centre of CCTV rules and regulations UK businesses need to follow.
Cameras covering entrances, exits, reception areas, car parks, warehouses, loading bays and stock rooms are generally straightforward to justify. These are areas with a clear security purpose and a reasonable expectation that some monitoring may be taking place.
Areas that need more careful consideration include meeting rooms, open plan offices where staff work throughout the day, and any space where a higher expectation of privacy exists. It is not that cameras can never be installed in these locations, but the justification needs to be clear and the need genuine.
Toilets and changing areas should be treated as off limits. There are very few circumstances under which surveillance in those spaces could ever be justified, and the ICO is explicit on this.
It is also worth thinking about what your cameras will capture incidentally. A camera covering your car park may also pick up part of a public pavement or a neighbouring property. That collateral capture should be acknowledged, minimised where possible, and documented.
Decide who can access recordings
This is one of the areas that businesses most often leave vague, and it is worth getting right before the system goes in rather than after.
Access to live footage and recorded footage should be limited to people with a clear reason to view it. That usually means a small number of named individuals, typically a security manager, a senior member of the facilities or operations team, and whoever is responsible for data protection in the organisation.
Password-protected access is the standard approach for IP CCTV systems. Where remote viewing is enabled, that access should be equally controlled.
You also need to be clear about what happens when a subject access request comes in, someone asks to see footage they appear in, or the police or an insurer requests recordings. Having a named person responsible for handling those requests, and a documented process for doing so, means you are not trying to work it out under time pressure when it actually happens.
Set a sensible footage retention period
There is no single retention period that applies to every business. The legal requirement is that footage is kept only for as long as it is needed for the purpose it was collected.
In practice, 30 days is the standard for most commercial sites. That gives enough of a window to identify and investigate incidents while keeping the retention period proportionate. Some businesses have good reasons to keep footage for longer, for example, a site that operates on a seasonal basis with extended periods of low activity. Others may find that 14 days is sufficient.
The important thing is that the retention period is defined, applied consistently, and that footage is actually deleted when the period expires rather than accumulated indefinitely.
