1. Reconfirm why your business uses CCTV
Before installing, upgrading or expanding CCTV, your business should be able to explain the reason for using it. A general reference to “security” is a start, but a more useful statement explains the real purpose, such as deterring theft, protecting staff and visitors, monitoring access points or supporting incident investigations.
That defined purpose helps shape camera placement, retention settings, signage and access permissions. It also makes it easier to show that the system is necessary and proportionate rather than excessive.
2. Review whether camera placement is still proportionate
Cameras should be positioned to cover the areas that are genuinely needed for the stated purpose, not every possible angle just because coverage is technically available. Businesses should be especially cautious where cameras may capture neighbouring property, public areas beyond what is necessary, staff rest spaces or sensitive private areas.
Good CCTV design balances security coverage, image quality, privacy and operational practicality. For the legal fundamentals, see our guide to CCTV laws in the UK.
3. Check that CCTV signage is clear and visible
People should know when CCTV is in use. Signs should normally be visible before or as people enter monitored areas, and they should explain that CCTV is operating, why it is being used and who is responsible for the system.
A practical sign may also include a contact route for further information. Clear signage helps demonstrate transparency and reduces confusion for staff, visitors, customers and contractors.
4. Check whether your retention period is still justified
There is no single fixed retention period that applies to every UK business. Footage should be kept only for as long as necessary for the purpose it was collected, and many businesses use around 30 days as a practical working default rather than a legal rule.
Your chosen period should be justified, documented and reflected in the actual recorder or cloud platform settings. You should also know what happens when footage is exported for investigation or legal purposes. For a broader overview, see our guide to CCTV rules and regulations for UK businesses.
5. Review who can access CCTV footage
Access to live and recorded footage should be limited to authorised people who need it for a clear business reason. This is particularly important where systems allow mobile viewing, cloud access or remote administration outside the premises.
Businesses should review user accounts, password standards, access logs, export controls and leaver processes so permissions do not continue indefinitely after roles change.
6. Review remote access and system security
Modern IP CCTV systems rely on sound infrastructure as well as sound policy. Recorder security, network segmentation, firmware updates, PoE capacity, switch configuration and secure remote access all affect reliability and risk.
If your system depends on the wider network, it helps to plan the installation properly from the start. See our guidance on structured cabling for IP CCTV systems and related network infrastructure.
7. Check that staff monitoring is handled carefully
CCTV can be used in workplaces, but employers need to be careful where monitoring affects employees. Cameras should not be used in an excessive, hidden or unjustified way, and systems installed for crime prevention should not casually drift into monitoring routine staff activity or productivity.
If employees may be recorded, be clear about why CCTV is being used, where cameras are located, who can access footage, how long recordings are kept and when footage may be reviewed. Covert monitoring should only be considered in exceptional circumstances. For the underlying legal framework, see CCTV laws in the UK.
8. Make sure you have a process for subject access requests
People can ask for CCTV footage of themselves, so businesses should have a process for identifying relevant footage and responding appropriately. In practice, that means knowing who receives the request, who searches the system, how footage is exported securely and how actions are logged.
You should also be ready to protect the privacy of other people captured in the same footage, including redaction or other appropriate safeguards before disclosure where needed. See GOV.UK guidance on requesting CCTV footage and our own guide to CCTV laws in the UK.
9. Review whether audio recording is necessary
Audio recording is generally more intrusive than video-only CCTV and can be harder to justify. In most business environments, it is safer to avoid audio unless there is a strong, specific and documented reason for using it.
For most commercial systems, clear camera coverage, good image quality and secure recording matter more than conversation capture.
10. Document higher-risk use and review whether a DPIA is needed
Some CCTV use needs more than a basic common-sense review. If your system involves extensive staff monitoring, audio recording, broad public-area coverage, integrated analytics, cloud sharing or other higher-risk features, it is sensible to document the privacy impact and review whether a formal DPIA is appropriate.
Even where a full DPIA is not mandatory, a written assessment helps show that the system was designed deliberately rather than expanded without review.
11. Plan the installation around compliance and reliability
CCTV compliance is easier when the system is designed properly from the start. Businesses should think about coverage, recorder location, remote access, retention settings, handover documentation, network support and who will manage permissions before installation begins.
For practical implementation support, see our pages on CCTV rules and regulations for UK businesses, structured cabling and commercial CCTV installation.
