Can I use CCTV in my business?

Whether you run a shop, café, restaurant, salon, office or other business premises, CCTV can be a useful way to protect your staff, customers and property.

However, if your cameras capture identifiable individuals, you're likely to be processing personal data. That means the UK GDPR and Data Protection Act 2018 apply.

And there are a few things you need to get right.

Do I need permission to install CCTV?

You don't generally need permission from the ICO before installing ordinary CCTV, but you must have a lawful basis for using it.

For many private businesses, this will be legitimate interests, such as protecting premises from theft, vandalism or other crime.

However, simply saying you're using CCTV for security isn't enough.

You should consider:

Why you need the cameras.

Whether CCTV is necessary to achieve your purpose.

Whether a less intrusive alternative would work.

Which areas the cameras will capture.

How the recording might affect people's privacy.

If you're relying on legitimate interests, you should assess and document why those interests justify the processing.

Do I need CCTV signs?

Yes. People should generally be told that CCTV is operating before they enter an area being monitored.

Your signs should be clearly visible and explain:

That CCTV is in operation.

Why you're using it.

Who operates the system.

How people can contact you for more information.

A generic camera symbol isn't necessarily enough.

You should also make more detailed privacy information available, explaining how footage is used, stored and shared.

And remember, you don't need a website to provide that information.

Do I need a CCTV policy?

You should document why you're using CCTV and how your system is managed.

A CCTV policy is a practical way to do this.

It should explain who is responsible for the system, why footage is recorded, who can access it, how long it is retained and when it can be shared.

For example, if a member of staff asks to review footage because they believe somebody has stolen something, who can authorise that access?

What happens if the police request a recording?

Who makes sure footage is deleted when it's no longer needed?

These are the sorts of questions your CCTV arrangements should answer.

Do I need to register with the ICO?

Generally, yes, if your business uses CCTV that captures identifiable individuals for purposes such as crime prevention.

If you aren't already registered, you will usually need to pay the ICO's annual data protection fee, unless an exemption applies.

Being a small business doesn't automatically exempt you.

You can check your position using the ICO's data protection fee checker.

Can I use CCTV to monitor my employees?

This is where businesses need to be particularly careful.

You may have a legitimate reason to use CCTV in the workplace, such as protecting staff or preventing theft.

However, using cameras installed for security to routinely monitor employee performance is a different matter.

You need to consider whether the monitoring is necessary, proportionate and fair.

Employees should be informed about the nature and purpose of monitoring, and workplace video monitoring will require a Data Protection Impact Assessment (DPIA) where it is likely to create a high risk to individuals.

Cameras in toilets, changing rooms and other areas where people reasonably expect privacy will almost never be appropriate.

Installing CCTV for security doesn't give you unrestricted permission to watch your employees.

Can my CCTV record sound?

Just because your camera has a microphone doesn't mean you should use it.

Audio recording is generally much more intrusive than video recording.

In most ordinary business settings, continuous audio recording will be difficult to justify.

If your system records sound, you should consider whether it is genuinely necessary and whether a less intrusive option would achieve the same purpose.

Unless you have a clear, documented justification, audio recording should normally be switched off.

How long can I keep CCTV footage?

There's no universal rule that CCTV footage must be deleted after 14 or 30 days.

Your retention period should depend on why you're recording it and how long you genuinely need it.

For example, a business recording footage to investigate security incidents might decide that a relatively short retention period is sufficient.

You should document your chosen period, explain why it's appropriate and ensure footage is routinely deleted when no longer required.

Keeping recordings indefinitely, or simply because your system has plenty of storage, isn't an appropriate approach.

You may sometimes need to preserve particular footage for longer, such as when it's relevant to an ongoing investigation.

Can someone ask to see CCTV footage of themselves?

Yes.

CCTV recordings can contain personal data, and individuals may have the right to request footage showing them.

This is called a Subject Access Request (SAR).

You may need to locate the relevant recording and provide the individual's personal data, subject to applicable exemptions and the rights of other people captured.

For example, footage might show other customers or employees. You may need to blur or otherwise protect their identities before disclosing it.

Your CCTV system should allow you to retrieve footage when required.

What if my CCTV is already installed?

It's not too late to review your arrangements.

Start by checking:

Whether your cameras are necessary and appropriately positioned.

Whether you have clear signage and privacy information.

Whether you need to pay the ICO data protection fee.

Whether you have documented your CCTV purposes, lawful basis and procedures.

Whether access to footage is restricted and recordings are deleted appropriately.

You should also consider whether a DPIA is required, particularly if you're monitoring employees or using more intrusive technology.

How Novo can help

At Novo Data Services, we help small businesses get their CCTV data protection arrangements in order without unnecessary complexity.

Our CCTV Compliance Pack (£149 + VAT) is designed to help businesses put the essential documentation in place.

It includes CCTV signage, a CCTV policy and practical guidance on your responsibilities, including ICO registration.

The ICO data protection fee, where applicable, is payable separately.

Find out more about Novo's CCTV Compliance Pack

Making data protection feel simple.