CCTV is legal. Getting the compliance side wrong is the actual risk.

The legal framework, briefly

The Data Protection Act 2018 is the primary UK law governing how CCTV footage is processed. The Surveillance Camera Code of Practice, issued under the Protection of Freedoms Act 2012, applies directly to police and local authorities but the ICO expects all organisations to follow it as best practice. A 2025 update (the Data (Use and Access) Act) amended rather than replaced UK GDPR and the DPA 2018 — the practical CCTV-relevant change is a “stop the clock” rule on subject access request timelines while waiting for the requester to clarify details like date, time or camera location.

What actually needs checking, in practice

Set a clear, documented reason for using CCTV rather than “just in case.” Avoid recording more than that purpose requires. Use visible, clear signage so people know they’re being recorded. Restrict access to footage to those who genuinely need it. Keep footage secure and delete it once it’s no longer needed for the stated purpose — there’s no single fixed retention period in law, so this needs defining and documenting, not defaulting to whatever the NVR happens to store by default.

The mistake most businesses make

Most UK businesses don’t need to rip out and replace existing CCTV because of updated guidance — they need to review why it’s there, where cameras actually point, who can access footage, and whether retention periods are documented anywhere at all. That review is cheap. Getting caught without one after a subject access request or ICO complaint isn’t.