CCTV is legal. Getting the compliance side wrong is the actual risk.
Installing CCTV isn’t the hard part. Running it in a way that stays compliant with UK data protection law — quietly, in the background, for years — is where businesses actually trip up.
The legal framework, briefly
The Data Protection Act 2018 is the primary UK law governing how CCTV footage is processed. The Surveillance Camera Code of Practice, issued under the Protection of Freedoms Act 2012, applies directly to police and local authorities but the ICO expects all organisations to follow it as best practice. A 2025 update (the Data (Use and Access) Act) amended rather than replaced UK GDPR and the DPA 2018 — the practical CCTV-relevant change is a “stop the clock” rule on subject access request timelines while waiting for the requester to clarify details like date, time or camera location.
What actually needs checking, in practice
Set a clear, documented reason for using CCTV rather than “just in case.” Avoid recording more than that purpose requires. Use visible, clear signage so people know they’re being recorded. Restrict access to footage to those who genuinely need it. Keep footage secure and delete it once it’s no longer needed for the stated purpose — there’s no single fixed retention period in law, so this needs defining and documenting, not defaulting to whatever the NVR happens to store by default.
The mistake most businesses make on CCTV compliance
Most UK businesses don’t need to rip out and replace existing CCTV because of updated guidance — they need to review why it’s there, where cameras actually point, who can access footage, and whether retention periods are documented anywhere at all. That review is cheap. Getting caught without one after a subject access request or ICO complaint isn’t.
FAQ
Is CCTV legal for UK businesses?
Yes, when used for a clear, documented purpose, installed proportionately, explained through visible signage, kept secure and retained only as long as necessary.
How long can we keep CCTV footage?
There’s no single fixed legal retention period — footage should be kept only as long as necessary for the stated purpose, defined and documented by the organisation rather than left to default NVR storage settings.
What a documented CCTV policy should actually cover
A written CCTV policy does not need to be long, but it should cover a handful of specific points clearly: the stated purpose for each camera or group of cameras, who has access to live and recorded footage, how long footage is retained before it is deleted, and who to contact with a subject access request or complaint. Having this written down, even briefly, is what makes it straightforward to demonstrate compliance if the ICO or a data subject ever asks, rather than having to reconstruct the reasoning after the fact.
Reviewing the policy annually, alongside checking that camera positions, signage and access permissions still match what the policy actually says, catches the drift that happens naturally over time: a camera repositioned during a refurbishment, a member of staff who left but still technically has access to footage, a retention period nobody has actually enforced consistently. None of these are dramatic failures on their own, but together they are exactly the kind of gap an ICO complaint or audit tends to surface.
Assigning clear ownership of the policy to a named role, rather than leaving it as a general responsibility nobody specifically owns, is a small step that makes the annual review far more likely to actually happen rather than quietly slipping year after year.
Have a project in mind?
Tell us what you’re trying to fix and we’ll tell you honestly what’s realistic.
