CCTV Laws Explained – What You Can and Can’t Do

This article about CCTV may surprise you.

Why?

Because when it comes to the legal requirements and laws surrounding CCTV for commercial use, there are more restrictions and rules than you may realise.

Many more, in fact.

Indeed, without the right CCTV policies, procedures and strict compliance, you could find yourself on the wrong side of the law through infringement of the privacy laws that protect the rights of individuals.

So, this article – free of jargon or legalese, lays everything on the line. What you need to do, and what is verboten.

Before We Start

As experts in CCTV, Clearway will offer solid, legally compliant advice when you engage our services. Working with us is straightforward, and we’ll give you all the information you need to implement lawful CCTV processes. 

The Government Has Decreed…

The massive adoption of CCTV in the mid-1990s led the government to get more actively involved in regulating video surveillance. In the UK, there was a thin line between legitimate CCTV scrutiny and what could easily have been a gross invasion of people’s privacy.

Article 8 of the Human Rights Act (1998) is a broad piece of legislation, but it also clamps down hard on privacy issues – which extend to public spaces and the workplace.

Also, any CCTV – whether for your home or your property – is included under the Data Protection Act (DPA) and the Information Commissioner’s Office (ICO).

There are slightly different regulations concerning domestic versus commercial premises (we’ll highlight them briefly), but in a nutshell, protecting your building site, land for future development, offices, warehouse or factory with CCTV is more tightly governed than for a residential property.

Doing Everything Right – The First Time

Ignorance of the law is no defence.

Operators of CCTV can’t claim not to know what they didn’t know. In fact, to be specific, “If one is ignorant of the existence of a law, such ignorance is an insufficient basis for a person to contend that they believed that they had not contravened the law.” Powerful stuff. Equally, it’s impossible to try to ignore these conventions or save time by skirting around them. The ICO is a hard taskmaster: breaching these laws could be costly, with fines of up to £500,000. Or even criminal charges.

From a business point of view, if you install a CCTV system without notifying your staff, you could or perhaps should anticipate a massive drop in employee trust – with catastrophic results for your company.

So, now that we’ve scared the living daylights out of you, what exactly are the rules?

Domestic Vs. Commercial

For your home, you must have a valid reason for installing CCTV and what you may wish to record. The retailer has the right to ask you what this is.

Generally, however, you don’t need to obtain permission – although you may require planning consent if it’s a listed property. Also, you won’t have to have a Privacy Impact Assessment (see below).

Commercial CCTV Laws Explained

CCTV is sophisticated technology that can help protect your commercial building from criminal activity. And, it can even alert you to other incidents, such as fire or flooding, especially when paired with remote CCTV monitoring.

It’s well worth the investment, and Clearway offers in-depth expertise on the type of installation that will work best for your premises.

To stay compliant, the system also needs to stay reliable over time. That includes maintaining image quality, ensuring access controls remain correct as staff change, and keeping hardware and software updated through CCTV maintenance and repair support.

How do users comply with the DPA and the ICO?

• They (or you) must register with the ICO as a CCTV operator and advise them they need it and plan to use it. There’s also a data protection fee to pay, which can be either £40 or £60, depending on the size of the operation.
• In its guidelines, the ICO recommends the creation of a Privacy Impact Assessment (PIA), with a trusted, responsible member of staff nominated as the person who will be available to respond to complaints or queries about your CCTV system.

A PIA identifies and ideally reduces any privacy risks. It’s an effective way to identify them early on, when putting things right may be more manageable.

• Signs showing that CCTV is in operation must be mounted and clearly visible. A good example of this could be a surveillance installation at a land perimeter that overlooks a public access area. The sign needs to warn and advise people walking by what’s going on, with obvious contact details should they have concerns. Here, the focus is on transparency and privacy, with proactive measures put in place before anyone complains or takes things further.
• All employees need to know about the presence of CCTV.
• CCTV footage can be kept but for no longer than 31 days. The guidelines state that images can only be retained “for long enough for any incident to come to light and to investigate”. They also mention “for the minimum time necessary for its purpose”.
• Recording conversations between members of the public is not allowed.
• Users of CCTV must follow recognised technical and operational standards when required.
• CCTV in private places, such as toilets or changing rooms, is not permissible.
• Users must ensure that they set the date and time correctly in case footage is needed by the police, or in court proceedings.
• The ICO recommends that commercial operations that install and use CCTV should audit and publish their CCTV operations regularly.

The ICO is keen on policies. 

Pulling a policy document together could help your business use CCTV to a consistent standard, including how it handles the information captured. A policy document could also contain guidelines about disclosures and recording.

Data quality is critical, too:

The ICO’s guidelines emphasise a need for the quality of CCTV footage to be as clear as possible. This is so that the police, if necessary, can actually use it to investigate the possibility of a crime.

As you would expect, of vital importance, of course, is data security:

CCTV images must be stored securely, with access limited only to authorised individuals.

Operators must, as much as possible, prevent the information from falling into the wrong hands – with technical and physical security in place to prevent wireless systems from being intercepted or compromised.

Steve Hardcastle

Chief Technical Officer
Clearway

Steve Hardcastle

CCTV systems capture far more than just images-they capture personal data, and under UK law that data must be processed lawfully, fairly, and transparently, or you're breaching GDPR and the Data Protection Act 2018 regardless of your security intentions.

Quick Facts

• CCTV was invented by a chap called Walter Bruch, and it was used as far back as 1942 to capture live video footage.
• CCTV came to Britain in 1960, so it’s surprisingly long-lived.
• What is the UK’s most “watched” city? According to recent statistics, it’s London, with 1.1 million private sector businesses and more than 809,000 surveillance cameras.

What Clearway Thinks

CCTV is a high-standard, peace-of-mind solution to the challenges of vacant property security. It’s quick to install, looks impressive, is highly effective, and acts as a visual deterrent and is easy to maintain.

Nevertheless, video and audio recordings of people count as personal data – that’s the bottom line.

In our opinion, staying within the laws governing CCTV is common sense, as well as mandatory. Ultimately, it’s about using it responsibly, respectfully and sensibly.

So, as soon as you start thinking about CCTV cameras at your commercial premises, you’ll also need to consider data protection. This way, with the right approach, you’ll feel confident that your use of CCTV is compliant.

And, you’ll be impressing on your staff and visitors that you take their privacy seriously.

If you want help setting up compliant CCTV policies, signage, and retention practices for your site, contact the Clearway team.

FAQs

Can I record and watch my staff on CCTV?

This issue concerns trust.

The short answer is no, and this is where GDPR rises to the surface. The General Data Protection Regulation Act prevents employers from using a camera for a reason different from what was initially intended.

How do I know I’m complying with the Data Protection Act?

Because Clearway will advise you on how to do this. The responsibility, however, will be yours, and you will need to act accordingly.

How do I handle a request for CCTV footage (Subject Access Request)?

Log the request, find the relevant time window fast, and confirm identity if needed. Share only what the requester is entitled to, and blur or redact other people before you disclose anything.

Can CCTV record audio in the UK?

Audio recording is almost always harder to justify than video and can create bigger privacy risks. If you record sound at all, you need a strong lawful basis, clear signage that mentions audio, and tight access controls.

Do I need signage and a privacy notice if I use CCTV?

Yes. Signage should warn people before they enter the recorded area, and the privacy notice should explain who runs the system, why it exists, how long footage is kept, and how people can contact you about their data.

Keep both easy to find on-site, and make the privacy notice accessible online too.

Written by Steve Hardcastle

Chief Technical Officer

View Steve’s LinkedIn profile More articles by Steve

Steve Hardcastle is Chief Technical Officer at Clearway, bringing extensive leadership experience from across the security sector, including the management of NSI and ACS-accredited businesses and the founding of Cerberus Security and Monitoring, which he led for over 25 years.

Working closely with Clearway’s research and development team, Steve helps shape the Group’s technical direction by identifying innovative technologies that enhance service capability, support operational performance, and provide a competitive advantage. His role includes developing technology strategies that support business growth, while also strengthening and evolving the Group’s existing product range.

Steve also provides technical and practical support across the wider business, working with sales, marketing, and operational teams on solution design, product positioning, implementation challenges, and day-to-day technical issues. His broad industry knowledge and hands-on approach play an important role in ensuring Clearway remains at the forefront of security technology and service innovation.