Covert CCTV Use Cases: What Is Permitted Under UK Law

Covert CCTV is a form of surveillance in which cameras are deployed without the knowledge of those being monitored, used specifically to gather evidence of suspected criminal activity or serious malpractice where overt surveillance would not be effective.

Unlike standard commercial CCTV systems, covert cameras are not designed to deter. They are designed to document. This distinction is central to how UK law treats them, and it places strict obligations on any organisation that chooses to deploy them.

This article explains what covert CCTV is, when its use is lawful under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and ICO guidance, which specific use cases are permitted, and where organisations must not use it.

What Is Covert CCTV and How Does It Differ from Overt Surveillance

Covert CCTV is a surveillance method in which cameras are intentionally concealed or disguised so that the individuals being recorded are unaware of their presence, deployed exclusively in situations where prior knowledge of the camera would prevent the evidence from being captured.

Standard commercial CCTV systems are designed to be visible. Signage informs staff, visitors, and the public that recording is taking place, which satisfies the transparency requirements under UK GDPR and the ICO’s video surveillance guidance. Visibility also provides deterrence: a potential offender who sees a camera is more likely to reconsider. This is the correct default approach for the vast majority of business premises.

Covert cameras work on a different principle. Because the subject of surveillance is unaware of being recorded, the footage can capture behaviour that would not occur in front of a visible camera. This makes covert CCTV effective for a specific and limited set of scenarios, none of which relate to routine site monitoring.

The critical distinction is purpose. Overt CCTV monitors and deters. Covert CCTV investigates and documents. The legal framework reflects this: organisations must have a specific, justified reason to deploy covert systems, and they cannot simply choose covert over overt for convenience or cost.

The UK Legal Framework for Covert CCTV

Covert CCTV in a commercial context is governed primarily by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). Because CCTV footage that captures identifiable individuals constitutes personal data, any organisation operating a CCTV system must have a lawful basis for processing that data under Article 6 of UK GDPR.

For most commercial CCTV systems, the lawful basis is legitimate interests under Article 6(1)(f). Covert CCTV is no different in this respect, but the ICO’s guidance on covert surveillance and its Employment Practices Code set out considerably stricter requirements for how that lawful basis is satisfied.

The ICO’s position is that covert monitoring of employees is only justified in limited circumstances: where there is specific suspicion that criminal activity or equivalent serious malpractice is taking place, where informing those involved would prejudice the investigation, and where no less intrusive method of gathering the evidence is available. Organisations must be able to document that all three conditions were met before any covert system was activated.

Understanding the rules around collecting CCTV evidence is essential before any deployment: both to protect the integrity of the investigation and to ensure footage is admissible if legal proceedings follow.

It is also worth being clear about scope. The Regulation of Investigatory Powers Act 2000 (RIPA) governs covert surveillance by public authorities such as police, local councils, and intelligence services. Private commercial organisations are not subject to RIPA and cannot authorise surveillance under it. Businesses operating covert CCTV must work within UK GDPR and DPA 2018, not RIPA.

The Legitimate Interests Test for Covert CCTV

To rely on legitimate interests as the lawful basis for covert surveillance, an organisation must pass a three-part test set out by the ICO in its guidance on video surveillance.

First, a legitimate purpose must exist. Investigating credible suspicion of theft, fraud, or serious malpractice meets this threshold. General concern about workplace culture, productivity, or vague suspicion does not.

Second, the processing must be necessary. This means there must be no less intrusive way to investigate the issue. If a visible camera or a different investigative method would achieve the same result, covert surveillance is not necessary and therefore cannot be justified.

Third, the organisation must balance its interests against the privacy rights of the individuals being recorded. Where covert monitoring extends to areas or circumstances where people have a reasonable expectation of privacy, the balance will almost always fall against the organisation. Proportionality is not just a legal requirement. It is also the measure by which any ICO investigation or employment tribunal claim will be assessed.

The ICO has the power to issue fines of up to £17.5 million or 4% of global annual turnover under UK GDPR. While most covert CCTV enforcement actions are handled through reprimands and enforcement notices, organisations that deploy hidden cameras unlawfully and cause demonstrable harm face the prospect of financial penalties alongside the reputational consequences of a public ICO decision.

Steve Hardcastle

Chief Technical Officer
Clearway

Steve Hardcastle

Organisations sometimes assume that covert CCTV is a straightforward option when they have a theft problem. In practice, it requires a formal decision-making process: you need documented suspicion, a clear purpose, and evidence that no less intrusive approach is available before any camera goes in. If you skip those steps, the footage may be inadmissible and you risk an ICO complaint or employment tribunal.

Permitted Use Cases for Covert CCTV in Commercial Settings

The following use cases represent scenarios where covert CCTV deployment can be lawful under the UK GDPR legitimate interests basis, provided the necessity and proportionality conditions are met and the decision is properly documented before deployment.

Investigating Suspected Employee or Contractor Theft

This is the most common lawful use case for covert CCTV in commercial environments. Where a business has credible, specific evidence of theft by an employee or contractor (such as consistent stock discrepancies, access log anomalies, or witness accounts), a covert camera targeted at the suspected area can be lawfully deployed to gather evidence for disciplinary proceedings or prosecution.

The key requirement is specificity. Suspicion must relate to an identified individual or a defined group in a defined location. Blanket monitoring of all staff in response to a general theft problem does not satisfy the legitimate interests test. The deployment must also be time-limited: once the investigation is concluded, the covert system should be removed or the data deleted in line with the organisation’s data retention policy.

For CCTV footage to be used as evidence in court, it must also meet admissibility standards. Read more in our guide to CCTV footage used as evidence in court.

Fraud Detection

Covert CCTV can be used to investigate suspected till fraud, manipulation of stock records, expense fraud, or the misuse of company assets. As with theft investigations, the basis for deployment must be specific: identified irregularities in financial records, transaction logs, or audit findings that point to a defined location or individual.

In retail and distribution environments, covert cameras placed above tills or at goods receipt points have been used successfully to capture evidence of systematic fraud that could not have been detected by visible cameras, since the subjects were aware of their positions and worked around them.

Protecting High-Value Asset Areas

In some environments, the location of overt cameras is known to those who might target them, reducing their effectiveness. Server rooms, fuel stores, pharmaceutical storage, and high-value plant areas are examples where a motivated individual with knowledge of the camera positions could avoid detection.

Where the value of the asset and the credibility of the threat justifies it, covert cameras in these areas may satisfy the proportionality requirement. The decision must be reviewed periodically, as covert monitoring should not become a permanent default for high-value areas without ongoing justification.

Lone Worker Safety Monitoring in High-Risk Environments

Covert monitoring in the context of lone worker safety is a less commonly discussed use case but one that is increasingly relevant in industrial and security environments. Where workers operate alone in high-risk settings, including night shifts in remote locations, security patrols in high-crime areas, or controlled substance storage environments, discreet monitoring can protect the worker rather than investigate them.

In these cases, the lawful basis may differ: the organisation may rely on legitimate interests tied to the duty of care rather than the investigation of wrongdoing. The monitoring purpose must be clearly defined, communicated in general terms in the worker’s contract or safety documentation, and not used for disciplinary surveillance purposes.

Critical Infrastructure and Utility Sites

Power stations, electrical substations, water treatment facilities, gas terminals, and pipeline infrastructure face specific threats including metal theft, cable theft, and targeted sabotage. These sites often cover large areas with remote sections where overt cameras can be identified and avoided by persistent offenders.

Covert CCTV at these locations serves a protective function against external threats rather than an investigative function against employees. The proportionality case is typically strong: the impact of infrastructure interference is significant, the threat is credible, and overt cameras at known positions are frequently defeated. Remote monitoring via 4G-connected systems allows security teams to receive alerts and review footage without requiring physical site visits.

At Clearway, we have supported operators of utility and infrastructure sites where the combination of overt perimeter cameras and strategically positioned covert units has provided a layered approach: deterrence at the boundary and targeted evidence-gathering at the highest-risk points inside the site. In each case, the deployment was documented, purpose-limited, and reviewed at regular intervals by the site security lead.

What Covert CCTV Is Not Permitted For

The ICO is explicit that certain uses of covert CCTV cannot be lawfully justified regardless of the circumstances. Organisations that deploy cameras in the following scenarios face the risk of enforcement action, substantial fines, and employment tribunal claims.

Covert CCTV must not be used in:

• Toilets, washrooms, or shower facilities
• Changing rooms or any space designated for personal hygiene
• Prayer rooms, faith rooms, or meditation spaces
• Private offices where individuals have a reasonable expectation of not being observed
• Staff rest areas and break rooms in most circumstances

Beyond location, covert CCTV is also not permitted as a routine monitoring tool. Organisations cannot deploy hidden cameras to measure productivity, monitor attendance, or conduct generalised oversight of staff behaviour without specific suspicion of criminal activity or serious malpractice. This is true even where employees have been informed in general terms that monitoring may occur. General notification does not legitimise covert monitoring in the absence of specific justification.

Footage captured through covert surveillance must also not be repurposed. If a covert camera is deployed to investigate a specific theft allegation and the footage is then used for a different purpose (performance management, dismissal for an unrelated reason, or sharing with a third party), this constitutes a breach of the purpose limitation principle under UK GDPR and creates additional legal exposure.

When Overt CCTV Is the Right Choice

For the majority of commercial sites, overt CCTV is the correct and legally straightforward approach. Visible cameras with appropriate signage satisfy the transparency requirements under UK GDPR, deter opportunistic crime, and provide general monitoring and evidence capture without the complexity of satisfying the legitimate interests test for covert surveillance.

Overt CCTV is the appropriate choice when:

• The objective is crime deterrence rather than evidence gathering against a specific suspect
• The monitored areas are public-facing, such as entrances, car parks, reception areas, and loading bays
• Employees, visitors, and the public need to be informed of monitoring as part of your data protection obligations
• The site requires perimeter monitoring, incident recording, or integration with a professional monitoring centre

Clearway’s commercial CCTV systems are designed for these environments. Where the right answer is a visible system with remote monitoring, AI-assisted detection, and NSI Gold-accredited response, overt CCTV delivers more value, more compliance, and more deterrence than a covert alternative.

For sites with specific CCTV signage requirements or questions about where signage obligations begin, our guide covers the ICO’s requirements in full.

Getting Covert CCTV Right

Covert CCTV is a lawful and effective surveillance tool when it is deployed within the legal framework set out by the ICO, UK GDPR, and the DPA 2018. The key requirements are specific suspicion, documented decision-making, proportionate deployment, and time-limited operation. Where those conditions are met, covert cameras can provide the evidence needed to prosecute offenders, recover losses, and protect people and assets.

Where they are not met, organisations face significant legal risk, including enforcement action from the ICO, admissibility challenges in court, and employment tribunal claims.

If you are considering covert CCTV as part of your site security strategy, speak to Clearway first. Our security technology team can advise on the appropriate system, the legal requirements that apply to your situation, and how to ensure your deployment is documented and defensible. Contact Clearway to discuss your requirements.

Frequently Asked Questions

Is covert surveillance legal in the UK?

Covert surveillance by private commercial organisations is legal in the UK under specific and limited conditions governed by UK GDPR and the Data Protection Act 2018. Businesses may deploy covert CCTV where they have specific, documented suspicion of criminal activity or serious malpractice, where informing the subject would prejudice the investigation, and where no less intrusive method of gathering evidence is available. The ICO’s guidance on covert monitoring in the workplace sets out these requirements in full, and failure to meet them exposes organisations to enforcement action and legal challenge.

What is a covert camera used for?

A covert camera is used to gather video evidence of suspected criminal activity or serious malpractice in situations where the subject’s knowledge of the camera would prevent the evidence from being captured. In commercial settings, this typically means investigating credible allegations of employee or contractor theft, detecting fraud at tills or in financial processes, monitoring high-value assets in areas where overt cameras would be defeated, and gathering evidence to support prosecution or disciplinary proceedings.

What is an example of covert surveillance in a business setting?

A warehouse manager who identifies consistent stock discrepancies in a specific zone, and has reason to believe a contractor is removing goods from that area, may deploy a concealed camera targeted at that location for the duration of the investigation. The deployment is time-limited, based on documented suspicion, targets a specific area rather than the whole workforce, and is removed once the investigation concludes. This scenario satisfies the ICO’s conditions for lawful covert monitoring.

What are the rules around covert CCTV in the workplace?

The ICO’s Employment Practices Code sets out that covert monitoring of employees is only justified where there is specific suspicion of criminal activity or equivalent malpractice, where the investigation cannot be conducted through less intrusive means, and where monitoring does not extend to areas in which workers would reasonably expect privacy, such as toilets, changing rooms, or rest areas. Organisations must document their decision-making process before deployment and must not use footage for any purpose beyond the original investigation.

When should you use overt CCTV instead of covert?

Overt CCTV is the correct default for the majority of commercial sites because it satisfies UK GDPR transparency requirements through appropriate signage, deters opportunistic crime, supports general monitoring of premises, and avoids the complex legal justification required for covert systems. Covert CCTV should only be considered where a specific investigation requires it and where the organisation can demonstrate, with documentation, that the deployment meets the ICO’s conditions.

Written by Steve Hardcastle

Chief Technical Officer

View Steve’s LinkedIn profile More articles by Steve

Steve Hardcastle is Chief Technical Officer at Clearway, bringing extensive leadership experience from across the security sector, including the management of NSI and ACS-accredited businesses and the founding of Cerberus Security and Monitoring, which he led for over 25 years.

Working closely with Clearway’s research and development team, Steve helps shape the Group’s technical direction by identifying innovative technologies that enhance service capability, support operational performance, and provide a competitive advantage. His role includes developing technology strategies that support business growth, while also strengthening and evolving the Group’s existing product range.

Steve also provides technical and practical support across the wider business, working with sales, marketing, and operational teams on solution design, product positioning, implementation challenges, and day-to-day technical issues. His broad industry knowledge and hands-on approach play an important role in ensuring Clearway remains at the forefront of security technology and service innovation.