No UK law says your business must have CCTV, and none says what system you must buy. What the law does require is that if you install cameras, you use them lawfully. In practice that means paying the data protection fee to the ICO, displaying clear signs, being able to supply footage to people who ask for it, and keeping recordings no longer than you can justify. This guide walks through each duty in the order you will meet it, and says where the installation itself affects whether you can comply.
TL;DR
- Using CCTV at a business means registering with the ICO and paying the annual data protection fee, unless you are exempt.
- Put up visible signs saying who runs the system, why, and how to contact them.
- There is no fixed retention period in UK law. Choose the shortest period that serves your purpose, and write it down.
- Your system must be able to export clips and redact other people, because access requests have a one calendar month deadline.
- Avoid audio, and do not repurpose security cameras to monitor staff productivity.
Table of Contents
- Before you buy: decide why you need cameras
- Register with the ICO and pay the fee
- Signs: a core requirement, not a formality
- Retention: there is no magic number
- Subject access requests: build for them at installation
- Audio, staff monitoring and other grey areas
- A practical checklist for a new business system
- Our perspective: compliance is mostly decided on the day of installation
- Related compliance duties for business premises
- Need a system installed properly?
- FAQ
- Sources
Before you buy: decide why you need cameras
Everything else follows from your purpose. The ICO expects you to identify and document a lawful basis under Article 6 of the UK GDPR. For most businesses that is legitimate interests: preventing theft, protecting staff, or keeping a record if there is an incident. Consent is rarely workable, because customers walking past cannot realistically say no.
Write the purpose down in a sentence or two. “Deter and investigate theft from the stockroom and till area” is a purpose. “Security” is not specific enough to help you decide where a camera goes.
Do a risk assessment first
The ICO’s CCTV checklist asks whether you have identified and documented the potential impact on people’s privacy, and whether you review that CCTV is still the best security solution. In formal terms this is a data protection impact assessment (DPIA). Think of it as a short, honest justification: what problem you have, why cameras answer it, and what less intrusive options you considered, such as better lighting, locks or staffing changes.
If you cannot explain why cameras are necessary and proportionate, you should not install them. If you can, the document protects you when a customer, employee or the regulator asks questions later.
Where cameras should and should not point
A useful rule is to film what you need and nothing more. A camera covering your entrance, till, loading bay and stock room is easy to justify. Cameras in toilets, changing areas or staff rest rooms almost never are. Cameras that take in a neighbour’s windows or a large stretch of public pavement will draw complaints, so adjust the angle or use privacy masking in the recorder’s settings.
If you share a building, think about who the data controller is. In a multi-tenant unit, the landlord, managing agent and each tenant may all have cameras, and the signs must make clear which party is responsible for which system.
Register with the ICO and pay the fee
GOV.UK states that a business using CCTV must register with the ICO and pay a data protection fee, unless it is exempt. The fee depends on the size and turnover of the organisation, and the current range runs from £52 to £3,763 a year. Most small businesses sit in the lowest tier, but check the ICO’s tiers against your own staff numbers and turnover rather than assuming.
Two practical points:
- Having CCTV for crime prevention generally takes you out of the exemption that some businesses enjoy for staff administration, marketing and accounts only.
- You do not need the ICO’s permission to install ordinary CCTV. The ICO’s guidance for organisations makes the point that you need a lawful basis and must follow the rules, not that you apply for approval.
The regulator has been going through a structural change, so expect the ICO’s web pages and wording to be updated. Always check the current fee page on GOV.UK or the ICO site on the day you pay.
Signs: a core requirement, not a formality
GOV.UK says you must tell people they may be recorded, usually by displaying signs. The ICO’s small organisation guidance adds the detail: signs should be clear, visible and readable, and explain who is operating the system, why, and how to contact them.
A good sign has:
- A camera symbol or the words “CCTV in operation”.
- The name of the organisation responsible.
- The reason for recording, for example prevention and detection of crime.
- A phone number or email for questions and access requests.
Place signs at entrances to the monitored area and again near each camera zone, at a height and size a person can read from a sensible distance. In a shared building, the sign needs more than a generic message, because nobody can tell who to contact.
Retention: there is no magic number
Search results are full of confident answers such as 30 days or 31 days. Treat those as habits, not law. The ICO guidance says there is no fixed minimum or maximum retention period. You must keep footage for no longer than is necessary for your purpose. Keeping it indefinitely, or “as long as the hard drive allows”, does not meet that standard.
How to choose a period:
| Situation | What drives the period |
|---|---|
| Shop that checks for theft at the end of each week | A short period, because problems are noticed quickly |
| Premises that are empty for a fortnight at a time | Long enough to cover the gap before anyone reviews footage |
| Site with frequent insurance or injury claims | A longer period, if you can justify it, with an incident clip held separately |
Once an incident happens, export and secure the relevant clip, and let everything else overwrite on schedule.
Write the period down
An automatic overwrite setting on the recorder is not enough by itself. The ICO expects you to be able to show accountability, so record the chosen period and the reason in your CCTV policy and privacy notice. A recorder that overwrites at 28 days with no written policy still leaves you unable to prove you chose that figure deliberately.
Subject access requests: build for them at installation
Anyone recorded on your system can ask for a copy of their footage. GOV.UK says that in most circumstances you must be able to provide it on request, and the deadline is one calendar month. You generally cannot charge for it.
The awkward part is other people. The ICO’s Q&As for employers deal with footage that includes third parties, and the practical consequence is that you need to be able to blur or otherwise redact other individuals where appropriate. If your recorder can only export a full-screen clip and you have to edit frame by frame in separate software, one request can take a day of someone’s time.
When choosing or upgrading a system, check these before you buy:
- Can you export a specific time window from a specific camera, with a built-in player?
- Is the time and date accurate, and synchronised to a network time source?
- Is there a built-in masking or redaction tool, or a clear process for outsourcing it?
- Does the system keep a log of who viewed or exported footage?
Those points are cheap to get right at installation and expensive to retrofit.
Audio, staff monitoring and other grey areas
Sound recording
Audio is far more intrusive than video, and recording private conversations is a particular concern. The ICO’s CCTV guidance for small organisations says that you should turn off audio recording unless you have a strong justification. If staff face real abuse and want audio as a safeguard, a manually triggered option that staff activate during an incident is easier to defend than continuous recording. Take advice from the ICO or an employment solicitor first.
Watching your own employees
GOV.UK’s guidance for employers is that if you installed cameras to detect crime, you should not use them to monitor staff productivity or attendance, and that staff should be told clearly about monitoring, for example through the handbook or contract. Covert cameras are a different matter and only suit very narrow circumstances. If you think you need them, speak to an employment lawyer before doing anything.
Do you need an SIA licence?
This catches people out. Under the Private Security Act 2001, a licence is needed for public space surveillance, meaning using CCTV to guard premises, property or people. However, the same page notes that you do not usually need an SIA licence if you work in-house, employed directly by the company that uses your services. A shop owner watching their own monitor is generally in that position. If you outsource monitoring to a third party, ask whether the operators hold the correct licence.
Scotland and Northern Ireland
The data protection regime applies across the UK, but other rules and codes can differ by nation. If you operate in Scotland or Northern Ireland, check the local guidance in addition to the ICO material.
A practical checklist for a new business system
- Write down your purpose and the alternatives you considered.
- Complete a short impact assessment and keep it on file.
- Pay the ICO fee at the correct tier.
- Choose camera positions, then mask areas you do not need.
- Put up signs with the operator’s name, purpose and contact details.
- Set retention, then document it in your policy and privacy notice.
- Restrict access to the recorder and remote viewing app, and use strong, unique passwords.
- Tell staff in writing.
- Test an export and a redaction before you need one.
- Review the whole set-up at least once a year.
If you want to see how the installation side of this works, our article on complying with UK CCTV laws, with installer steps and handover goes through what should be handed over when a system is commissioned.
Our perspective: compliance is mostly decided on the day of installation
We are electrical contractors, and CCTV and home security is one of the services we fit across Dorset, Hampshire and Devon. What we see is that the law is rarely the hard part. The trouble starts when a system goes in with no thought about the paperwork that has to sit alongside it.
The three problems we would flag to any business owner are these. First, cameras are placed to cover everything, then nobody can explain why. Start from the risks you actually have. Second, the recorder is left on its default settings, with default passwords and no written retention period. Third, nobody tests an export until a request arrives and the clock is already running.
A good handover should leave you with a camera plan, a tested export, access credentials that belong to you, and a short note you can copy into your policy. We also think CCTV should be treated as part of the wider electrical picture: a clean, properly protected supply, sensible cable routes, and power to the recorder that survives a minor outage. We hold NICEIC and MCS accreditation, and we aim to explain choices plainly and leave sites tidy.
— Simon
Related compliance duties for business premises
CCTV is rarely the only obligation on commercial premises. Two others come up constantly in our work:
- Fixed wire testing. If you are checking your site’s security, it is a good moment to look at the wiring that powers it. See our guide to fixed wire testing for UK commercial properties.
- Fire detection. Fire alarm systems have their own standards and are separate from CCTV. Our commercial fire alarm checklist sets out what to look at.
Landlords will also want to look at EICR requirements alongside any security upgrade.
Need a system installed properly?
We install CCTV and home security systems, along with fire alarms, electrical testing and wider residential and commercial electrical work, for customers in Dorset, Hampshire and Devon. If you want a system fitted with the compliance points above in mind, see our services or get in touch through our main site and tell us about your premises.
FAQ
Does my business have to register its CCTV with the ICO?
In most cases, yes. GOV.UK says a business using CCTV must register with the ICO and pay a data protection fee unless it is exempt. The amount depends on the size and turnover of the organisation. Check the ICO’s current tiers before you pay.
How long can a business keep CCTV footage?
There is no fixed legal period. You must keep footage only as long as needed for your stated purpose, and be able to explain your choice. Document the period in your CCTV policy and privacy notice, and keep any incident clips separately.
Can I record audio on business CCTV?
It is rarely justifiable. Audio is more intrusive than video, and the ICO advises switching it off unless you have a strong reason. If staff safety is the issue, a manually triggered option is easier to defend than continuous recording.
How quickly must I respond to a request for footage?
You have one calendar month from receiving a subject access request, and you generally cannot charge for it. If the footage shows other people, you may need to redact them, so make sure your system can export and edit clips before a request arrives.
Sources
- Data protection and your business: Using CCTV, GOV.UK
- CCTV installation at your commercial property, GOV.UK
- How can we comply with the data protection principles when using surveillance systems?, ICO
- CCTV for your organisation: things you need to do, ICO
- CCTV checklist, ICO
- Subject access request Q and As for employers, ICO
- Public Surveillance Operative, Regulated Professions Database
