Using CCTV on your premises lawfully

Aug 29
3 min read

Updated: 2 days ago

Introduction

Cameras are fitted after a break-in. They cover the yard, the entrance and, incidentally, the workshop where staff spend the day. Footage is kept on a recorder in the office and overwritten whenever the disk fills.

Nothing about that is unusual and several parts of it create obligations nobody has considered. Footage of identifiable people is personal data, staff have particular protections, and the recordings are subject to access requests. Installing cameras is a decision with a compliance component that arrives with the equipment. Nobody selling the cameras mentions any of it.

1. Using CCTV on your premises lawfully means treating footage as personal data

The starting point.

Recordings of identifiable individuals fall within data protection frameworks. Everything that applies to a customer database — purpose, lawful basis, retention, security, access rights — applies to the recorder in the office. The recorder in the office is a database like any other.

2. Establish why you are using it

Before installation, not after.

Preventing theft, protecting staff, monitoring a specific risk. A documented purpose is what justifies the processing, and it determines what coverage is proportionate. A system installed after a break-in should be pointed at where the break-in happened.

3. Be proportionate about coverage

The test most systems fail.

Cameras covering entrances and areas of genuine risk are usually defensible. Continuous coverage of where employees work, rest areas, or anywhere with an expectation of privacy is much harder to justify. Continuous recording of people at work engages a stricter set of considerations.

4. Tell people they are being recorded

A transparency requirement.

Clear signage at the entrance and in covered areas, stating who operates the system and how to make contact. This is the most visible obligation and the most commonly done badly. Signs are frequently faded, missing an operator name, or placed where nobody sees them.

5. Inform staff specifically

Beyond the signage.

Employees should be told what is recorded, why, who can view it, and how long it is kept, usually in the employee privacy notice. Monitoring staff without telling them is very narrowly permitted and should not be assumed.

6. Set a retention period and apply it

Not until the disk fills.

A defined period appropriate to the purpose, commonly a small number of weeks, after which footage is deleted. Automatic overwriting can satisfy this if the cycle is known and documented.

7. Control who can view it

Access, as with any other data.

Named individuals, password protected, with a record of who viewed what and why. Systems accessible by anybody in the office, or viewable on a phone application shared around, fail this straightforwardly.

8. Be ready for a request for footage

It will happen eventually.

Individuals can generally request footage of themselves, and you must provide it while protecting other people who appear. Redacting video is difficult, which is a practical argument for shorter retention and narrower coverage.

9. Handle requests from authorities properly

A defined process.

Requests from police or other bodies should be recorded, with the basis for disclosure noted. Handing over footage informally, without recording why, is a disclosure you may later be asked to justify.

Check whether audio recording is included, because it is frequently enabled by default and is considerably harder to justify than video. Recording conversations is substantially more intrusive and most systems do not need it at all.

Conclusion

Treat the footage as personal data with all the obligations that carries.

Document why you are using the system before installing it, keep coverage proportionate and avoid areas where people expect privacy, put up clear signage naming the operator, inform staff specifically in the employee privacy notice, set and apply a defined retention period, restrict and log who can view recordings, prepare for individuals requesting footage of themselves, record any disclosure to authorities and the basis for it, and disable audio recording unless you can justify it.