CCTV in the UK is governed by data protection law, not by a dedicated camera statute. If your cameras record identifiable people, you are processing personal data under the UK GDPR and the Data Protection Act 2018, and the Information Commissioner's Office is your regulator. On top of that sit a British Standard for how control rooms are run, a statutory code for public authorities, and, if you sell alcohol, conditions on your premises licence that have nothing to do with privacy at all and sometimes pull in the opposite direction.
This guide covers each of those layers, what they actually require, and the point where most operators get caught out: you cannot hand over CCTV footage in response to a subject access request without obscuring the other people in it.
CCTV law in the UK: which rules actually apply
There is no single CCTV Act. What people call CCTV law in the UK is four separate instruments stacked on each other, and which ones bind you depends on who you are. Searches for CCTV regulations in the UK usually return the first of these and stop there, which is why so many operators are compliant on paper and caught out in practice.
Instrument | Who it binds | What it governs | Enforced by |
|---|
UK GDPR and Data Protection Act 2018 | Everyone recording identifiable people, including homeowners whose cameras reach beyond their boundary | Lawful basis, transparency, retention, security, individual rights | ICO |
Surveillance Camera Code of Practice (Protection of Freedoms Act 2012) | Relevant authorities in England and Wales, mainly police and local authorities. Best practice for everyone else | Twelve guiding principles on proportionate and transparent camera use | Statutory code, followed by public bodies |
BS 7958:2015 | Voluntary standard, often contractual for monitored schemes | How control rooms, staff and evidential handling are managed | Not a regulator, but referenced in contracts and procurement |
Licensing Act 2003 conditions | Premises licence holders, including off licences | Whether you must have cameras, for how long you must keep footage, and how fast you hand it to the police | Licensing authority and police |
The first is the one with the fines. The last is the one that most often forces a small business to install cameras in the first place, and the two are not written to fit together.
GDPR CCTV rules: what UK GDPR requires of an operator
The starting point is that footage of an identifiable person is personal data. That single classification brings in the whole framework. In practice the GDPR CCTV rules come down to six obligations.
Identify a lawful basis before you record. For most businesses this is legitimate interests under Article 6(1)(f), which requires a documented balancing test weighing your security purpose against the privacy of everyone caught on camera. Consent is almost never workable for CCTV, because you cannot obtain it from someone who has already walked into shot.
Define the purpose narrowly and stick to it. Cameras installed for crime prevention cannot quietly become a productivity monitoring tool. Repurposing is a separate processing operation needing its own justification.
Complete a Data Protection Impact Assessment where required. Article 35 of the UK GDPR requires a DPIA for systematic monitoring of a publicly accessible area on a large scale, which describes most retail, hospitality and town centre schemes.
Tell people they are being recorded. Signage that identifies the operator and gives a route to more information, backed by a fuller privacy notice.
Keep footage no longer than necessary. There is no statutory retention period in data protection law. You set one, justify it, and delete on schedule.
Be able to answer individual rights requests. Access, objection and erasure all apply to footage, and the access right is the one that generates real work.
The penalty range is what changed after the old Data Protection Act 1998. Under the UK GDPR the higher tier reaches £17.5 million or 4% of total worldwide annual turnover, whichever is greater, with a lower tier of £8.7 million or 2%. Infringements of the basic principles and of data subject rights sit in the higher tier. Any guide still quoting a £500,000 ceiling is describing the pre-2018 regime.
CCTV and data protection: the principles applied to cameras
CCTV data protection is easiest to get right if you work through the principles in Article 5 one camera at a time.
Principle | What it means for a camera |
|---|
Lawfulness, fairness, transparency | A documented basis, plus signage and a privacy notice people can actually find |
Purpose limitation | One stated purpose per scheme. Security footage is not marketing material |
Data minimisation | Angle the camera at what you need. Do not overlook the pavement, the neighbour, or the staff room. Audio is treated as especially intrusive and is normally disabled |
Accuracy | Correct date and time stamps, which also determines whether footage is usable as evidence |
Storage limitation | A written retention period, automatically enforced. See our note on theCCTV footage retention period |
Integrity and confidentiality | Access control, logged exports, encryption where footage leaves the system |
Data minimisation is where most schemes fail an inspection, and it is a physical problem before it is a legal one. A camera pointed at a public footpath collects data you cannot justify, and no policy document fixes that. Reposition the camera or mask the area in the system.
CCTV GDPR compliance: the checklist before you switch a camera on
Working CCTV GDPR compliance is a short list, done in order, before installation rather than after a complaint.
Write down the problem the cameras solve and the evidence that they will solve it
Record the lawful basis and, for legitimate interests, the balancing test
Complete a DPIA if the scheme is large scale or covers a publicly accessible area
Map every camera's field of view and remove or mask anything outside your premises
Decide whether audio is genuinely necessary. Usually it is not, so turn it off
Set a retention period, write it down, and configure the system to enforce it
InstallCCTV signage naming the operator and how to contact them
Publish a CCTV privacy notice covering purpose, retention, recipients and rights
Restrict who can view and export, and log every export
Confirm you can locate footage by date, time and camera, and redact third parties before release
Pay the data protection fee to the ICO if your organisation is required to
Train whoever will handle requests, because the clock on those is short
The second to last point is worth pausing on, because the old version of this article got it wrong and so does much of the internet. You do not notify the ICO of an intention to install cameras. There is no such process. Most controllers must pay an annual data protection fee, which is a funding mechanism, not a permission.
CCTV British Standards: BS 7958 and the Surveillance Camera Code
Search for CCTV British Standards and you will mostly find installers selling systems. The two documents that actually matter are these.
BS 7958:2015, Closed circuit television (CCTV). Management and operation. Code of practice. This is the British Standard for running a scheme rather than for the hardware. It gives recommendations for CCTV within a controlled environment where footage may be offered as evidence, covering scheme principles, the responsibilities of personnel, incident handling and privacy. Its scope is schemes in places the public has a right to visit, which the standard describes as ranging from privately owned spaces with no perceived boundary through to roads, sports stadiums, housing estates and supermarkets. It superseded the 2009 edition. It is guidance rather than a specification, and it is widely treated as the baseline for local authority monitoring centres, police control rooms and commercial control rooms. It is not law, but it is frequently written into contracts and procurement requirements, so failing to meet it can cost you a tender even where it cannot cost you a fine.
The Surveillance Camera Code of Practice, issued under the Protection of Freedoms Act 2012, sets twelve guiding principles for surveillance camera systems in public places. It binds relevant authorities in England and Wales, principally police forces and local authorities, who must have regard to it. Private operators are not bound by it, but its principles on proportionality, transparency and clear responsibility are a reasonable structure for anyone. The Code remains in force.
Separately, hardware and image quality standards exist in the BS EN 62676 series, which is what installers usually mean when they talk about standards. That is a procurement question rather than a compliance one.
Rules for commercial CCTV systems
Commercial operators carry the full weight of the framework because the volume of people recorded is higher and the purposes multiply quickly.
You need a clear and legitimate reason such as crime prevention, and it needs to be evidenced rather than asserted. A defensible file contains a plan of where cameras sit and why, a risk assessment covering theft, unauthorised access and vandalism, a note of the vulnerabilities the cameras address, and a record of whether the footage has in fact been useful.
That justification is not permanent. If the business changes, the case has to be re-made. A retail operation that moves largely online no longer has the same argument for the same camera coverage, and a scheme that has produced nothing useful in three years is difficult to defend as necessary.
Using footage beyond its stated purpose is the most common enforcement trigger. Recording for security and then using the same footage to monitor how long staff spend on breaks is a new purpose that needs its own basis, its own transparency and, in an employment context, its own assessment. The ICO's guidance on monitoring workers is the reference point there.
CCTV in off licences and other licensed premises
This is the layer that catches small businesses, and almost nothing written about UK CCTV addresses it. Questions about CCTV off licences and late-opening venues come up constantly, and the answer is not in data protection law at all.
If you hold a premises licence under the Licensing Act 2003, CCTV is frequently imposed as a condition of that licence, usually at the request of the police in support of the crime and disorder licensing objective. That means the cameras are not optional and the terms are not yours to set. Conditions vary between licensing authorities and between individual licences, so read your own, but the model conditions used around the country follow a recognisable pattern:
Cameras record continuously while the premises are open to the public
Recordings are retained and available for a minimum of 31 days, with accurate date and time stamping
Viewing is made available immediately on request by an officer of a responsible authority, throughout that period
A copy is provided for evidential purposes within a stated window, commonly 48 hours
A member of staff trained in retrieving and viewing footage is on site whenever the premises are open
The licence holder checks regularly, often weekly, that recording works and that footage can be downloaded
Two things follow that are easy to miss.
First, the 31 day minimum is a licensing requirement, not a data protection one, and it overrides your instinct to delete sooner. Your retention policy has to reconcile the two: keep for the licensed period because a condition requires it, then delete, and record that reasoning. A shorter retention period is not more compliant if it breaches your licence.
Second, a trained member of staff able to operate the system is a licence condition, which in practice means the person on shift in an off licence at eleven at night may be the person who has to find and export footage. Whether that same person is equipped to redact third parties before releasing footage to a member of the public is a question most licence holders have never been asked. The next two sections explain why it matters.
High resolution cameras generate large volumes of data, and the management question is less about storage capacity than about control.
Retention should be the shortest period that serves your purpose, subject to any licence condition. Access should be restricted to named roles, and every export should be logged, because an export is the moment footage leaves your control. Footage held for an ongoing investigation or a legal claim should be moved out of the normal deletion cycle deliberately, not by pausing deletion for everything.
Note that where you store footage is itself a processing decision. Handing recordings to a cloud provider makes that provider a processor and requires a contract under Article 28, along with an assessment of any transfer outside the UK. For many operators the simpler answer is to keep footage and any anonymisation work on their own infrastructure, so no raw material leaves the building at all.
Responding to a CCTV subject access request
This is the obligation that turns CCTV from an installation into an ongoing process, and it is where operators most often get it wrong.
Anyone recorded by your cameras can ask for a copy of the footage that is their personal data. You must respond within one month, and the response is free. A fee is only permitted where the request is manifestly unfounded or excessive. The previous version of this article described charging as ethically questionable, which understates it. It is a breach.
The complication is that CCTV footage is almost never about one person. A clip showing the requester in a shop also shows other customers and your staff. Article 15(4) of the UK GDPR provides that the right to obtain a copy must not adversely affect the rights and freedoms of others. Your obligation is to supply the information relating to the requester, not a complete copy of the footage.
The ICO's guidance on video surveillance addresses this directly. Where a response would involve information relating both to the requester and another individual, you may need to seek the consent of third parties where that is reasonable, or alternatively remove or redact the relevant footage. The same guidance advises choosing a system that lets you locate and extract footage in response to a request and allows redaction of third-party information where necessary.
Sending unredacted footage to a requester is therefore not a shortcut. It is a disclosure of other people's personal data, and it is a common enough failure that it appears regularly in complaints to the ICO.
Where Gallio PRO fits
Redacting a clip by hand, frame by frame, is the reason small operators either miss the one month deadline or send footage they should not have sent. Gallio PRO detects faces and license plates automatically across the whole clip and blurs them, so you can release the part that relates to the requester while everyone else in the frame is obscured. The blur is burned into the exported file and cannot be reversed.
Two details matter for this specific job. The software includes an editor, so you can remove the blur from the requester while everyone else stays anonymised, which is exactly the shape of a subject access response. And processing runs on your own computer, so footage that is already sensitive is not uploaded anywhere in order to be redacted.
Automatic detection covers faces and license plates. Anything else identifying in the frame, a name badge, a delivery note, a distinctive uniform, is marked manually. Our guidance onCCTV footage redaction covers the workflow, and there is a worked example in theMZUiM Katowice case study , a municipal roads authority that uses Gallio PRO precisely to answer access requests for city camera footage without exposing third parties.
Download the free demo and try it on a real clip
Police requests are not subject access requests
Operators who learn the redaction rule sometimes over-apply it, and licensed premises are the most exposed to this because both types of request land on the same counter.
A subject access request comes from an individual exercising their own rights, and third parties must be protected. A request from the police, or from a licensing authority or trading standards officer, is a different route entirely. Schedule 2, Part 1, paragraph 2 of the Data Protection Act 2018 provides an exemption where personal data is processed for the prevention or detection of crime, the apprehension or prosecution of offenders, or the assessment or collection of tax, and where applying the usual provisions would be likely to prejudice those purposes.
In plain terms: you generally do not blur an alleged offender out of footage before giving it to the police, because doing so would defeat the point. The exemption is not automatic and it is not a blanket permission, so record what was requested, by whom, under what authority and what you disclosed. But treating a police request like a subject access request, and redacting everyone, can obstruct an investigation and may breach a licence condition requiring footage to be made available.
The working distinction:
| Subject access request | Police or licensing authority request |
|---|
Who asks | An individual, about themselves | A body with a crime prevention or enforcement function |
Deadline | One month | Set by your licence conditions, often immediate viewing and a copy within 48 hours |
Fee | Free | Not applicable |
Third parties | Must be obscured | Normally disclosed, under the Schedule 2 crime exemption |
Record to keep | The request, the response and the redaction decisions | Who asked, under what authority, what was disclosed and why |
Consent, signage and notification
Signage is the primary transparency measure. Signs should be visible before someone enters the recorded area, identify the operator, and say how to get more information. They do not need to be elaborate, but they do need to be present and legible.
On employees, the previous version of this article recommended obtaining written consent. That advice should be treated with care. In an employment relationship consent is rarely a valid lawful basis, because the imbalance of power means it is not freely given, and an employee who can withdraw consent could switch off the security system by doing so. The workable approach is legitimate interests supported by a documented assessment, clear information in the staff privacy notice, consultation where appropriate, and particular caution about cameras in areas where people expect privacy. Rest areas and changing facilities should not be covered at all.
CCTV compliance: what the ICO looks at after deployment
Installation is the easy part. Ongoing CCTV compliance is about whether the scheme still does what you said it would.
Is the justification current? Review whether the cameras are still necessary and still proportionate, and write the review down
Does coverage still match the plan? Cameras get knocked, repositioned and added. Re-check fields of view
Is deletion actually happening? Confirm it rather than assume it. Automatic overwrite that quietly stopped working is a common finding
Are exports logged? You should be able to say who took footage out of the system and why
Can you still meet a request? Time a dry run, including redaction, and see whether one month is comfortable
Is the signage still there and still readable? Signs fade and get removed during refits
Is the privacy notice accurate? It should match the system you have now, not the one you installed
Our article onensuring privacy in video monitoring goes into the operational side in more detail, and there is a sector-specific view in our page onCCTV anonymization for shopping malls .
Additional responsibilities for businesses in CCTV use
Data Protection Officer. Article 37 of the UK GDPR requires a DPO where core activities involve regular and systematic monitoring of data subjects on a large scale, which a substantial camera network can meet. Scale matters here: a single shop with four cameras is unlikely to trigger the duty, while a chain monitoring dozens of sites may. Where a DPO is appointed they need genuine expertise, independence and a direct line to senior management.
Data Protection Impact Assessment. A DPIA is required under Article 35 for systematic monitoring of a publicly accessible area on a large scale. It should be completed before deployment, revisited when the system changes, and kept as evidence. The older term privacy impact assessment refers to the same exercise.
Records and contracts. Cameras belong in your record of processing activities. If a monitoring company watches the feed or an installer holds remote access, that is a processor relationship needing an Article 28 contract.
Rules for domestic CCTV systems
A home system that captures only your own property falls under the domestic purposes exemption and sits outside data protection law. The moment it captures a shared driveway, a neighbour's garden, a pavement or a road, that exemption stops applying and you become a data controller for that footage, with the obligations that follow.
For the concerned individuals who believe their image has been captured on some private property's CCTV camera, they may request its deletion or a copy of the footage for legal or personal purposes. The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA) empower individuals to exercise their privacy rights for privacy protection or arrange proofs for any potential legal proceedings.
That is not merely theoretical. Complaints about neighbours' cameras are among the most common the ICO receives, and a doorbell camera capturing the street is enough to cross the line. Article 8 of the European Convention on Human Rights, brought into UK law by the Human Rights Act 1998, is also in play in disputes between neighbours.
Practical steps for a domestic operator: put up a sign, angle cameras so they cover your property rather than someone else's, use masking for areas you cannot avoid, secure the system with a strong password and current firmware, set a short retention period, and be ready to respond if a neighbour asks for footage of themselves. That last obligation is real. A domestic operator whose camera reaches beyond the boundary can receive a subject access request, and the same rule about protecting third parties applies.
FAQ
Do I need to register CCTV with the ICO?
There is no CCTV register and no process for notifying an intention to install cameras. Most organisations that process personal data must pay an annual data protection fee to the ICO, which is a funding requirement rather than a permission.
How long can CCTV footage be kept in the UK?
Data protection law sets no fixed period. You choose the shortest period that meets your purpose and document it. Licensed premises are usually required by their premises licence to retain footage for a minimum of 31 days, which takes precedence over a shorter policy.
Can someone request CCTV footage of themselves?
Yes. It is a subject access request, you have one month to respond, and it is free. You must provide the information relating to them while protecting other people in the footage.
Do I have to blur other people before releasing CCTV footage?
For a subject access request, yes. Article 15(4) provides that the right to a copy must not adversely affect the rights and freedoms of others, and ICO guidance advises redacting third-party information where necessary.
Do I have to blur faces before giving footage to the police?
Normally no. Schedule 2, Part 1, paragraph 2 of the Data Protection Act 2018 provides an exemption for the prevention and detection of crime where applying the usual rules would prejudice that purpose. Record what you disclosed and on what authority.
Is CCTV a legal requirement for an off licence?
Not by statute, but it is very commonly imposed as a condition of a premises licence under the Licensing Act 2003, typically with a 31 day retention period and an obligation to make footage available to the police. Check the conditions on your own licence, because they vary.
Can I record audio on CCTV?
You can, but audio is treated as significantly more intrusive than images and is hard to justify in a general security scheme. Most operators should disable it.
Does GDPR apply to home CCTV?
Only if the cameras capture areas beyond your own property boundary. If they do, the domestic purposes exemption no longer applies and you take on controller obligations for that footage.
Can I use CCTV to monitor my staff?
Only with a proper basis, transparency and an assessment of the impact on workers. Consent is rarely valid in an employment context. Rest areas and changing facilities should never be covered.
What is the maximum fine for CCTV breaches in the UK?
The higher tier under the UK GDPR is £17.5 million or 4% of total worldwide annual turnover, whichever is greater. The £500,000 figure often quoted online is the maximum under the repealed Data Protection Act 1998.
The bottom line
UK CCTV compliance is less about the cameras than about what happens to the footage afterwards. The framework is knowable: a lawful basis, a DPIA where the scheme is large, honest signage, a retention period you actually enforce, and the ability to answer a request inside a month.
The two operational pinch points are worth stating plainly. You cannot release footage to a member of the public without obscuring everyone else in it, and you generally should not obscure anyone before handing footage to the police. Getting those two the wrong way round is the most common serious mistake in this area, and it is entirely avoidable.
Gallio PRO covers the first of those. It detects and blurs faces and license plates across recorded footage automatically, on your own hardware, with an editor for the parts a machine cannot judge. It is a standalone desktop application rather than a VMS module, so it works alongside whatever system you already have. Seevideo anonymization for the feature detail.
Download the free demo
Sources
Information Commissioner's Office, Guidance on video surveillance (including CCTV). Available at: ico.org.uk
Information Commissioner's Office, A guide to the data protection exemptions. Available at: ico.org.uk
Information Commissioner's Office, The maximum amount of a fine under UK GDPR and DPA 2018. Available at: ico.org.uk
Data Protection Act 2018, Schedule 2, Part 1, paragraph 2, crime and taxation exemption. Available at: legislation.gov.uk
Licensing Act 2003. Available at: legislation.gov.uk
Protection of Freedoms Act 2012, sections 29 to 33, and the Surveillance Camera Code of Practice. Available at: legislation.gov.uk
British Standards Institution, BS 7958:2015 Closed circuit television (CCTV). Management and operation. Code of practice.
Regulation (EU) 2016/679 as retained in UK law (UK GDPR), in particular Articles 5, 6, 15, 28, 35 and 37.
This article is general information about the law in England and Wales, not legal advice. Licence conditions vary between licensing authorities, and Scotland and Northern Ireland differ in places. Check your own licence and take advice on your own facts.
