CCTV and GDPR: UK Rules and What AI Changes

UK GDPR applies to any business CCTV that records people who can be identified. You need to pay the ICO's data protection fee (from £52 a year), write down why each camera is there, put up signs, delete footage on a schedule and hand over a person's own footage within one month if they ask. Almost every site also needs a written risk assessment called a DPIA. Adding AI means updating it, and face recognition adds a much higher legal bar.

Below is each duty, what the 2025 Act altered, and what analytics adds. We build AI on top of existing CCTV, so data protection shapes how we design every system. We are engineers, not solicitors: treat this as a map of the ICO's guidance, and take legal advice before anything involving faces or staff discipline.

Do GDPR and the Data Protection Act apply to CCTV?

Yes. Footage of a person who can be identified is personal data, and the business that decides what the cameras record and why is the "controller", the party the law holds responsible. That is true for one camera over a shop till and for 200 across a warehouse. The ICO is clear that watching a live feed counts too, even when nothing is recorded.

The law is the UK GDPR and the Data Protection Act 2018, both amended by the Data (Use and Access) Act 2025. People still say "the Data Protection Act" for all of it. The EU's GDPR asks for broadly the same things, so a business with sites in Ireland or France can start from one policy. The US has no federal equivalent.

Home CCTV and doorbell cameras

The one exemption is a camera on your own home that sees only your own property. It does not stretch to a home office with staff, a rented-out property or a camera a business puts on a director's house. And it ends at the boundary: the ICO's guidance on home CCTV says that once a camera or video doorbell records the street, a shared path or a neighbour's garden, data protection law applies. A householder then has to capture no more than they need, put up a sign, keep footage secure, delete it regularly and answer a neighbour who asks for footage of themselves.

CCTV data protection: what UK GDPR requires

Nine duties cover almost every system, and most rows below link to their section. None needs a lawyer or special software. The common failures are paperwork that was never written, not cameras in the wrong place.

Security has a deadline attached. If footage is lost, stolen or leaked (a recorder taken in a break-in, a clip posted to a staff group chat), you must report it to the ICO within 72 hours of finding out, unless it is unlikely to put anyone at risk.

The ICO says sound recording should be switched off by default and used only where you can show a specific need. Some cameras ship with the microphone on. Check yours.

Do you need to register CCTV with the ICO?

In almost every case, yes. There is no separate CCTV registration. A business that uses CCTV is processing personal data, so it must pay the ICO's data protection fee unless it is exempt. The ICO's surveillance guidance says so directly: a controller whose cameras record identifiable people has to register and pay. If you already pay the fee for customer or staff records, you do not pay again for the cameras.

Those are the fees since 17 February 2025; older pages still quote £40, £60 and £2,900. Paying by direct debit takes £5 off. Charities pay tier 1 whatever their size. The ICO's self-assessment tells you whether you are exempt and which tier applies.

What lawful basis covers CCTV?

You need a lawful basis, one of the legal reasons for using personal data listed in Article 6 of UK GDPR, written down before the cameras go live. Consent rarely works, because a visitor cannot meaningfully refuse. Private businesses usually rely on legitimate interests: you have a real reason (theft, staff safety, evidence for insurance claims), the cameras are necessary for it, and you have weighed that against the privacy of the people recorded. That weighing is a one-page note called a legitimate interests assessment.

There is now a second option. The Data (Use and Access) Act added recognised legitimate interest, a short list of purposes Parliament has already approved, including preventing, detecting and investigating crime. For those purposes you no longer have to do the balancing step. You must still show the cameras are necessary, and every other duty in this guide still applies. Public authorities cannot use it for their public tasks; state schools, councils and other public bodies normally rely on the "public task" basis instead.

Our view: keep the one-page balancing note anyway. The ICO says you do not have to switch basis, its CCTV guidance has not yet been rewritten for the new Act, and few systems are used for crime alone. The moment footage settles a delivery dispute or a slip-and-fall claim, you are outside the pre-approved list and back to ordinary legitimate interests.

Whatever the basis, the purpose limits what you can do with the footage. GOV.UK puts it bluntly: a system set up to detect crime must not be used to monitor how much work your staff do.

Can business CCTV cover the street or a neighbour?

Only as much as the purpose needs. A camera on your entrance will usually catch some pavement, and that is acceptable if you can say why. A camera that takes in the whole road, or looks into a flat, is not. The ICO's own example is a café whose entrance camera could see into a nearby flat: the owner narrowed the view to the door.

Three fixes, in the order we would try them:

1. Re-aim the camera or fit a narrower lens.
2. Use the privacy mask in the camera's settings, which blacks out part of the picture before it is recorded. Most network cameras have one.
3. If part of the public area has to stay in view, write the reason in the DPIA and make sure a sign is readable from that area.

What must a CCTV sign say?

The ICO asks for three things on the sign:

• who operates the system, unless it is obvious (a camera inside a shop is the shop's);
• why it is there;
• a way to get in touch: a phone number, email address or website.

The ICO's example wording, with blanks for your details, is a good template:

Images are being monitored and recorded for the purposes of crime prevention and public safety. This system is controlled by [name]. For more information, visit our website at [web address] or call [number].

Put signs where people read them before they walk into view, not under the camera. Size them for the reader: a sign for drivers entering a yard needs to be far larger than one on a shop door. Every entrance and every separately covered area, such as a rear car park, needs its own. If you record sound, or use analytics people would not expect such as number plate or face recognition, the sign should say so.

A sign cannot hold everything the law wants people to be told, so it points to a fuller privacy notice: a page on your website and a section in the staff handbook. Keep it short. It should say:

• who the controller is and how to reach them;
• what the cameras are for and the lawful basis;
• where they are and whether they record sound or run analytics;
• how long footage is kept;
• who it may be shared with, such as the police, insurers or a monitoring company;
• how to request footage, how to complain to you, and the right to complain to the ICO.

The same page, with the names of the people allowed to view footage added, is most of a CCTV policy.

How long can you keep CCTV footage?

The law sets no number. The ICO's guidance says UK GDPR and the Data Protection Act "do not prescribe any specific minimum or maximum retention periods", and that the period should be the shortest your purpose needs. The 30 or 31 days that installers quote, sometimes as "the ICO's default", is a convention. It is a reasonable one for most sites, because theft and damage usually come to light within a month, but you have to be able to say why it fits yours.

The ICO rules out two common habits:

• Letting the disk decide. Its example is footage kept for six months "merely because the manufacturer's settings" allow it.
• Keeping footage "just in case" it is useful one day.

In practice: set the overwrite period on the recorder, write the number and the reason in your policy, and export the clip when something happens. An exported clip of an incident can be kept for as long as the claim or investigation runs. On cloud systems retention is something you pay for, which is one more reason to choose it on purpose; our Verkada price breakdown shows the same camera costing almost five times as much with 365 days of storage as with 30.

Who can ask to see CCTV footage?

Three groups ask, and the rules differ for each. The ICO covers all three in its guidance on running a system.

The person in the footage

Anyone can ask for footage of themselves. This is a subject access request, or SAR. You must answer within one month, free of charge. The deadline can stretch by two more months if the request is complex, and you can charge a reasonable fee only if a request is clearly unfounded or repetitive (the law says "manifestly unfounded or excessive").

They are entitled to their own images, not everyone else's. Blur or mask other people before you hand a clip over, or ask those people for consent where that is realistic. You can invite the person in to view the footage if they agree, but if they want a copy you must provide one. Since the 2025 Act the law says outright that your search only has to be reasonable and proportionate, so ask for the date, time, place and what they were wearing.

This is the duty that catches small sites out. Some recorders cannot blur at all. Before you need it, check whether yours can, and if not, find a redaction tool or a service that will do it within the month.

The police

The ICO says it is appropriate in most cases to give footage to law enforcement, but unless there is a court order it is voluntary. Ask for the request in writing, hand over only the relevant clip, and log what you gave, to whom and when. The 2025 Act made this easier: when a public body tells you it needs the footage for its official functions, you no longer have to judge whether that is true.

Everyone else

Insurers, solicitors, a driver whose car was scraped in your car park, a neighbour. The ICO tells you to treat these with care and confirms you can refuse unless a court orders otherwise. Staff who pass footage to someone outside the business without permission, or post it online, may be committing a criminal offence under section 170 of the Data Protection Act 2018.

Do you need a DPIA for CCTV?

A data protection impact assessment (DPIA) is a written check of what could go wrong for the people you record and what you do to reduce it. The ICO says it is a legal requirement for surveillance likely to be high risk and that this "applies in most cases" of video surveillance. It names three triggers:

• monitoring people at a workplace;
• monitoring publicly accessible places on a large scale;
• processing special category data, the sensitive kinds the law protects most, which includes recognising faces.

Nearly every business camera films staff, so assume you need one. If you decide you do not, the ICO expects the reasons in writing. A DPIA has four parts:

1. What the system does, where, and for what purpose.
2. Why it is necessary and proportionate, including the milder options you ruled out (better lighting, a fence, a lock).
3. The risks to the people recorded.
4. What you do about each risk.

For a small site that can be a few pages, and the Surveillance Camera Commissioner and the ICO published a DPIA template made for cameras. Do it before the system goes live, consult staff while you write it, and update it when the system changes. If a high risk remains that you cannot reduce, you must consult the ICO before you switch on.

Skipping it is a breach in its own right. In July 2024 the ICO reprimanded an Essex school that introduced face recognition for canteen payments without one.

What AI changes

The same law applies once AI is added, but you have more to show. The more the software learns about each person, the more the ICO expects on paper.

Face recognition is where businesses come unstuck. In February 2024 the ICO ordered Serco Leisure to stop using face recognition and fingerprint scanning to clock in more than 2,000 staff at 38 leisure centres, because an ID card or fob would have done the same job. That is the test to apply to any analytic: is there a less intrusive way to get the same result?

Most of what a business wants from AI passes that test easily. Knowing that somebody is in the yard at 2am does not need to know who they are. Our guide to which CCTV analytics can be trusted rates each type, and the overview of adding AI to existing CCTV covers cost and cameras.

Where the AI runs matters

If video leaves the building for a cloud service to analyse, that provider is your "processor", a company handling footage on your instructions. You need a written contract under Article 28 of UK GDPR and you need to know which country the footage is stored in. If the AI runs on a box on site and only alerts leave, far less personal data moves and the DPIA is shorter.

That is how we build. For a UK CCTV security company we designed trespass and violence detection so that footage stays on the customer's site, with 15 to 20 cameras handled by one on-site graphics card. For Angel Protection's weapon detection across 1,000+ cameras, only a timestamp and a cropped image leave the building. Our cloud CCTV comparison goes through the trade-offs if you are weighing the two.

Six questions to ask an AI CCTV supplier

1. Does video leave our site, and if so to which country?
2. Will you sign a data processing contract?
3. Is our footage used to train your models?
4. Can face recognition and audio be switched off, and are they off by default?
5. Can the system blur other people when we export a clip?
6. Can it delete automatically after the period we set, on every camera?

CCTV that films staff

Cameras for security that also happen to film employees are normal and lawful. The ICO's guidance on monitoring workers asks for more:

• Consult staff or their union, ideally while writing the DPIA.
• Tell them in writing what is recorded, where and why.
• Keep cameras to areas of real risk and out of rest areas, toilets and changing rooms.
• Do not use security footage for discipline or performance unless your policy says you may.

Hidden cameras are for very exceptional cases, such as suspected crime. The ICO says covert monitoring is unlikely to be justified in most circumstances, should be authorised by senior management and needs a DPIA first.

What changed in 2026?

The Data (Use and Access) Act 2025 amended UK GDPR in stages between June 2025 and June 2026, and the ICO confirmed in June 2026 that all of its data protection provisions are in force. It did not replace UK GDPR. Four changes touch ordinary CCTV.

A fifth matters once software makes decisions: the Act widened when significant automated decisions are allowed, provided safeguards are in place, but not where special category data such as faces is involved. The complaints duty is the only one that makes you do something. A named email address on your CCTV policy and website, and someone who reads it, is enough for a small business. The ICO's video surveillance guidance is marked as under review because of the Act, so expect its wording to change.

What happens if you get it wrong?

The ceiling is a fine of £17.5 million or 4% of worldwide turnover, whichever is higher, and £8.7 million or 2% for lesser breaches such as a missing DPIA. Those numbers are for the worst cases at the largest companies.

The two camera cases above ended differently: an order to stop and delete the data for Serco, and a public reprimand for the school. For a business that has built a process around a system, being told to switch it off within three months, as Serco was, costs more than most fines would. Complaints usually start with one unhappy person, often an employee or a neighbour, which is why signs, a contact address and a prompt answer to footage requests prevent most trouble.

Where to start

1. Check you are on the ICO's register of fee payers. Pay if not.
2. List every camera with one line on why it is there. Remove or re-aim any you cannot justify.
3. Fix the signs: name, purpose, contact. Publish the privacy notice.
4. Set the overwrite period on the recorder and write it down.
5. Give each person who views footage their own login. Change the default password.
6. Run a practice footage request: find a clip of yourself, blur a colleague, export it.
7. Write the DPIA, even a short one, and date it.
8. Before adding AI, update the DPIA first. It will tell you which features to leave off.

If you are planning analytics on cameras you already own, our computer vision feasibility study (£4,000 to £6,000, credited to the build) can map the data flow you need for the DPIA: what is processed, where, and what leaves the site.

Questions

Who can view CCTV footage in the UK?

Only people the business has authorised, for the purpose the cameras were installed for. Outside the business, a person can request footage of themselves, and the police can ask for footage, which you may give voluntarily. Anyone else can be refused unless a court orders it.

Can I share CCTV footage?

With the police, yes, and it is your choice unless a court orders it. With insurers or solicitors, at your discretion, and only the relevant clip. Posting a suspect's picture on social media or in the shop window is rarely justified and is the quickest route to a complaint.

Can an employer watch staff on CCTV all day?

Security cameras that also film staff are lawful if staff have been told. Continuous monitoring of particular individuals is, in the ICO's words, only likely to be justified in the rarest of circumstances. Staff cannot simply opt out of security cameras, but they can object, request their own footage and complain.

Is the Data Protection Act 2018 still current?

Yes. It sits alongside UK GDPR and was amended, not replaced, by the Data (Use and Access) Act 2025. CCTV rules come from both.

Do you legally have to tell people you have CCTV?

Yes. Businesses must tell people they may be recorded, normally with clearly visible signs that say who runs the system, why, and how to make contact. Hidden cameras are lawful only in very exceptional circumstances.

Can I request CCTV footage of myself under GDPR?

Yes. Ask the business in writing, giving the date, time and place and a description of yourself. It must respond within one month and cannot normally charge. It will blur other people, and it cannot give you footage that has already been deleted under its retention schedule.

Does GDPR apply to home CCTV and doorbell cameras?

Not if the camera only covers your own property. If it captures the street, a shared space or a neighbour's garden, data protection law applies: you need a sign, secure storage, regular deletion and a way to answer a neighbour who asks for footage of themselves.

Can CCTV record sound?

Yes, but only with a specific reason. The ICO regards audio as more intrusive than video and says it should be off by default, used only for a specific, evidenced need, and made clear to people on top of the usual signs.

Is AI CCTV legal under GDPR?

Yes. Person and vehicle detection sits under the same rules as ordinary CCTV, with a DPIA that describes what the software does. Face recognition is lawful only with one of the listed exceptions in Article 9 and a strong case that nothing less intrusive would work.

Is GDPR changing in 2026?

It already has. The Data (Use and Access) Act 2025 was fully in force by June 2026. For CCTV it adds a pre-approved lawful basis for crime prevention, simpler disclosure to the police, proportionate searches for footage requests and a duty to handle complaints.