CCTV in the Workplace: UK Law for Employers and Staff

UK employers can use CCTV in the workplace if they have a real reason for it, such as security or safety, tell staff what is recorded and why, and keep cameras out of private areas. No law bans it. Data protection and human rights law set the limits, and they tighten sharply for hidden cameras, sound recording and watching how people work.

This guide covers where cameras can go, what you can do with the footage, what staff can ask for, and what changes when AI is added. We build AI on top of existing CCTV. We are engineers, not solicitors: this follows the regulator's published guidance, and you should take legal advice before a dismissal or a hidden camera.

Is CCTV in the workplace legal in the UK?

Yes. There is no single "workplace CCTV act". Five pieces of law do the work, and the first one covers most of what an employer has to do. The Information Commissioner's Office (ICO), the UK data protection regulator, publishes the guidance that tells you how to apply it.

One law that many guides cite does not apply to most readers. The Regulation of Investigatory Powers Act 2000 sets up authorisations for covert surveillance by public authorities such as the police and councils. A private business does not apply for one. Its hidden camera is judged under data protection and human rights law, covered below.

Two general duties apply before any of the staff rules. A business with CCTV pays the ICO's data protection fee: £52 a year for a micro business, £78 for a small or medium one and £3,763 for a large one, and one fee covers the whole organisation. And every covered area needs a sign saying who runs the cameras, why, and how to get in touch. Those duties, with retention and footage requests, are in our guide to CCTV and GDPR. This page is about what is different when the people on camera work for you.

What the law asks of an employer

The ICO's guidance on monitoring workers says data protection law "does not prevent you from monitoring workers", but you must be clear about your purpose and "select the least intrusive means to achieve it". In practice that comes down to seven things.

Staff consent is not on the list. The ICO says consent "is not usually appropriate in the employment context" because an employee is unlikely to feel free to say no. Most employers rely on legitimate interests instead: a real need, weighed against the effect on staff and written down. For cameras whose only purpose is preventing or detecting crime, the Data (Use and Access) Act 2025's recognised legitimate interest removes the weighing, but not the need to show the camera is necessary. A clause in the contract saying "you agree to CCTV" does not make excessive monitoring lawful.

Where can cameras go in a workplace?

The test is how much privacy a person can reasonably expect in that spot. The European Court of Human Rights put it as a scale: the expectation is "very high" in toilets and cloakrooms, "high in closed working areas such as offices" and "manifestly lower" in places open to colleagues or the public. The ICO's guidance follows the same logic.

The ICO gives a worked example. Staff report thefts from a changing room and the employer wants a camera inside. That is unfair, so the employer puts one on the door outside, with signs, runs it only for the length of the investigation and destroys what is not relevant. The camera still narrows down who went in and when.

Can an employer watch staff on CCTV?

An employer can view live or recorded footage for the purpose the cameras were installed for: checking an alarm, reviewing an incident, investigating a theft. Watching a live feed counts as using personal data even when nothing is recorded, so the same rules apply to a manager's phone app as to the recorder.

What the law does not support is a manager watching particular people as a habit. The ICO's video surveillance guidance says "continuous video or audio monitoring of particular individuals is only likely to be justified in the rarest of circumstances". Three cases come up most:

• Viewing from home or a phone. Lawful if the person is authorised and has a reason. Give each viewer their own login so the recorder logs who watched what, and say in the policy that remote viewing happens.
• Checking who arrived late. Not covered by a "security" purpose. If you want footage for timekeeping, say so in the policy first, and expect to explain why a clocking system would not do.
• Phoning the shop about what you just saw. The ICO notes that workers "base their expectations of privacy on practice, as well as policy". If the policy says cameras are for security and the owner comments on chatting at the till, the policy no longer describes what is happening.

Can CCTV be used for discipline or performance?

Yes for serious misconduct such as theft or violence, which a security camera is there to catch. For routine performance or timekeeping, only if staff were told beforehand. The ICO's CCTV guide for small organisations is direct: "If you install CCTV for security reasons, it won't usually be fair on your staff to use it to monitor or discipline them without warning." You can change what footage is used for only if the new use is compatible with the original one, staff consent, or a law requires it.

The practical fix is one paragraph in the CCTV policy, written before you need it:

• Footage may be used to investigate suspected theft, violence, harassment, safety breaches and other gross misconduct.
• It will not be used for routine checks on performance or timekeeping.
• Who decides to pull footage, and who else sees it.

Then follow a fair process. The Code of Practice on disciplinary procedures from Acas, the public body that advises on workplace disputes, is the minimum a tribunal expects. Show the employee the footage before the hearing and let them explain it, as the ICO says workers should be able to see and challenge the results of monitoring. Footage of a suspected theft is also "criminal offence data", a category the law protects more strictly, so keep the clip to the few people running the investigation.

Using cameras to measure performance is a different system from security CCTV, and the ICO lists "monitoring that may result in financial loss (such as performance management)" as an example of high-risk processing, the point at which a DPIA becomes a legal requirement. Our view: a supervisor on the floor or figures from the till usually answer the question with less trouble.

Can workplace CCTV record sound?

Rarely. Many cameras ship with a microphone, and the ICO says the audio should be "switched off by default". Its guidance calls recording conversations between members of the public "highly intrusive and unlikely to be justifiable in most circumstances", and it says surveillance of staff, audio above all, should be rare. To turn it on you need:

• A specific problem you can evidence, such as repeated verbal abuse of staff at a counter.
• A record that less intrusive options were tried or would not work.
• Signs and a policy that say sound is recorded, on top of the CCTV sign.
• Where possible, a trigger rather than continuous recording. The ICO's small business guide suggests a button staff press.

Recorded business phone calls have their own rules and are not covered here.

Are hidden cameras legal at work?

Sometimes, briefly, for something serious. The ICO says covert monitoring is unlikely to be justified "in most usual circumstances" but may be where it is "necessary to enable you to prevent or detect suspected criminal activity or gross misconduct". Its conditions:

• Senior management authorises it.
• A DPIA is done first. The guidance says "must" here, not "should".
• It targets specific suspected wrongdoing, for the shortest time that will get evidence.
• It stops when the investigation ends.
• Not in toilets, changing rooms or other places staff expect to be private.
• As few people as possible know about it or see the footage.
• Anything else it captures is disregarded and destroyed, unless it shows something no employer could reasonably ignore.

The leading case shows what "serious" looks like. López Ribalda v Spain (European Court of Human Rights, Grand Chamber, 17 October 2019) concerned a supermarket whose stock losses rose from €7,780 in February 2009 to €24,614 in June. The manager installed visible cameras at the entrances and exits, which staff were told about, and hidden ones over the tills, which they were not. The hidden cameras ran for ten days and stopped once those responsible were identified. Fourteen employees were dismissed, and five took the case to Strasbourg. The court held by 14 votes to 3 that their right to private life had not been breached.

The court refused to accept that "the slightest suspicion" justifies a hidden camera. What tipped it was reasonable suspicion of serious misconduct, large losses, a public area, ten days, and footage seen by three people. UK courts take these judgments into account, and the ICO's conditions ask for the same things. A hidden camera to catch someone taking long breaks would fail every one of them.

What changes when AI is added to cameras that film staff?

The cameras stay where they are, but software now reads every frame. Whether that is a legal change depends on one question: does the system learn something about a named person, or only that something happened?

The ICO has already acted on the last row. In February 2024 it ordered Serco Leisure to stop using face recognition and fingerprint scanning to clock in more than 2,000 staff at 38 leisure centres, and to destroy the data within three months. Staff had been given no real alternative, when ID cards or fobs would have done the job.

A person has to make the final decision. A decision with a real effect on someone, such as docking pay or dismissal, made with no meaningful human involvement falls under UK GDPR's rules on solely automated decisions. The ICO's example of doing it properly is a manager who reviews the data and speaks to the worker before issuing a warning. The Data (Use and Access) Act 2025 relaxed parts of those rules, but not where faces or other biometric data are involved.

Our rule when we design these systems is to detect events, not people. For a UK CCTV security company we built real-time trespass and violence detection that runs on a computer on site, so footage stays in the building. Our weapon detection for Angel Protection, live on more than 1,000 cameras, sends out only a timestamp and a cropped image when it detects something. An alert about an event in a place, with no name attached, is far easier to justify than a score per employee. Which kinds of detection are reliable enough to act on is covered in our guide to CCTV analytics, and the wider picture in how AI CCTV works.

If you buy a product instead, the ICO warns that you "should not assume that packages you purchase are compliant". Ask the supplier which features identify individuals, whether they can be switched off, and where the video is processed.

What should a workplace CCTV policy say?

One or two pages in the staff handbook, covering:

• Which areas are covered and which are not.
• The purpose of the cameras in each area.
• Who can view live and recorded footage, including remotely.
• How long footage is kept, and when a clip is kept longer.
• Whether footage can be used in disciplinary cases, and for what.
• Whether sound is recorded, and if so where and why.
• Any analytics or AI running on the cameras and what it detects.
• How to ask for your own footage and how to complain.

A template from the internet will not know your site. Write it from the camera list, and change it when the cameras or their use change.

What rights do employees have?

Staff cannot opt out of lawful security cameras, but they have five rights that matter. If you are an employee reading this, start with the first two: ask for the CCTV policy, then ask for your footage.

1. To be told. What is recorded, where, why, who sees it and how long it is kept. Hidden cameras are the narrow exception above.
2. To see their own footage. A request needs no form and no reason. The employer has one month, or up to three if the request is complex. Other people in shot are blurred where needed. Our CCTV and GDPR guide explains how to handle a footage request.
3. To object. Where the employer relies on legitimate interests, a worker can object with reasons based on their own situation. The employer can refuse if it shows compelling grounds, and must explain the decision.
4. To complain. First to the employer, which since 2026 must give people a way to complain about how their data is used and acknowledge it within 30 days, a duty added by the Data (Use and Access) Act 2025. Then to the ICO, which can order an employer to stop, as it did with Serco.
5. To go to a tribunal, as a last resort. GOV.UK's guidance on being monitored at work says a worker whose contract or handbook does not allow the monitoring "might be able to resign and claim unfair ('constructive') dismissal", after trying to sort the problem out first.

Do the people watching CCTV need a licence?

Usually not if they are your own employees. The Security Industry Authority (SIA), which licenses private security work, says you do not usually need a licence when working in-house. A public space surveillance (CCTV) licence is needed when someone supplied under a contract, such as a guard from a security company or a remote monitoring centre, uses CCTV to watch people in order to guard premises against disorder or damage, or to protect people from assault. The exception is door supervision at licensed premises such as pubs and clubs, where in-house staff need a licence too. If you outsource monitoring, ask the supplier for its operators' licence numbers.

Where to start

1. Walk the site with a list of cameras. Write one line on why each is there. Re-aim or remove any that film a break room, the inside of a changing room or a single desk.
2. Check every microphone is off unless you have written down why it is on.
3. Write or update the CCTV policy. Put it in the handbook and tell staff it has changed.
4. Ask staff or their reps for views and keep a note of what they said.
5. Write the DPIA, even a short one, and date it.
6. Give each viewer their own login and remove the shared one.
7. Before adding AI, list what each feature learns about a named person. Switch off what you cannot justify.

If you are planning analytics on cameras that film staff, our computer vision feasibility study (£4,000 to £6,000, credited to the build) can set out what the system would process, where it runs and what leaves the site, which is the technical half of the DPIA.

Questions

Can my boss watch me on camera all day?

Cameras that cover your work area for security or safety are lawful if you were told about them. A manager watching you in particular, continuously, is not, outside very rare cases. If you think it is happening, ask for the CCTV policy and compare it with what you see.

Does my employer have to tell me about CCTV at work?

Yes. Employers must tell workers what is monitored and why, normally through a policy and signs. The only exception is short, targeted covert monitoring of suspected crime or gross misconduct.

Is it illegal to record sound on CCTV at work in the UK?

Not automatically, but it is hard to justify. The ICO expects audio to be off by default and used only for a specific, evidenced problem, with signs saying sound is recorded. Secretly recording staff conversations would be very difficult to defend.

Can I refuse to be on camera at work?

Not if the cameras are lawful. Consent is not the basis employers rely on, so there is nothing to withhold. You can object in writing with reasons specific to you, and the employer must consider it and reply.

Can my employer watch CCTV from home?

Yes, if they are authorised to view footage and are doing it for the purpose in the policy, such as checking an alarm. The location of the screen does not change the rules. Viewing out of curiosity, or to keep an eye on one person, is not covered.

Can my employer watch me through my laptop camera?

Very unlikely to be lawful. The ICO's example is an employer that uses automatic webcam images to check remote workers have started on time: "likely to infringe data protection law because it is disproportionate", when login times would answer the same question. The ICO adds that the expectation of privacy is "significantly greater at home".

Who else can see workplace CCTV footage?

Only the people named in the policy, plus anyone the footage is properly disclosed to. The police can ask for a clip and it is usually right to give it, though without a court order it is voluntary. Insurers and solicitors can be refused. A colleague who copies footage out of the system or posts it online may be committing a criminal offence. See who can ask to see CCTV footage.

How long can an employer keep CCTV footage of staff?

The law sets no number. Footage should be deleted once the purpose is served, and a clip kept longer only for a live investigation, claim or dispute. Many businesses set the recorder to 30 or 31 days, which is a convention, not an ICO rule. See how long to keep CCTV footage.

What counts as unlawful use of CCTV at work?

The common ones: cameras inside toilets or changing rooms, hidden cameras without serious grounds, sound recorded without a specific reason, security footage used for a purpose staff were never told about, and clips copied or posted outside the business.

What are the new CCTV laws in the UK?

There is no new CCTV law, but the Data (Use and Access) Act 2025 changed data protection rules that apply to cameras, including a new duty to handle complaints. The ICO's guidance on monitoring workers and on video surveillance is marked as under review because of it. Our summary of what changed for CCTV in 2026 has the detail.