In short
Business CCTV is legal in the UK when it is run as what it is, a data processing activity: you need a stated purpose, visible signage, registration with the Information Commissioner's Office, secure storage with limited access, and footage kept no longer than the purpose needs. People you record can request their footage, and cameras must not watch more than the purpose justifies.
This is a plain-English summary of the rules, not legal advice. The Information Commissioner's Office publishes the authoritative guidance.
Most businesses fit CCTV to protect the premises and never think about the recordings again until something happens. The law thinks about the recordings constantly, because footage of identifiable people is personal data, and that single fact is where every obligation below comes from: UK GDPR and the Data Protection Act 2018 treat your recorder the way they treat your customer database.
None of it is onerous once it is set up properly. Here is what a compliant business system looks like, obligation by obligation.
What the rules require of a business system
A stated purpose, and cameras that match it
You need a documented reason for recording, typically preventing crime and protecting staff, premises and stock, and the cameras have to be justifiable against it. A camera on the entrance, the till and the yard matches a security purpose. A camera positioned to watch how quickly staff work does not, and monitoring staff performance by CCTV attracts much stricter scrutiny. Areas with a strong expectation of privacy, toilets and changing rooms above all, are effectively off limits except in extraordinary documented circumstances.
Signage that tells people they are on camera
Clear, visible signs at the entrances and within the covered areas, saying that CCTV is in operation, why, and who runs it, with contact details. Covert recording without signage is lawful only in narrow, documented investigations and is not a way to run day-to-day security.
Registration with the Information Commissioner's Office
A business operating CCTV for crime prevention is processing personal data and needs to be registered with the Information Commissioner's Office and to pay the data protection fee, which is an annual registration most businesses already hold for their other data. CCTV simply needs to be within it.
Secure storage and limited access
The recorder and its footage need protecting the way you protect any personal data: physically secure, password protected with the default credentials changed, and viewable only by the people who need it for the stated purpose. Footage shown around the office for entertainment is a data protection breach with a camera attached.
Retention no longer than the purpose needs
There is no fixed legal retention period for business CCTV. The rule is only as long as necessary for the purpose, and for routine security most businesses land around thirty days, keeping specific clips longer where an incident is being investigated. What fails the test is keeping everything forever because the hard drive happens to be big enough.
The rights of the people you record
Anyone identifiable in your footage, staff, customers or passers-by, can make a subject access request and receive a copy of their footage, normally within a month and free of charge. Other people in the frame may need blurring before release. Police can request footage for investigations, and providing it for that purpose is permitted; handing it to anyone else who asks is not.
Two boundary cases catch businesses out. Cameras should not overlook neighbouring property or public space beyond what the purpose justifies, so aim and mask views past your boundary. And audio recording is treated as significantly more intrusive than video: continuous audio on business premises is very hard to justify, and most compliant systems simply leave microphones off.
The one-page setup that keeps you right
In practice, compliance is a short checklist done once and reviewed yearly: a written purpose, a camera plan that matches it, signs at the entrances, the Information Commissioner's Office registration current, named people with access, a retention setting on the recorder, and a note of who handles footage requests. Set up that way, the system protects the business twice over, once against intruders and once against the complaint that turns a burglary inquiry into a data protection one.
How Core Comms can help
We design and fit business CCTV installation across Manchester, the North West and West Yorkshire, and compliant is the only way we install: cameras justified against your stated purpose, privacy masking where views cross a boundary, signage, hardened recorder access and retention configured before handover. The same DBS-checked engineers handle CCTV installation for homes and businesses alike.
If you are fitting cameras or unsure the system you inherited would survive a footage request, talk to our team or call 0330 838 1000 for a free site survey.
Ready to fix your office network?
Talk to Core Comms about a network review and we'll help you get to the root of the problem.
Get in touch