What are the laws on CCTV cameras in the workplace?
Employers must be clear about why they are using CCTV, must tell people that monitoring is taking place and must use the footage fairly.
If cameras are introduced for site security, it won’t usually be reasonable to use the footage to monitor staff behaviour or as evidence in disciplinary action unless that possibility has been clearly explained.
Employers must also respect reasonable expectations of privacy. For instance, cameras should not be installed in toilets, changing areas or similar spaces where people would clearly expect privacy.
Covert monitoring is even more sensitive. It should only be considered in exceptional circumstances, such as a time-limited investigation into suspected serious misconduct, and only where a less intrusive option would not work.
Does a CCTV camera in a workplace require a privacy notice?
Yes.
If your business uses CCTV, you must inform people that monitoring is taking place, why it is taking place and who controls the system. In practice, this usually means a combination of visible signage and fuller privacy information.
Your signs should be clear, easy to see and easy to understand.
They should tell people that CCTV is in operation and explain where they can find further information – for instance in an online privacy notice.
Your privacy notice should explain the purpose of the monitoring, your lawful basis for processing, who footage may be shared with, how long it is kept and how individuals can exercise their rights.
A simple CCTV privacy notice example might say:
“CCTV operates at these premises for security, safety and incident investigation purposes. GRC Solutions is the controller of this footage. For more information about how we use CCTV, how long footage is retained and how to exercise your rights, please contact [insert details] or see our privacy notice at [URL]”
That will not suit every organisation, but it shows the kind of information people should be given.
Can business CCTV cover the street?
Sometimes it can, but only where it is justified and limited.
If a camera unavoidably captures a small part of a public road or pavement while monitoring an entrance or delivery area, for example, that may be acceptable.
What matters is whether that view is necessary for the stated purpose.
You should not capture more than you need.
If a camera can be repositioned to avoid neighbouring property or unnecessary public space, it should be.
If privacy masking, filters or narrower camera angles can reduce unnecessary capture, those steps should be considered.
This is one of the clearest areas where poor setup can create risk.
A system installed for legitimate security reasons can quickly become disproportionate if it records large areas of public space without a good reason.
How long does a company have to keep CCTV footage?
There is no single fixed legal retention period.
Under the GDPR, personal data must not be kept for longer than necessary for the purpose for which it was collected.
That means retention should be based on actual need, not habit or convenience.
A business should define and document its own CCTV retention policy, which it should be able to justify.
For some organisations, a short retention period may be enough for routine monitoring.
In other cases, footage may need to be kept longer where it is relevant to an incident, an investigation or legal proceedings.
What matters is that the retention period is documented, justified and applied consistently.
Automatic deletion is usually sensible, because it reduces the risk of footage being kept indefinitely without a valid reason.
Who can legally view CCTV footage?
Only people with a genuine and authorised reason should have access.
That may include nominated security staff, certain managers, HR personnel or investigators, depending on the circumstances. Access should not be informal or unrestricted.
Businesses should know who can view footage, why they can view it and what controls apply.
This is where role-based permissions, secure storage and access logging become important.
Individuals who appear in footage may also have rights to access their personal data through a DSAR (data subject access request).
If the footage includes other people, the organisation may need to blur or otherwise redact third parties before disclosure.
Businesses may also share footage with the police or other authorities where there is a lawful basis for doing so.
A disclosure log is good practice and helps demonstrate accountability.