A business CCTV system passes an audit when its written spec states the purpose, retention period, evidential target, time source and access rules, and the handover file proves each one was configured. Cameras and recorders are the easy part. Auditors, insurers and the ICO test the paperwork and settings. This guide is general guidance, so check the ICO's published CCTV guidance and the standard itself for the exact requirements that apply to your premises.
What do auditors and insurers check on CCTV for business premises?
They check evidence of intent (a documented purpose), control (access, retention, logs) and quality (footage that identifies someone, with a trustworthy timestamp).
The sections below follow that order. First comes the paperwork that justifies the system, then who can reach the recorder and how long it keeps footage. Last is the camera and recorder specification that decides whether an image is usable. This holds for business CCTV systems of any size, from one shop to several units.
In the extracts we reviewed, regulation guides and installer pages stay general, listing signage, a retention policy, access control and audits. None gave a specification template, a clock-sync requirement or a handover checklist, which is what an assessor can actually ask to see.
One correction to a common claim. Some guides say businesses must "register" with the ICO. As general guidance, what most data controllers pay is a data protection fee, and some are exempt, so use the ICO's own self-assessment rather than assuming either way. Insurers' CCTV conditions vary by policy, so read your schedule before you buy.
How do you document purpose, lawful basis, signage and retention?
Write one purpose for each camera area, pair it with a lawful basis (legitimate interests is the usual one for private businesses), and record the reasoning rather than just the label.
A till camera might be "deterring and evidencing theft", while a rear-door camera is "staff safety when locking up". For legitimate interests, note what you are protecting, why cameras are needed rather than a lesser measure such as better lighting, and why the impact on people filmed is proportionate. This is general guidance, so check it against your own premises.
DPIA
A data protection impact assessment is generally expected where monitoring is large-scale or covers publicly accessible areas. Even a small shop benefits from a short written risk assessment. Whether a full DPIA is required depends on your set-up, so check the ICO's video surveillance guidance.
Signage
Signs should say who operates the system, why it records, and how to contact them. Put them where people read them before they enter a camera's field of view, such as the front door or car park entrance, not beside the lens.
Retention
No statutory retention period exists. Around 30 days is a common default, and a shorter period can be justified if incidents are normally noticed within days. Commercial CCTV compliance guidance generally advises a written retention policy with secure-deletion procedures, but it does not set a fixed number of days, so pick a period you can defend and put it in writing.
Once the period is set, size the recorder's drives to hold that many days at your chosen bitrate.
What evidence standard should the cameras meet?
Specify each camera zone as detect, recognise or identify, with a pixels-per-metre (ppm) target at the subject distance, rather than quoting megapixels.
A 4K camera aimed across a wide yard can fail to identify anyone, while a modest camera on a narrow doorway can succeed. The calculation that decides it is:
ppm = horizontal pixels ÷ width of the scene in metres at the subject distance
A 4K sensor such as the one in the Hikvision 4K two-way audio turret supplies 3840 horizontal pixels. The scene width then comes from the lens field of view at your distance, which you read from the datasheet.
A figure of 100 ppm is commonly quoted for identification. IEC/BS EN 62676-4 uses its own DORI-style bands, with a higher identification figure. In the spec, state the target number and the standard it comes from, then check it against the current text of that standard. No single number is universal.
Add light and shutter conditions
For each identification zone (entrance, till point, vehicle gate), also write down:
- Illumination: a minimum lux at the subject after dark, from proper lighting rather than infrared alone.
- Shutter: a ceiling on exposure time wherever people or vehicles move quickly.
- Handover proof: night footage test-recorded and reviewed at handover.
Infrared range is not an identification distance. The 40m night vision quoted on that turret describes how far it illuminates, not how far a face stays recognisable.
Give every person a named account with role-based permissions, no shared admin login, and an audit log of every view, export and setting change. Ask the installer to confirm the recorder can produce that log before you buy, because capability varies between models.
Handover spec
- Passwords: unique credentials set at handover, with no manufacturer defaults left on the recorder or cameras.
- Roles: most staff get live view only, a few get playback, and one or two named people get export. Admin rights sit with the owner or a nominated manager, not the installer.
- Remote access: the written spec states which route is used and who holds the credentials.
- Export format: the clip in the recorder's native format with its bundled player, plus a hash or checksum file where supported, so you can show the copy hasn't been altered.
Export procedure (keep to one page)
- The requester (police, insurer or an individual) completes a request form giving name, organisation, camera, date and time window, and reason.
- A named person authorises release. Ideally this is not the same person who runs the export.
- A user holding the export role takes the clip and records the date, operator, cameras, time window, recipient and checksum (where supported) in the log.
- If other people appear in the footage, for example in a subject access request, the redaction route is stated up front: blur or mask them in a copy using editing software or an outside specialist. The original stays untouched.
- The recipient signs for the media, and the form is filed with the log entry.
Maintenance log
Record each check with the date and the name of the person who did it:
- Image focus and clarity on every camera
- Lens cleaning
- Clock drift against a trusted time source, since wrong timestamps weaken footage as evidence
- Disk health
- A test alert
Your own installer or electrician carries out any physical work, such as cleaning lenses at height, re-aiming or cable repairs. CCTV Master only sells the equipment, so check each product's datasheet or installation guide for what that work involves.
Fill-in spec template and pre-handover audit checklist
Fill in the spec before ordering and tick every checklist item before sign-off; a blank left empty is a decision nobody has made. Whoever fits the system completes the on-site tests, and the camera datasheet supplies the lens data for the ppm check.
Spec template
Copy one block per camera area and leave a blank until you have a real answer.
Area / camera ref: ________
Purpose: ________ Lawful basis: ________
DPIA ref: ________ Date: ________
Signage locations: ________
Retention period: ____ days Justification: ________
Evidential target: detect / recognise / identify (circle one)
Required ppm: ____ Standard named: ________
NTP source: ________ Tolerance: ____
Alert recipients (disk, camera loss, tamper): ________
User roles (name, role, access level): ________
Export procedure (who, format, log): ________
Maintenance interval: ____ Next due: ________
Pre-handover checklist
- [ ] Signs fitted at every location listed in the spec
- [ ] Policy and DPIA filed, with the reference and date matching the spec
- [ ] Per-camera ppm verified on a test subject at the target distance
- [ ] Clock synced to the named NTP source and checked against a reference
- [ ] Failure alert test recorded, with the recipient confirming receipt
- [ ] Default credentials changed on every camera and the recorder
- [ ] User roles set, with no shared admin login
- [ ] Test export played on a separate machine
- [ ] Retention verified by checking the oldest recording against the stated period
- [ ] Maintenance interval agreed and the first visit diarised
- [ ] Spec, camera schedule and credentials handed to a named owner
Related products from our own range:
