CCTV Laws for UK Businesses: Rules to Follow in 2026

Yes, CCTV is allowed in UK workplaces, provided you can justify it, tell people about it and use the footage only for the purpose you stated. Covert recording is the narrow exception and is far harder to defend. The business is the responsible party under data protection law, whoever fits the cameras. The ICO's CCTV guidance is under review following the Data (Use and Access) Act, so check the live ICO page before relying on any detail here.

CCTV laws for UK businesses: what must be in place before cameras go live?

Before a business CCTV system records anything, you need a sign, a way to hand over footage on request, a retention limit and, unless you are exempt, a paid data protection fee.

GOV.UK's guidance for commercial premises lists these duties:

• Put up a sign saying CCTV is in use and why.
• In most circumstances, provide images within 1 calendar month to anyone you have recorded. You usually cannot charge for this.
• Share images with the police or other authorities if they ask.
• Keep images only as long as the business needs them.
• Pay the data protection fee.

The fee is owed unless you are exempt, and the current amount is on the live GOV.UK page for using CCTV, so check it there.

How the rules fit together

Footage of identifiable people is personal data, so UK GDPR and the Data Protection Act 2018 apply. The ICO's CCTV guidance shows how to apply them in practice.

As general guidance, not detail from the GOV.UK page, most businesses rely on legitimate interests as their lawful basis. They also work through an impact-assessment step before installing, and the ICO's checklist helps you judge how far to take it.

Who is responsible

The business running the cameras carries these duties, whoever supplied or fitted the equipment. Your own electrician or installer handles the business CCTV installation, and each product's datasheet or installation guide covers the fitting details. CCTV Master supplies equipment only.

Pre-installation compliance checklist installers can hand to clients

Ten steps, completed before any camera goes up, make a practical preparation checklist for a business CCTV system in the UK. The Source column separates the duties GOV.UK states outright (a sign, supplying images, sharing with authorities, sensible retention, the fee) from operational steps we suggest.

Step	What to do	Source type
Define the purpose	Write down why the system exists and use it only for that purpose.	GOV.UK (signs must say why CCTV is used)
Record the lawful basis	Note the basis relied on, with a legitimate interests assessment if that is the basis.	General guidance
Consider a DPIA	Run a data protection impact assessment where monitoring is intrusive or covers staff areas.	General guidance (hedged: not every site needs one)
Position cameras	Aim at the area you need to protect and mask private areas. Keep cameras out of toilets.	General guidance
Fit signs	Display signs saying CCTV is in use and why.	GOV.UK
Control access	Name who can view live and recorded footage and who can export it.	General guidance
Set retention	Pick a period you can justify by business need. GOV.UK sets no fixed period, so don't borrow one.	GOV.UK ("only as long as your business needs them")
Subject access procedure	Be able to supply a person's images within 1 calendar month, in most circumstances free of charge.	GOV.UK
Pay the fee	Pay the data protection fee to the ICO unless exempt.	GOV.UK / ICO
Tell staff in writing	Say that monitoring happens and why, for example by email.	GOV.UK monitoring staff

Two rows tend to cause trouble later. GOV.UK says images must be provided within 1 calendar month, and the same page requires you to share footage with the police if they ask. A client who has never practised exporting a clip will struggle with both.

Before choosing a recorder, check its datasheet for three things: separate user permissions, a clear footage export method, and storage that can hold your chosen retention period across all your cameras. The customer's own installer fits the kit, and each product page shows live stock and back-order status.

On the fee, the ICO says a business recording to prevent crime, where crime prevention is not the purpose of the business, needs to pay. Covert staff monitoring is a separate matter. GOV.UK limits it to a specific investigation and says it must stop when the investigation ends.

Are CCTV signs compulsory, and how long can you keep footage?

In most cases, yes: GOV.UK says you must put up a sign telling people CCTV is in use and why. You may keep images only as long as your business needs them.

Signs

Make the sign visible before people enter the camera's view, and large enough to read. At minimum it should say that CCTV is operating and give the purpose, such as crime prevention. As general guidance rather than a quoted rule, adding a contact point (a phone number or email for the person who handles requests) saves a lot of confusion.

Retention

The law gives no fixed number of days, so write your own justification down. A workable method:

1. Purpose: state what the footage is for, such as investigating theft or disputes.
2. Risk: work out how long an incident typically takes to come to light. Your retention period is that delay plus a margin, not a round number picked from habit.
3. Review cycle: set a date to revisit the period, and change it if the purpose or premises change.

Size your recorder's storage to match the period you have justified, not the other way round.

Subject access and police requests

Anyone you have recorded can ask for their images. You must usually supply them free of charge within 1 calendar month. If other people appear in the frame, general guidance is to consider masking or blurring them, or to take advice from the ICO before handing over. Police and other authorities can also ask for footage, and you must share it with them.

Is CCTV footage allowed in court?

Footage can be requested by authorities and may be used as evidence. Whether it helps depends on image quality and on how you handled it: keep the original export unaltered and note who copied it and when.

Is it illegal to watch staff on CCTV in the UK?

No, watching staff on CCTV is not illegal in the UK, but you must be able to justify it and tell staff about it, per GOV.UK's guidance on monitoring staff at work.

Employees must be told they are being monitored and why, for example by email. The workers' rights guidance points to the handbook or contract as the place to explain how much monitoring takes place. Staff who feel they've been treated unfairly can complain to the Information Commissioner or take the employer to an employment tribunal.

Purpose creep

A system installed to detect crime shouldn't later be used to measure how much work staff get done. If the stated reason is theft prevention, reviewing footage to time how fast someone serves customers is a different purpose that staff were never told about.

Where cameras sit changes how easy they are to defend:

• Tills and stockrooms: cash handling and stock loss are usually straightforward to justify.
• Break rooms: staff expect more privacy here, so the case is much weaker and any camera needs to be clearly disclosed.
• Toilets and changing areas: as general guidance, avoid cameras altogether, because a justification is very hard to make.

Secret monitoring is a narrow exception. GOV.UK says it should only happen as part of a specific investigation and stop when that investigation ends.

Installer tip: record the stated purpose in the handover paperwork. If a client later wants to use the footage differently, they and you can see what the system was set up to do.

When are covert cameras lawful?

Hidden cameras are lawful only in a narrow case: when staff are suspected of breaking the law and telling them would make detection hard. GOV.UK's guidance on monitoring staff says covert monitoring must be part of a specific investigation and stop when that investigation ends.

Beyond that rule, the following is general good practice rather than a quoted legal requirement:

• Complete and keep a documented DPIA before any camera goes up.
• Set a short, defined duration.
• Use as few cameras as possible, aimed only at the suspected activity.
• Get senior sign-off, recorded in writing.

Some uses never qualify. Routine or open-ended hidden monitoring has no investigation to anchor it, so it fails the test. Private areas such as toilets and changing rooms are, as a general rule, no place for covert recording.

Try less intrusive options first:

• Visible cameras, which also deter.
• Access logs.
• Stock controls.

If the evidence still points to wrongdoing after those, document why they were insufficient before considering covert recording.

Visible cameras with proper signage are the usual starting point. You can shop at CCTV Master or ask about trade pricing, and in-stock items ordered before 4pm Monday to Friday are dispatched the same working day.