GDPR CCTV Policy Template UK 2026

Yes, CCTV is covered by UK GDPR whenever your cameras capture identifiable people, and the business using the system, not the installer, is normally the controller responsible for compliance. In practice, that means a written policy, clear signage, a defined retention period and a documented reason for recording are the minimum.

One caveat before you rely on any guidance: the ICO's video surveillance guidance is flagged as under review following the Data (Use and Access) Act, so check its current status before you finalise your policy.

Is CCTV covered by GDPR, and does it apply to home systems?

Yes, CCTV is covered by GDPR if footage lets you identify a person. For home systems, the household exemption is narrow and cameras capturing a neighbour's property or public space may still require GDPR compliance.

Yes: if footage or audio lets you identify a person, it is personal data, and the UK GDPR and Data Protection Act 2018 apply to business CCTV. Sprintlaw notes that faces, clothing, location and timestamps can all make someone identifiable. It also says the household exemption typically doesn't cover businesses filming in or around their premises.

Home systems

Whether GDPR applies to domestic CCTV depends on the case. The household exemption is narrow, and a camera that captures a neighbour's property or public space may fall outside it. Treat this as general guidance, not a ruling on your set-up, and read the ICO's domestic CCTV guidance before you mount anything.

Some regulators, such as Gibraltar's, give the domestic exemption its own section, which shows how often the question arises. Gibraltar's rules differ from the UK's, so use that guidance only as a pointer.

Is CCTV a breach of privacy?

Not in itself. It becomes a problem when it is disproportionate: cameras pointed at areas where people reasonably expect privacy, coverage broader than the stated purpose, or footage kept and shared without control. A documented purpose and sensible camera placement are what keep a system defensible.

The ICO's governance page carries a last-updated date of 24 January 2024, so check it for newer wording before you rely on any template.

Who is responsible: the client, the installer or the supplier?

The client is responsible as the data controller who determines the system's purposes and means. Installers and suppliers may be processors, requiring a written data processing agreement to document their role and obligations.

The client is responsible. Whoever determines the purposes and means of the CCTV processing, meaning why the system films and how, is the data controller. An installer or supplier may be a processor where it processes footage on the client's behalf.

Sprintlaw describes the controller as the party that sets the purpose and decides camera placement, coverage, retention and access. It says a security vendor or cloud host may process footage on the client's behalf. In that case the provider must follow the client's documented instructions, and a written data processing agreement should cover the arrangement.

We sell equipment and do not fit it, so compliance should be put in writing at handover. The customer's own electrician or installer carries out the installation, working from the product's datasheet and installation guide. The client then makes the policy, signage and retention decisions. The notes below are general guidance, not drawn from the extracts above.

Checklist for integrators

• Admin passwords: who holds them at handover, and have the factory defaults been changed?
• Remote access: is it the client alone, or also the installer, a support contractor or a cloud service?
• Support access: can anyone other than the client view or export live or recorded footage? If so, assess whether they are processing it on the client's behalf. If they are, agree terms in writing before access is granted.

What should a GDPR CCTV policy template include?

A GDPR CCTV policy template should cover twelve items: purpose, scope, lawful basis, camera locations, signage, retention, access and security, DPIA, subject access, third-party disclosure, complaints and review.

The policies cited here support only part of that list. The Read Parish Council contents page covers purpose, scope, camera locations, retention, access, access requests, third-party disclosure, responsibility and review. The Louis Fitzgerald group, University of Nottingham and Gibraltar regulator extracts open with purpose and data-protection principles. The twelve items below are our own synthesis.

The Louis Fitzgerald policy comes from a hospitality group, and the Gibraltar guidance is issued under Gibraltar's own GDPR and Data Protection Act. Treat both as structural guides, not UK-specific wording.

• Purpose and statement of intent: why the system exists, in plain terms.
• Scope: which sites, cameras and people it covers.
• Lawful basis: the basis you rely on, and why it fits.
• Camera locations: where each camera points.
• Signage: where signs go and whose contact details they carry.
• Retention: how long footage is kept and how it is deleted.
• Access and security: who may view footage, and how access is controlled.
• DPIA: the assessment, or your reasoning for not needing one.
• Subject access requests: how people ask for their images and who replies.
• Third-party disclosure: when footage goes to police, insurers or others.
• Complaints: the route and the named contact.
• Review: an owner and a date.

Add a "will not be used to" list. The Engaging Potential document shows the heading but not its items, so write your own. Our suggestions are no monitoring of staff performance, no recording in toilets or changing areas, no covert cameras and no commercial use of footage.

Where the competitors fall short: these are written for schools, parish councils, hospitality groups and universities. In the extracts reviewed, none reads from the installer's side, though the full pages may differ. That means a site-specific purpose statement, a camera schedule (ID, location, coverage, recording or not) and a handover pack. Ask your own installer for all three.

Signage, consent and retention: what you actually have to do

Tell people with prominent signs naming the operator, rely on a lawful basis rather than consent, and keep footage only as long as you can justify.

Do you have to tell people?

In practice, yes. Put signs where the cameras cover, stating who runs the system and how to contact them. Read Parish Council's CCTV policy does this: its warning signs carry the council's contact details. A sign with no named operator leaves people unsure who to ask about their footage.

Is consent required?

As general guidance (not something the sources above spell out), CCTV tends to rest on a lawful basis such as legitimate interests, not consent from each person filmed. Nobody walking past a camera can meaningfully opt in.

Employees are the sharper case. They can't freely consent to workplace monitoring when refusing isn't a real option, so your protection is proportionality: a clear purpose, cameras aimed only where that purpose needs them, and openness about what is recorded. Disclosure control and subject access requests (SARs) are covered in the ICO's governance guidance, so decide in advance who handles them.

How long can footage be kept?

There is no single legal period. Sprintlaw's UK GDPR guide frames it as keeping footage only as long as you need it, and the other policies cited here set their own periods rather than pointing to a fixed legal figure.

Pick a period you can defend against your stated purpose, write it into your policy, and size the recorder's storage to match, not the reverse. Footage you hold beyond that point needs a reason, such as an incident under investigation.

Installer mistakes that attract complaints

The risks below mostly come from defaults nobody changed: cameras aimed past the boundary, audio left on, weak access control and no paperwork handed over. They are common risks, not ICO enforcement statistics.

• Cameras covering neighbours or public space. A view into a neighbour's windows or onto a pavement needs a justification. Re-aim the camera or use privacy masking.
• Audio enabled by default. Sprintlaw's guidance notes that audio capture can be personal data too, just like images. Switch it off unless there is a specific, documented need.
• Default or shared admin passwords and open remote access. These undermine the security duty. Give each user their own login and don't leave remote access exposed.
• No signage, named contact or handover documents. Staff who were never told who handles requests may not recognise a subject access request. Unauthorised disclosure of footage is a related governance risk.
• Retention on "overwrite when full". Without a stated period and reason, you cannot justify how long footage is kept. Set the period deliberately on the recorder.
• Facial recognition or biometric features switched on without assessment. Sprintlaw says combining CCTV with these features can trigger stricter rules and more rigorous safeguards. Leave them off until you have assessed the risk and recorded your reasoning.

Treat every feature as off until someone has recorded why it is on. Whoever fits your kit, whether your own electrician or installer, should work through the product's installation guide and hand back the settings they chose.