Yes: CCTV footage is personal data under UK GDPR whenever a person can be identified from it, whether by their face, their vehicle registration or anything else that points to who they are. Whether the rules then apply to you depends on who runs the system and what it captures, because a camera that records only your own private property can fall outside them, while one that covers public space or is used by a business generally falls within them. Even recording without ever viewing the footage counts as "processing", so being identifiable is the test, not whether anyone watches the tape.

Is CCTV footage personal data under UK GDPR, or only some of it?

CCTV footage is personal data whenever a person in it can be identified. Footage in which nobody can be identified falls outside that definition.

The ICO's video surveillance guidance says organisations using systems that process the personal data of identifiable individuals must comply with the UK GDPR and the DPA 2018. It names traditional CCTV alongside ANPR, body-worn video, drones, facial recognition, dashcams and smart doorbell cameras.

So does CCTV come under GDPR? In most real installations, yes, because a recognisable face or a figure someone could name makes a person identifiable. Is CCTV recording personal data? The Irish DPC's guidance describes recording video or audio of identifiable people as "processing", so your obligations begin at capture, not when someone reviews the footage.

Personal or sensitive data?

Ordinary identifiable footage is personal data, not special category data. It moves into the sensitive categories only where the system processes biometric or similarly sensitive information, and the ICO flags AI-based surveillance as the kind of system that can do this. For the networking side of these installs, see our data comm and networking range.

One boundary to note: the ICO guidance excludes processing that is purely personal or household activity, so a strictly domestic setup is treated separately.

Which camera specification choices decide whether footage identifies anyone?

Lens angle, mounting height and pixels on target decide it: if a face or number plate is legible, the footage is very likely personal data.

A wide lens covering a whole yard spreads the sensor thinly, so people become small figures. A narrow lens aimed at a gate puts many more pixels on each face. Mount height matters too: a camera high on a wall looks down at steep angles, while one at head height captures faces. This is general installer guidance rather than a fixed rule, and the same camera can be out of scope framed on a blank wall or wide scene, then in scope once aimed at an entrance.

Audio, ANPR and analytics

A microphone adds a separate, more intrusive layer, because it records conversations as well as images. Disable it unless you have a documented need.

The ICO's scope guidance lists ANPR and facial recognition alongside traditional CCTV. Its video surveillance guidance also notes that AI-based systems can process more sensitive categories of personal data. Treat any of these features as a step up in risk, not a free extra.

Keeping neighbours and the footway out of frame

  • Privacy masking blocks out fixed areas, such as a neighbour's window, so they are never recorded.
  • Zone cropping limits the recorded view to your own boundary and keeps the public footway out.

Set both during commissioning, and recheck them if the camera is ever knocked or re-aimed.

Footage of neighbours or passers-by is still personal data, and a business camera that captures it falls under the UK GDPR.

The household exemption is narrow. The ICO's scope guidance excludes only processing that is "purely" personal or household, so a home camera recording beyond the owner's boundary may fall outside it. The home-specific detail is covered in our separate home CCTV laws guide.

On business and shared sites, start with what you can mask or re-aim. If a camera sees public pavement or neighbouring land, tighten the field of view or apply privacy masking in the camera or recorder settings, then work out what you would have to disclose about whatever remains. Check the model's datasheet for masking support before buying.

Who holds which role

  • Cloud and remote access: whoever controls the viewing login and cloud account must restrict who can see footage. Use individual logins and remove people who leave. A cloud provider usually acts as a processor and needs a contract (general UK GDPR guidance, not CCTV-specific).
  • Third-party monitoring: a company handling live or recorded footage is a processor. The system owner remains the controller.
  • Installers: the customer decides why the cameras exist and where they point, so the customer is the controller, not the person who fits them. We sell equipment only, so for fitting use an independent NSI or SSAIB-accredited installer, and agree with them who sets up logins and masking.

What does being in scope mean for signage, retention, access requests and ICO registration?

Being in scope means you need a documented lawful basis, visible signs stating purpose and contact, and a retention period you can justify. The ICO guidance applies when a system processes the personal data of identifiable individuals, but it excludes processing purely in a personal or household context. It doesn't settle access-request handling or ICO registration, so check the ICO's pages for your own circumstances, and use our GDPR CCTV policy template to document your retention period and lawful basis.

Signage and lawful basis

GDPR CCTV signage requirements apply wherever UK GDPR applies. Signs should be prominent and say why you are recording and who to contact, in line with the EDPB FAQ, which describes a sign indicating the purpose and the controller. There is no single mandated wording, so write it plainly.

Consent is rarely workable, because the EDPB notes it is hard to get freely given consent from everyone recorded. Legitimate interests is the usual basis, and it needs a balancing test. Write down:

  • the specific purpose
  • why cameras are necessary
  • whether any extra uses are proportionate
  • whether a Data Protection Impact Assessment is needed

Retention and storage

The ICO and EDPB material cited here gives no fixed UK retention period. Choose one, document the reasoning, then size the recorder's drive to match it.

storage (bytes) = (bitrate in bits/s × recording seconds ÷ 8) × number of cameras

For continuous recording, "recording seconds" is every second of the retention window. For motion recording, use only the expected seconds of activity, then leave headroom, since busy scenes push the total up.

Camera-position checklist: which placements pull you into scope?

UK GDPR applies wherever a camera records identifiable people, unless use is purely household; businesses should treat every position below as in scope. The ICO's video surveillance guidance names smart doorbell cameras and ANPR alongside traditional CCTV, and it excludes processing purely in a personal or household context.

Front door or doorbell

  • Sees visitors, couriers and often the pavement; faces are identifiable at door height.
  • Mask the public footpath and road, and trim motion zones to your own threshold.
  • If the view reaches past your boundary, note why and how long footage is kept.

Driveway or gate

  • Sees faces and number plates, and plates can point to a named keeper.
  • Angle down and mask the road.
  • Record whether plate recognition is switched on; the ICO lists ANPR as in scope.

Rear garden or boundary

  • Sees neighbours' gardens and windows, which is where the household position is weakest.
  • Mask everything beyond the fence line.
  • Don't rely on "it's my garden" if the view crosses the boundary.

Shop floor or till

  • Sees customers, staff and transactions, all clearly identifiable.
  • Document the purpose and legal basis. The EDPB says consent rarely works for CCTV and legitimate interest needs a balancing test.
  • Put signage at the entrance naming the operator and purpose.

Car park or yard

  • Sees vehicles, plates and people after hours, often with a public road in frame.
  • Mask neighbouring property and the highway.
  • If footage is used for anything beyond security, the ICO says a DPIA may be needed.

Reception or internal corridor (audio and staff)

  • Sees staff and visitors every day, and a microphone adds conversations.
  • Disable audio unless you can justify it separately from the video.
  • Tell staff, and write the purpose and retention into your policy.

Check each model's datasheet for privacy masking and audio control, then browse the range at cctvmaster.co.uk, with trade pricing on request.