Obligations of CCTV holders in the UK

If your company uses video surveillance (CCTV), even if it does not process any other personal data – you MUST register  details with the Information Commissioner’s Office (ICO) and pay a data protection fee.

However, this obligation does not apply to the installation of CCTV on private property.

If you decide to register voluntarily – your right will be not to disclose your address.

You will also not be visible in the database of licensed entities.

However, it will still be your responsibility to comply with the UK GDPR rules below.

As a CCTV owner you must:

inform people that they may be recorded, usually by displaying signs that must be clearly visible and legible

control who can view your recordings

ensure that the system is only used for its intended purpose – for example, if it has been configured to protect property in the company’s external parking lot, you may not use it to monitor employees

make available – at the request of the subject of personal data – viewing – photos or videos recorded by you. Materials must be made available free of charge within 1 calendar month

keep the recordings no longer than it is absolutely necessary to achieve the purposes of their storage (the most common practice – 3 months).

However, when you create the UK GDPR documentation for your company – do not forget about the “CCTV Policy“, i.e. a document in which you will determine how personal data is processed through your monitoring, how you protect it, who may have access to it, what steps must be taken in your company in the event of a breach, etc.

in data protection law data processing companies will not pay a penalty only,
if they can prove that they have done everything to protect the data

Have a question?

Go to our service page if you need a consultation or other help related to UK GDPR

Our Service
Scroll to Top
Cookie Consent with Real Cookie Banner