Obligations of CCTV holders in the UK
If your company uses video surveillance (CCTV), even if it does not process any other personal data – you MUST register details with the Information Commissioner’s Office (ICO) and pay a data protection fee.
However, this obligation does not apply to the installation of CCTV on private property.
If you decide to register voluntarily – your right will be not to disclose your address.
You will also not be visible in the database of licensed entities.
However, it will still be your responsibility to comply with the UK GDPR rules below.
As a CCTV owner you must:
– inform people that they may be recorded, usually by displaying signs that must be clearly visible and legible
– control who can view your recordings
– ensure that the system is only used for its intended purpose – for example, if it has been configured to protect property in the company’s external parking lot, you may not use it to monitor employees
– make available – at the request of the subject of personal data – viewing – photos or videos recorded by you. Materials must be made available free of charge within 1 calendar month
– keep the recordings no longer than it is absolutely necessary to achieve the purposes of their storage (the most common practice – 3 months).
However, when you create the UK GDPR documentation for your company – do not forget about the “CCTV Policy“, i.e. a document in which you will determine how personal data is processed through your monitoring, how you protect it, who may have access to it, what steps must be taken in your company in the event of a breach, etc.