Security for UK sites and premises
CCTV for Business Premises: What the Rules Ask of You
7 November 2026
CCTV for business premises comes with real legal duties, and what the rules ask of you is mostly about being open, keeping records and looking after the footage. If your cameras capture people, data protection law applies, whether your business is in London, Manchester or Glasgow. The good news is that most of it is straightforward once you know the steps.
Quick answer: For CCTV for business premises, what the rules ask of you is to pay the ICO data protection fee, record why you need cameras, carry out a DPIA where the risk is high, put up clear signs, keep footage no longer than you need it, keep it secure and respond to access requests.
Key Takeaways
If your cameras capture identifiable people, UK GDPR and the Data Protection Act 2018 apply.
Most organisations using CCTV for crime prevention must pay the ICO data protection fee.
There's no fixed legal retention period, so set the shortest period that does the job.
Signs must make it clear people are being recorded, before they enter the area.
Audio recording should be off by default.
CCTV for business premises: what the rules ask of you under UK law
CCTV footage that identifies living people is personal data, so the UK GDPR and the Data Protection Act 2018 apply. If you decide why and how the cameras are used, you're the controller and you're legally responsible for compliance. That stays true if a supplier runs the system for you.
Organisations that use personal information must pay a data protection fee to the ICO unless they're exempt, and the ICO says that using CCTV for crime prevention means paying it. For SMEs, the ICO puts this at £52 or £78 a year. If you're reviewing your setup, our security buyer’s checklist covers the contract side.
Who regulates CCTV in the UK
The ICO is the UK's data protection regulator, and it's the body that deals with how businesses handle footage. The Security Industry Authority (SIA) licenses certain security work, including using CCTV under a contract in some situations. Installing a system isn't on the SIA's list of licensable activities, so an SIA licence won't tell you an installer is any good.
Your responsibilities
Write down why you need CCTV and how you'll limit the impact on people's privacy, including what's covered and how long you'll keep footage. Update your privacy notice too, and create a CCTV policy covering your lawful basis, who's responsible, your security measures, who you share data with and how long you keep it.
Privacy assessments, signage and transparency
A Data Protection Impact Assessment (DPIA) is a legal requirement where processing is likely to result in a high risk to people, and the ICO says that applies in most cases of video surveillance. It's specifically expected for monitoring publicly accessible places on a large scale, or monitoring people at work. Do it before you install or change a system, and keep a copy.
CCTV signage requirements in practice
The ICO says you always need to make sure people under surveillance are clearly aware of it. It also says that publishing the information on a website isn't enough by itself. Your signs should:
Sit prominently before people enter the area the cameras cover, with further signs inside it.
Name the organisation operating the system.
Explain why you're using it, for example crime prevention and public safety.
Give basic contact details, such as a website, phone number or email address.
Be more prominent and frequent where people are less likely to expect cameras.
Audio and sensitive areas
The ICO says you should switch off any capability to record audio by default, and you shouldn't normally record conversations between members of the public. Cameras in places such as toilets and changing rooms should only be used in the most exceptional circumstances, where it's necessary to deal with very serious concerns. Set the camera angles so you capture only what you need.
Installation, maintenance and keeping footage
Choose an installer who can explain how the system supports these duties, then check that the pictures are clear enough to do the job. Keep a simple log of maintenance, software updates and password changes. Our guide on how to choose a security company has the questions to ask any supplier.
How long can CCTV footage be kept?
The UK GDPR and the Data Protection Act 2018 don't set a minimum or maximum retention period. The ICO says the purpose should determine it, and your retention period should be the shortest period for that purpose. Don't keep footage for months just because that's the system's default, and set up automatic overwriting if you can.
Keeping footage secure
Store footage securely and restrict access to authorised people. The ICO says encryption can be an effective way to prevent unauthorised access, and that recorded footage should be viewed in a restricted area. Keep a record of who has handled it and of anything you share. A breach may need to be reported to the ICO.
Comparing business CCTV systems
Different systems raise slightly different questions, although the core rules are the same for all of them. Cost depends on the number of cameras, the site, the storage and any monitoring, so ask for an itemised quote.
System type |
Often used for |
Check before you buy |
|---|---|---|
Analogue CCTV |
Single sites with simple needs |
Picture quality, who can reach the recorder, overwrite settings |
IP (digital) cameras |
Larger or multi-site businesses |
Encryption, strong passwords, access logs |
Cloud-hosted CCTV |
Sites needing remote access |
Written contract with the supplier, where footage is stored, how users log in |
If someone else watches your cameras
If you use a security company to monitor cameras, its staff may need an SIA licence. A public space surveillance licence applies when CCTV is used to identify people or monitor their activities to guard against disorder, damage or assault. Our guide to security guard services explains what a guard's licence does and doesn't cover.
Staff you employ directly don't usually need a licence, although the Home Office has consulted on whether in-house CCTV operators should be licensed, so check the current position. Venues should also read our door supervisor guide, because door staff may use cameras as part of the job.
Common mistakes in CCTV compliance and how to avoid them
The most common slips are simple ones: not paying the fee, missing or vague signs, and keeping footage because nobody decided when to delete it. Others forget to tell staff, or never review the policy. A yearly review of your needs, signs, settings and access list will catch most of this.
Good habits for managing your system
Limit live viewing and playback to trained, authorised people.
Use strong, unique passwords and change default ones.
Keep a record of who has accessed or copied footage.
Make sure you can find and redact footage if someone asks for a copy.
Keep footage if the police ask you to preserve it for an investigation.
People can ask for copies of their own personal data, so you'll need to find footage quickly and blur other people where necessary. These habits make that much easier.
The ICO says its CCTV guidance is under review following the Data (Use and Access) Act 2025, so check its steps for organisations using CCTV for the latest position.
If you have a question, get in touch with our team.
There is more advice on our blog.
Frequently Asked Questions
What are the rules for CCTV in business?
Pay the ICO data protection fee, record why you need CCTV, carry out a DPIA where the risk is high, put up clear signs, keep footage only as long as you need it, keep it secure and be ready to deal with requests from people who want a copy.
How long can CCTV footage be kept by businesses?
There's no set legal period. The ICO says your retention period should be the shortest period for your purpose, so decide on one, record it in your policy and delete footage once you no longer need it.
Do I need to tell staff and the public about CCTV?
Yes. People must be clearly aware that they're being recorded. The ICO says signs should sit before the area the cameras cover, and a notice on your website isn't enough by itself.
Who can access CCTV footage in a business setting?
Only authorised people should see it, and the ICO says viewing should happen in a restricted area. People can also ask for copies of their own personal data, and you'll normally have one month to respond.
What are the consequences of breaching CCTV rules?
The ICO can take enforcement action, and the highest fines reach £17.5 million or 4% of annual worldwide turnover, whichever is higher. Those are maximums. There are separate fixed penalties of up to £4,000 for not paying the data protection fee.
Then use our buyer’s checklist for UK sites to pull your own actions together before you speak to a supplier.