CCTV Policy for Pubs: UK Law & Requirements

No law makes CCTV compulsory in every pub, but your premises licence may require it: under the Licensing Act 2003 the licensing authority can attach it as a condition where it supports the licensing objectives, and the police can ask for it but cannot insist.

Whether or not it is a condition, once your cameras record identifiable people you need a written policy showing the system is necessary, proportionate and controlled, covering retention, access requests, signage and who can view footage. Retention periods and licence wording vary by premises, and Scotland runs a different regime, so check your own licence conditions before you copy anyone else's policy.

Do pubs have to have CCTV by law, and why write a policy anyway?

CCTV is not mandatory under the Licensing Act 2003, though licensing authorities can impose it to meet licensing objectives. A written policy demonstrates the system is justified and shows how images are captured, stored and disclosed.

No: CCTV is not a mandatory condition under the Licensing Act 2003 in England and Wales, though a licensing authority can impose it where it helps meet the licensing objectives. Those objectives are preventing crime and disorder, public safety, preventing public nuisance and protecting children from harm. Freeths notes that a licensing authority may require you to install cameras in some cases.

The police can ask the licensing authority to make CCTV a licence condition, but they cannot insist. The authority makes the final decision. DCMS and LACORS guidance, as summarised in the East Lindsey/ICO FAQ, says CCTV should not be added as a matter of course, only where there is a justifiable reason.

Scotland is a different regime

Under section 142 of the Licensing (Scotland) Act 2005, certain defined late-night premises with regular extended hours beyond 0100 may face mandatory CCTV to the Chief Constable's satisfaction, per Moray Council's Licensing (Liquor) CCTV Guidance. English and Welsh licensees should check their own licence conditions and speak to their licensing authority rather than assume the Scottish rule applies.

Why write a policy even when CCTV is optional

Once cameras are recording identifiable people, you are the data controller, and a written policy is how you show the system is justified. The East Lindsey/ICO FAQ makes the licensee responsible for how images are captured, stored and disclosed. It also says signs should be displayed and that sound recording should be disabled other than in exceptional circumstances.

A policy also gives you a ready answer when someone asks to see footage, or when the police request images for detecting crime. The ICO's small-organisation CCTV guidance starts by asking what you want CCTV to do, so the policy should record that purpose first. For a ready-to-adapt starting point, see our GDPR CCTV policy template, and for the wider legal picture, read our CCTV law UK compliance guide. For the signage side of the same job, see our CCTV signage requirements UK checklist.

What should a CCTV policy for pubs include?

A pub CCTV policy should state a narrow purpose, name who is responsible, map each camera, and set rules for sound, retention, disclosure, signage and review. The skeleton below is general guidance, not legal advice.

Clause	What to write
Purpose	Crime prevention, staff and customer safety, evidence. Keep it narrow and written down.
Controller and manager	The named data controller and the responsible manager. The ICO's licensed-premises FAQ says the licensee is the data controller.
Camera locations	Each camera, its position and what it covers.
Sound	Off. The ICO FAQ says sound recording should normally be disabled other than in exceptional circumstances.
Retention	A stated period and how footage is deleted. One pub's published policy gives a 30-day maximum, but that is an example, not a rule.
Access and disclosure	Who can view footage, and how police or other requests are handled.
Signage	Where signs go and what they say.
Review date	When the policy and camera coverage are next checked.

Write the purpose clause first. National Pubwatch's question, repeated in the ICO's small-organisation CCTV guidance, is "What do you want CCTV to do?". Your answer shapes the kit, the staffing and the training.

As a cross-check, the Somerset licensed-premises guidance also covers image retention, time/date stamp, image integrity, equipment security, lighting, signage, training and maintenance. Add those as operating clauses if your licence conditions touch them.

How long do pubs keep CCTV, and who can see the footage?

No single UK law sets a retention period for pub CCTV; the general principle is to keep footage no longer than your stated purpose needs. Check your premises licence conditions first, because some licensing authorities attach their own minimum.

Writing the retention period down

The Old Grainstore, an Irish pub in Westport, publishes a policy saying images are kept for a maximum of 30 days from the date of recording. It is a non-UK example of how a pub phrases a limit, not a benchmark for your own premises.

Sizing storage for your retention period

Work backwards from the retention you have chosen:

retention days × daily recorded data per camera × number of cameras

Daily data depends on your cameras' bitrate and recording mode, so take it from the recorder or camera datasheet. You can then match the result to the NVRs and hard drives in the Clear Security range.

Can you request footage from a pub?

You can ask for footage of yourself through a subject access request. A pub is the data controller for its images, so it should respond, and it may need to redact other people who appear in the clip. Pointing to the date, time and area helps the pub find the right clip.

Police can ask for footage too, and the disclosure must be justified as necessary, for example to prevent or detect crime. The ICO's CCTV for your organisation: things you need to do page is the place to check current expectations.

How do you handle toilets, tills and staff in a pub CCTV policy?

Keep cameras out of toilets, point tills at the cash-handling area with staff told why, and state in writing that footage may be used in investigations.

Toilets

Freeths says CCTV shouldn't be used in toilets and changing rooms. As general good practice, cover entrances and corridors, never cubicles or washbasin areas where people undress or groom.

Tills and back office

State the purpose as cash handling and fraud prevention, a purpose the Old Grainstore policy also names, and tell staff. A camera aimed mainly at staff needs a documented reason, so write down why that angle is needed.

Staff conduct and discipline

Say in both the CCTV policy and the staff handbook that footage may be used in investigations. The Old Grainstore wording is a useful example, though it is an Irish pub's policy, not a UK template. Have an HR or legal adviser confirm the legal basis before you rely on footage in a disciplinary case.

Incident response sequence

Write the steps into the policy so whoever is on shift follows the same routine:

1. Preserve the footage before the recorder overwrites it.
2. Record the date and time of the incident, and of the export.
3. Note who exported it and who received it.
4. Keep that log with the footage.

Footage can be handed to the police for preventing or detecting crime, according to the ICO's licensed-premises FAQs, which were written under the Data Protection Act 1998. Check the current UK GDPR position before you rely on that wording.

What about signage, the ICO fee and keeping the policy current?

Put up clear signs identifying who runs the system and why, check whether your processing requires you to pay the ICO data protection fee, and review the system on a fixed annual cycle to keep records accurate.

Put up clear signs, check whether the ICO fee applies, and review the system on a fixed annual cycle. Signage and registration are the two items a pub's CCTV policy should record, and the review cycle keeps both accurate.

Signage

Signs must make clear that CCTV is in operation. The ICO's guidance, as reflected in the Inspired CCTV extract, says they should be prominent and easy to read, and should identify who runs the system, why it is used, and how to contact them. For the full steps, see the ICO's CCTV guidance for organisations.

The ICO fee

Check on the ICO site whether your processing requires you to pay the data protection fee. Where it does, the ICO says small and medium-sized organisations pay £52 or £78 a year, or £47 or £73 by direct debit. The older East Lindsey document is based on the Data Protection Act 1998, which has since been replaced, so rely on current ICO guidance for fees.

Keeping the policy current (best practice)

These steps are good practice rather than a stated legal rule:

• Annual review date: diarise it and record who signed it off.
• Camera-by-camera necessity check: confirm each camera still has a purpose, such as crime prevention, and move or remove any that does not.
• Maintenance log: note faults, repairs and checks of recording and time stamps.
• Staff training records: log who has been trained on viewing, disclosing and handling footage.

For the wider legal picture, the ICO guidance linked above is the place to start.

Related products

Related products from our own range:

• CCTV warning sticker — 24-hour CCTV warning sticker.Self-adhesive warning sticker stating that the premises are under 24-hour CCTV surveillance.