CCTV and UK GDPR: Rules for Buyers and Installers

Yes, CCTV is covered by UK GDPR and the Data Protection Act 2018 whenever it records identifiable people, because that footage is personal data. The one big exception is a camera on your own home used purely for household purposes. Once it also captures a neighbour's property, a public area or a communal space (voices included), data protection law applies.

The buyer is normally the controller, so duties like a lawful basis, a DPIA where needed, sensible retention and handling subject access requests fall on them, not on whoever fits the kit.

Is CCTV covered by UK GDPR, and what about home cameras, neighbours and public space?

The ICO video surveillance guidance names CCTV, ANPR, body-worn video, drones, facial recognition, dashcams and smart doorbells, and says organisations whose systems process the personal data of identifiable people need to comply with UK GDPR and the DPA 2018. It lists areas outside its scope, including covert surveillance, law enforcement processing under Part 3 of the DPA 2018 and processing purely in a personal or household context. The ICO currently marks this guidance as under review following the Data (Use and Access) Act, so check the live page for changes.

Your own home, and where the exemption ends

GOV.UK says data protection rules do not apply to a camera on your own home for household purposes, such as protecting it from burglary. The ICO home CCTV page draws the line at your boundary. Where possible you should position cameras to capture only your own property, but if a camera also captures someone else's property, a public area or a communal space, data protection law applies. Voices count as well as images, so a doorbell or camera that records audio from beyond your boundary is caught.

Neighbours

Once the law applies to you, you take on the duties any controller has. The ICO's home CCTV guidance lists them: have a clear reason for recording, capture no more than you need, put up a sign saying CCTV is in operation, store footage securely so only people who need it can reach it, delete it regularly or automatically, answer requests for footage from people who appear in it, and stop recording someone who objects unless you have a legitimate reason to carry on. GOV.UK says requests for footage should usually be met free of charge within one calendar month. For a fuller walkthrough of these obligations in a school setting, see our UK school CCTV guidance for 2026.

Neither the ICO's home CCTV guidance nor GOV.UK sets out a rule that you must tell or ask your neighbours before installing a camera, and the ICO says consent will rarely be needed for home CCTV. What matters is where the camera points. The simplest fix is to aim and frame each camera at your own land and entrances, so the household exemption still covers you. If a view of the street or a shared drive is unavoidable, treat the camera as regulated and put up a sign.

Which lawful basis and DPIA fit your scenario?

Most private-sector CCTV rests on legitimate interests, and a written DPIA is sensible for anything beyond a purely household camera. Legitimate interests only holds up if you pass a balancing test: your genuine reason against the impact on the people filmed. The table below is general guidance rather than legal advice, and your own circumstances can change the answer.

Scenario	Likely lawful basis	DPIA advisable?	Safeguard that matters most
Home camera overlapping pavement or a neighbour	Legitimate interests, because the household exemption no longer applies once you film beyond your boundary	Short written assessment is good practice	Angle or mask the view to your own property
Small shop	Legitimate interests	Brief DPIA, yes	Signs naming who is responsible, plus a set retention period
Office with staff monitoring	Legitimate interests, not consent	Yes	A narrow, written purpose that staff are told about
Block of flats or communal entrance	Legitimate interests	Yes	Restrict who can view and export footage
Car park	Legitimate interests	Yes, more so if the view takes in public areas	Signage at every entrance

Employee consent is often invalid because of the power imbalance between employer and staff, as one legal guide notes.

The Data (Use and Access) Act 2025 added a new, similarly named basis: recognised legitimate interest. It applies only to a short list of pre-approved purposes, and one of them is preventing, detecting or investigating crime. If your reason for recording fits one of those purposes, you do not have to run the balancing test, though you must still show that recording is necessary, tell people you rely on it and which condition applies, and respect their right to object. The ICO says you do not have to change basis if you already rely on legitimate interests for a purpose it covers. Its guidance on recognised legitimate interest sets out the five conditions, and because the ICO's CCTV guidance is still under review, check how it treats the new basis before you rewrite your policy.

A DPIA in five steps

1. State the specific problem the cameras solve.
2. Show why recording is necessary to solve it.
3. Record the less intrusive options you considered, and why they fall short.
4. List the risks to the people filmed and the measures that reduce them, such as camera angles, retention and access.
5. Sign off the decision and set a review date.

A DPIA becomes necessary where the CCTV is likely to be high risk to individuals' rights and freedoms.

How long should you keep CCTV footage, and how do you justify it?

UK GDPR sets no fixed number of days: footage must be kept no longer than necessary for your stated purpose. "30 days" is common industry practice that some guides repeat as typical, not a legal limit. A shop that spots theft the same evening and a site that shuts for a fortnight need different numbers.

Justifying your period

Start from how quickly an incident normally comes to light. Weekend closures, holiday shutdowns and delayed reports (a complaint arriving days later, say) set the minimum realistic window. Choose the shortest period that covers those gaps, then write down why.

Record that reasoning in your CCTV policy. Put the period itself in your privacy notice or on your signage, so the number you publish is the one you can defend. The ICO's video surveillance guidance is the document to align your policy with.

Checking your disk can deliver it

Days of retention are your usable disk capacity divided by what the cameras write each day. Take the capacity from the formatted drives in your recorder, not the label figure. Read each camera's bitrate from the camera or NVR settings rather than guessing, add them together, and multiply by the 86,400 seconds in a day, converting bits to bytes so the units match. For a wider look at setting these periods, see our GDPR CCTV policy template guide, and for a zone-by-zone layout of where to place each camera in a shop, see our CCTV for shops setup guide.

As an illustration only, with assumed figures: four cameras each recording at 4 Mbps give 16 Mbps, which is 2 MB a second or about 173 GB a day. A recorder with 4 TB usable would then hold roughly 23 days. Your own bitrates will differ, and motion-only recording or variable bitrate changes the result, so treat the answer as a planning figure.

If the maths falls short of your justified period, add drive capacity or lower the bitrate. You can browse the range at Clear Security.

How do you handle a subject access request for CCTV footage?

Log the request, verify the requester, find and export the footage, and supply it, usually free of charge within one calendar month. GOV.UK says anyone can ask to see images recorded of them.

Secure the footage the day the request arrives. Most recorders overwrite their oldest recordings on a loop, so the clip can disappear while you are still deciding how to respond.

The sequence

1. Log the date received. The one-month period runs from here.
2. Verify identity: confirm the requester is the person in the footage, or is authorised to ask on their behalf.
3. Ask for specifics, namely the date, a time window and the camera location. A narrow window makes searching and reviewing far quicker.
4. Search for the clip and export it.
5. Check for other identifiable people, reviewing the clip frame by frame if necessary.
6. Redact or mask third parties. If that isn't practical, consider whether disclosure is appropriate at all.
7. Supply the footage in a viewable format the requester can actually open.
8. Record what was supplied and why, noting any footage withheld and the reason.

Finding and masking footage

Use the recorder's time and camera search, then its export function. Export and masking features differ between recorders, so check your NVR manual or datasheet before promising the requester anything. If your recorder can't mask faces, you may need separate editing software.

Who is responsible: controller versus installer or processor, and what about the ICO fee?

The organisation that decides why and how the cameras are used is the controller, and the legal responsibility stays with it. An installer or maintenance firm becomes a processor only if it handles footage on the controller's behalf, for example through remote access or cloud storage. In that case a written contract is generally expected. An electrician who fits the kit and leaves, without touching recordings afterwards, is usually just a supplier of work.

The ICO fee sits with the controller. GOV.UK says a business that uses CCTV must register with the ICO and pay a data protection fee unless it is exempt, and you can register and pay online. A camera on your own home for purely household purposes falls outside the data protection rules, so the fee question mainly concerns business and other non-household use. The ICO sets the amount, so take the current figure from its data protection fee page.

The split below is good practice for a straightforward installation rather than a legal list.

Buyer (controller)	Their own installer or electrician
Decide the purpose, lawful basis and whether a DPIA is needed	Aim cameras and set privacy masks to the controller's brief
Register and pay the ICO fee unless exempt	Change default credentials
Put up signage	Configure retention as instructed
Set the retention policy	Document the setup
Run a subject access request (SAR) process
Control who can view recordings
Review the system periodically

Hand your installer a written brief covering coverage areas, masked zones and retention, and keep the signed-off setup record. Clear Security only sells equipment, so your own installer does the fitting; the product datasheet and installation guide give them the settings to work from. If you want a starting point, ask for a suggested system.

Related products

Related products from our own range:

• CCTV Warning Sticker – 24-Hour CCTV Surveillance — Self-adhesive CCTV warning sticker stating that premises are under 24-hour CCTV surveillance. Prices include VAT. Free UK delivery over £100.