GDPR and CCTV Cameras: UK Buyer's Guide for 2026

Yes, CCTV is covered by UK GDPR whenever it records identifiable people beyond a purely household setting, and a camera pointing at a public street, a neighbour's property or a communal area usually crosses that line, even on a home system. No camera can make you compliant on its own, because lawful basis, signage and retention policy are your responsibility, but the right hardware makes those duties far easier to meet. Features such as privacy masking, adjustable retention, encrypted storage, audio disabling and access logs are what to look for, and this guide shows how to check each one before you buy or sign off an installation. For a school-specific shortlist, see our best CCTV camera for school buyer's guide.

Is CCTV covered by GDPR, and what can hardware actually do about it?

Yes: CCTV footage is covered by GDPR once cameras capture other people's property, public areas or communal space, and hardware can only limit that. The ICO's home CCTV guidance explains why. Cameras can pick up other people's images and voices, and that counts as their personal information. So data protection law applies to domestic systems as well as business ones, including GDPR security cameras at home.

The household exemption is narrow. EDPB Guidelines 3/2019 give the EU-level reading, but UK readers follow UK GDPR and the ICO.

Recording and storing footage is processing in itself, even if nobody ever watches it. Ireland's Data Protection Commission also notes that recording quality affects whether people are identifiable, so a sharper camera makes the duty bigger, not smaller.

Hardware choices can reduce what you capture:

• Fixed field of view: a static CCTV camera aimed at your own boundary captures less than a pan-tilt unit that can sweep a street.
• Audio: voices are personal information too, so disable the microphone on any camera where sound has no purpose.
• Resolution: HD CCTV cameras suit a shop till or doorway, but match the sharpness to your stated purpose.

A lens can't supply a lawful basis. For a retail shop or workplace, the ICO's data protection principles guidance says you must document one, and it is often legitimate interests rather than consent.

Which camera features limit what you capture?

Privacy masking is the main feature, backed by a fixed lens and a resolution matched to the job rather than the highest one available.

Privacy masking

Masking blacks out set zones in the image, which suits neighbouring windows, gardens and public land. Confirm it in the datasheet or the camera's web interface before buying, including how many zones you get. Don't assume every camera has it.

Field of view and lens

The ICO's CCTV guidance says owners should, where possible, position cameras to capture only their own property. A static CCTV camera with a lens chosen for the area makes that easier to achieve and to prove. A pan-tilt-zoom unit can wander beyond your boundary, so if you use one, lock its presets and limit its travel.

Resolution proportionate to purpose

Image quality affects whether a person can be identified, so more resolution means more personal data. HD CCTV cameras suit most jobs, and the "best quality" camera is the one that fits the task. A till needs enough detail to settle a transaction dispute, an entrance needs faces at a doorway, and a perimeter often only needs to show that someone is present. For a retail shop, spend resolution on the till and the door, not on the aisles. For a closer look at how these resolutions compare, see 4MP vs 8MP CCTV cameras.

Your electrician or installer fits the kit, and the datasheet lists the lens options for each model.

How should recorders handle retention, storage and encryption?

Set the recorder to overwrite footage after a retention period you can justify against your stated purpose, then verify encryption and storage location on the datasheet and in the menu.

Retention

Most NVRs and DVRs loop-record, overwriting the oldest footage once the disk fills or a set number of days passes. Choose the day-limit setting deliberately rather than leaving the disk to decide. The ICO's data protection principles guidance and the EDPB FAQ both start from the purpose, and footage should not outlive it.

No single period is a rule. A commonly used figure is a fair starting point only if you can explain why your site needs it, and you should write that reasoning down.

Storage sums

As general guidance, the working formula is storage ≈ bitrate × seconds recorded × number of cameras ÷ 8, with bitrate in bits per second giving bytes. Plug in your own camera bitrates and chosen retention. Our PoE and NVR guides cover sizing the switch and recorder around the result.

Encryption and location

Check these before buying or commissioning, rather than assuming them:

• Whether remote access uses HTTPS.
• Whether the disk or exported clips can be encrypted.
• How firmware updates are delivered, and whether the manufacturer still issues them.

Cloud-only storage puts a third party between you and the footage. Establish who holds it, where, and on what contract terms before relying on it.

Who can view footage, and how do you prove it?

Only named, authorised people should be able to view or export footage, and the recorder should keep a log showing who did what and when. The ICO's CCTV guidance treats governance as mattering alongside technical capability, so a log you can produce is part of your evidence.

Access control: features to confirm

Check the recorder's documentation for these before you buy:

• Individual user accounts with different permission levels, such as live view only, playback, export and settings.
• A forced change of the default password at first setup.
• No shared admin login, so every action traces to one person.

Remote access

The red flag is a recorder port-forwarded to the internet while still on a default password. As general guidance, prefer authenticated, encrypted remote viewing over opening ports on your router.

Audit logs

Look for a recorder log that records logins, playback and exports. If someone later asks who watched or copied a clip, this is how you answer.

Section 4 of the EDPB's video-surveillance guidelines covers disclosure to third parties in general and to law enforcement agencies. In short, footage should go only to recipients with a reason tied to your stated purpose. The detail belongs in the CCTV law guide.

Shops and workplaces

For a retail shop, or for "GDPR CCTV at work" generally, limit live-view rights to named staff. Keep monitors out of sight of customers and passers-by, since an unattended screen on the shop floor discloses footage to anyone who looks. The same restriction applies to any GDPR CCTV monitoring set-up where playback happens in a shared office.

A good checklist turns each data protection decision into a setting that someone can open, see on screen and tick off before handover. The ICO's CCTV self-assessment checklist covers installation, management, operation, public awareness and signage, so the sign-off below follows the same ground.

Red flags on a spec sheet

• No privacy masking
• Audio recording that is always on
• Cloud-only storage with no stated location
• No configurable retention period
• Shared or default logins
• No access log

Installer sign-off table

Obligation	Feature to verify	Where to check	Client sign-off
Masking	Mask zones can be drawn over neighbouring property and public areas, and they survive a reboot	Datasheet feature list; camera or NVR image/display menu	☐
Audio default	Audio is off, or can be switched off per channel, and the live view confirms it	Datasheet audio entry; camera and NVR audio settings	☐
Retention setting	Overwrite period matches the client's documented retention period, and the drive capacity supports it	NVR storage menu; datasheet recording specs	☐
Encryption and remote access	Remote viewing needs a login, default passwords are changed, and any cloud storage location is stated in writing	Manual security section; network menu; supplier terms	☐
User accounts	Each person has a named login, and the default admin account is changed	NVR user management menu	☐
Logs	Playback, export and login events are recorded and can be viewed	NVR system log or search menu	☐
Signage placed	Signs stand at the approach to each monitored area and name the purpose and a contact	Walk the site against the ICO checklist	☐

We sell the equipment; the client's own electrician or installer fits it. They should work from each product's datasheet or installation guide, because menu names differ between recorders.

Once the table is settled, you can browse the range or ask for a suggested system and test each datasheet against these seven rows.

Related products

Related products from our own range:

• Hilook 4 MP Fixed Mini Bullet Camera THC-B140-R — 4MP Turbo HD mini bullet camera for home and business CCTV, with a fixed view for entrances and corridors. Prices include VAT. Free UK delivery over £100.
• Hilook 3 MP Fixed Mini Bullet Camera THC-B230-R — 3 MP Turbo HD bullet camera for entrances and corridors. Needs a compatible Turbo HD DVR to record. Prices include VAT. Free UK delivery over £100.
• Hikvision 3K Two Way Audio Fixed PT Turret for Coax CCTV — 3K HD-TVI turret camera with built-in mic and speaker, 2960 × 1665 video and 2.8 mm lens. Audio over coax needs a compatible Hikvision DVR. IP67 rated.
• Hilook THC-T240-M-R 4MP Turret Camera, 40 m IR — 4 MP Turbo HD turret camera with 40 metres infrared night vision, IP66 housing and switchable video output. Prices include VAT. Free UK delivery over £100.