CCTV Laws in the Workplace (UK Guide)
CCTV helps protect people, property, and business assets, but in the UK it carries legal responsibilities. For legal compliance, use CCTV for clear, legitimate reasons, be transparent, and avoid collecting unnecessary footage.
Before we look at the specifics of what the law says, let’s start with the basics.
Is CCTV Allowed at Work?
Yes, CCTV is allowed in UK workplaces, but it must be justified and used fairly.
In practice, that means you should be able to clearly explain:
- Why you need CCTV (e.g., preventing theft, protecting staff, health & safety, access control, safeguarding)
- Where cameras are placed and what they capture
- How footage will be used (and who will see it)
CCTV should not be installed as a default, especially for performance monitoring, which requires stronger justification and controls.
Also, some areas are almost always inappropriate for CCTV, such as:
- Toilets and changing rooms
- Private welfare areas where people reasonably expect privacy
If you’re unsure, a good rule of thumb is: would a reasonable person feel this is intrusive in this location? If yes, rethink the placement.
Employee Privacy Rights
Employees don’t lose their right to privacy at work. Even on company premises, staff have legal protections around how their personal data is collected and used.
To respect employee privacy rights, employers should:
- Tell employees that CCTV is in use (signage + written policy)
- Ensure monitoring is proportionate to the risk you’re trying to manage
- Limit who can access footage and keep access strictly need-to-know
A note on covert CCTV (exceptional circumstances)
Workplace CCTV should be used openly and with clear notification.
However, UK guidance recognises that covert CCTV may be lawful in exceptional circumstances, typically where:
- There is a specific, serious issue (for example, suspected criminal activity)
- Open monitoring would be likely to prejudice the prevention or detection of that issue
- The monitoring is strictly necessary and proportionate
- It is used for a limited time and reviewed frequently
Example: If theft or another crime has been repeatedly detected in a locker room, an employer may consider covert monitoring for a short period to obtain evidence and identify the offender. In that scenario, the key compliance point is this: once the evidence has been obtained, the covert camera must be removed.
Because covert monitoring is high-risk and highly intrusive, especially in areas like locker rooms, it exposes employers to significant legal, reputational, and trust risks. Misuse can lead to complaints, enforcement actions, and long-term damage to employee relations. Therefore, covert CCTV should never be used casually. If you’re even considering it, you should document your justification carefully and take specialist advice.
Using footage for new purposes (such as performance management) is risky unless your policy and lawful basis clearly cover it.
GDPR and CCTV
CCTV footage that identifies people is personal data, so UK GDPR and the Data Protection Act 2018 apply.
Here are the practical GDPR steps most businesses should cover:
You must have a lawful reason, usually a legitimate interest like security or safety, but always consider your situation.
You must inform people about the recording. Use clear signs and a policy that explains the purpose, retention, access, and contact details.
Only record what is necessary. Avoid capturing public areas needlessly, and don’t record audio unless strictly justified.
Do not keep footage longer than needed. Set a retention period that matches your business purpose.
Store footage securely, restricting access with controls and passwords.
Individuals can request copies of footage showing them. You need a process to respond and protect third-party identities.
A Data Protection Impact Assessment (DPIA) is often required—especially where CCTV could intrude on people’s rights or freedoms, which is common in workplace settings.
Best Practices for Businesses
If you want CCTV that supports your business without creating legal or trust issues, focus on these best practices:
- Carry out a DPIA (Data Protection Impact Assessment)
o Document the purpose, lawful basis, risks to privacy, and the measures you’re putting in place to reduce those risks
o Review it if you change camera locations, add audio, increase coverage, or change how footage is used
- Write a clear CCTV policy
o Purpose (security, safety, safeguarding)
o Locations covered
o Who can access footage
o Retention period
o How requests and complaints are handled
- Use clear signage
o Signs should be visible before people enter monitored areas
- Keep it proportionate
o Place cameras where risk is real
o Avoid constant close monitoring of individuals unless absolutely necessary
- Control access tightly
o Limit access to trained, authorised staff
o Keep a log of who accessed footage and why
- Train managers
o Make sure managers understand what CCTV can and cannot be used for
- Review regularly
o Risks change. Your CCTV setup should be reviewed to ensure it’s still necessary and appropriate.
Final thought
CCTV can absolutely be part of a well-run workplace, but it should never feel like Big Brother. When you’re transparent, fair, and purposeful, CCTV becomes a tool for safer spaces and stronger compliance, not conflict.
