CCTV is often introduced as a straightforward security measure. Cameras deter crime, help investigate incidents and provide reassurance to staff, customers and visitors. Yet every recorded image is also personal data when individuals can be identified. That means a CCTV system is not simply a collection of cameras and hard drives; it is a data processing operation with legal, ethical and operational consequences.
For organisations operating under the UK GDPR, the Data Protection Act 2018 or similar privacy frameworks, the central question is not whether CCTV is useful. It is whether its use is necessary, proportionate and properly governed.
The most obvious risk is excessive coverage. A camera aimed at a building entrance may be justified, while one pointed directly into a neighbouring garden, employee rest area or private changing facility is much harder to defend. Problems can also arise from high-resolution lenses, audio recording, facial recognition features and systems that retain footage indefinitely.
Even well-intentioned surveillance can create privacy concerns if an organisation has not considered how people will experience it. Employees may feel constantly monitored. Visitors may not understand where cameras are located or why footage is being collected. Members of the public might be recorded far beyond the area relevant to the stated security purpose.
Before installing or expanding CCTV, organisations should identify a clear lawful basis for processing. In many cases, this will involve legitimate interests, but that does not mean the phrase can be used as a shortcut. A legitimate interests assessment should explain the purpose, show why CCTV is necessary and weigh the organisation’s needs against the rights and freedoms of those being recorded.
Transparency is more than putting up a sign
A small “CCTV in operation” notice is rarely enough on its own. People need accessible information about who operates the system, why it is being used, how long footage is retained, who can access it and how they can exercise their rights.
A layered privacy notice is often the most practical approach. A concise sign can provide the essential information at the point of capture, with a QR code or web address directing people to fuller details. The notice should be easy to find and written in plain language rather than buried in a long, general privacy policy.
Transparency also matters when footage is shared. Disclosure to the police may be appropriate, but organisations should still record what was requested, who authorised the release and which images were supplied. Sharing footage casually through email or messaging platforms can create a second set of security and compliance problems.
Managing footage without creating new exposure
The longer footage is kept, the greater the risk that it will be misused, accessed improperly or compromised in a cyberattack. Retention periods should therefore be based on a documented business need. A retailer might retain routine recordings for a few weeks, while footage connected with an active investigation may need to be preserved for longer.
Retention should not be confused with convenience. “The system stores everything for 90 days” is not, by itself, a defensible retention policy. Organisations should distinguish between ordinary recordings and material that has been formally placed on hold because it may be relevant to an incident, complaint or legal case.
Access controls are equally important. Not every security guard, manager or IT administrator needs unrestricted access to the entire archive. Permissions should reflect job responsibilities, and access logs should be reviewed periodically. Strong passwords, multi-factor authentication, encryption and secure network design can reduce the likelihood of unauthorised viewing or extraction.
When footage must be shared externally, redaction can be an important safeguard. Blurring unrelated faces, vehicle number plates, screens or personal documents helps an organisation respond to a valid request without disclosing more personal data than necessary. In larger operations, AI video redaction software may assist with identifying and obscuring people or sensitive details across extensive footage, although automated results should still be checked for accuracy before disclosure.
Subject access requests and the challenge of third-party privacy
People recorded by CCTV may have the right to request copies of footage containing their image. These requests can be deceptively difficult. A single frame may include employees, customers, children, bystanders and confidential information. Providing the requester with an unedited recording could unfairly expose other individuals.
Organisations should have a defined process for locating relevant footage, verifying the requester’s identity, reviewing exemptions and protecting third parties. The response must also respect applicable time limits. Staff need training to preserve original footage while creating a separate working copy for review and redaction.
It is important not to assume that all requests can simply be refused because other people appear in the video. In many cases, third-party identities can be protected through blurring or cropping. A refusal should be based on a genuine legal exemption or an inability to comply proportionately, not on administrative inconvenience.
A privacy impact assessment should come early
A data protection impact assessment, or DPIA, is particularly valuable where surveillance is systematic, extensive or likely to create a high risk to individuals. It should be completed before deployment, not after a complaint has exposed weaknesses.
A meaningful DPIA should examine the camera locations, fields of view, recording and audio settings, retention period, access arrangements, supplier relationships and potential effects on vulnerable groups. It should also consider whether less intrusive measures could achieve the same result. Better lighting, improved access controls or visible security staff may sometimes be more proportionate than expanding camera coverage.
The assessment should remain a living document. Changes such as adding analytics, connecting cameras to cloud platforms or using footage to monitor staff performance can alter the privacy risk significantly.
Building a culture of accountable surveillance
CCTV compliance is ultimately less about buying the right equipment and more about making disciplined decisions. Organisations should appoint clear responsibility for the system, train staff, document disclosures and review whether each camera still serves a legitimate purpose.
A useful governance review can ask:
- Are all cameras still necessary and correctly positioned?
- Are signs accurate and visible?
- Is footage retained only as long as required?
- Can access be audited and restricted?
- Is there a reliable process for requests, incidents and complaints?
Surveillance can support safety without becoming disproportionate. The dividing line is accountability: knowing what is being captured, explaining why it is necessary and taking practical steps to protect everyone who appears in the frame. When those principles guide design and day-to-day management, CCTV becomes a controlled security tool rather than an unmanaged data protection liability.
