CCTV in the workplace: UK legal requirements for employers

What employers need to know

Installing CCTV in the workplace is a highly effective way to protect your premises, safeguard your assets, and support the wellbeing of your staff with modern security cameras. However, the decision to monitor employees is not one that should be taken lightly. In the UK, businesses are governed by the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).

Navigating the line between corporate security and employee privacy rights can be tricky. This guide explains what UK employers need to consider when setting up and managing a lawful, fair, and effective video monitoring system.

Why invest in workplace surveillance?

Modern businesses use security cameras for a range of valid reasons. Upgrading your infrastructure and improving site safety with network cameras can help protect staff from external intruders and physical threats.

Retailers, warehouses, offices, and industrial sites may also rely on CCTV to help prevent theft, investigate incidents, and protect high-value assets. By deterring dishonest behaviour and supporting evidence gathering, video security can reduce risk and support better operational control.

Modern technology also offers practical convenience. Cloud-based office monitoring can reduce reliance on physical on-site servers that can be tampered with or destroyed. Instead, authorised managers can securely review footage off-site, making remote-access business surveillance systems especially useful for multi-site operations and hybrid working environments.

The UK legal landscape: balancing security and privacy

Because CCTV captures images of identifiable people, the footage is classed as personal data. The Information Commissioner’s Office (ICO) therefore expects employers to have a clear, justifiable reason for filming.

Completing a DPIA

A Data Protection Impact Assessment (DPIA) is mandatory before processing where the proposed CCTV use is likely to result in a high risk to people’s rights and freedoms. Large-scale systematic monitoring of publicly accessible areas is one trigger; workplace monitoring can also be high risk. Screen and document the risk before installation. Where the mandatory threshold is not met, a DPIA is still good practice. Follow the ICO’s DPIA guidance. The employer or operator remains responsible as controller.

Updating your staff handbook

To remain compliant, your business should document workplace monitoring requirements in a clear CCTV policy. This policy should explain why cameras are installed, who can access the footage, how long recordings are stored, and how employees can request access to recordings of themselves through a Subject Access Request.

Compliance note

This article is general guidance for UK employers. CCTV policies, DPIAs, and employee monitoring decisions should be reviewed against your own premises, risks, and legal obligations.

Navigating employee privacy and trust

While employers have a right to protect their business, staff also have a reasonable expectation of privacy at work. Cameras should not be installed in spaces where privacy is expected, such as toilets, changing rooms, break rooms, and prayer facilities. Placing cameras in these locations is highly intrusive and is likely to breach core UK data protection principles.

It is also important to consider the effect monitoring can have on staff. A workplace that feels like a surveillance environment can damage morale, increase stress, and reduce trust. Being transparent and explaining why CCTV is necessary for safety and security, rather than simply monitoring productivity, helps create a more positive culture.

Key rules for installation and operation

When setting up a workplace CCTV system, employers need to follow several practical rules from the outset. Camera placement, system configuration, signage, and access permissions should all be planned before installation begins.

Transparency and signage

The question of covert cameras versus visible security systems is usually settled by UK data protection expectations: transparency is almost always required. Hidden cameras are rarely justifiable and should only be considered in highly specific, serious circumstances, such as a police-supported investigation into criminal activity.

In most cases, you must install clear warning signs for business cameras. These signs should be visible and legible, state that CCTV is in operation, and include the contact details of the organisation managing the system.

Audio recording: a step too far?

Audio should be switched off by default on workplace cameras. Recording conversations is particularly intrusive and should be considered only in exceptional circumstances, with a documented lawful basis and evidence that it is necessary and proportionate for a specific need. Consider less intrusive alternatives and explain why they would not meet that need. Make audio recording clear to staff and anyone else affected, consult the workforce, and complete a DPIA before processing where the use is likely to create a high risk. Continuous monitoring of individuals is only likely to be justified in the rarest circumstances. See the ICO guidance on audio recording and workplace surveillance.

Managing and using CCTV footage

Recording footage is only part of the compliance picture. Employers must also manage, access, retain, and delete footage in a lawful way.

Disciplinary procedures

A common pitfall is using video evidence for disciplinary procedures without prior warning. If CCTV is installed primarily to prevent break-ins, employers should not suddenly use that footage to discipline an employee for unrelated conduct unless this use has been made clear in advance. If footage may be used for performance or disciplinary matters, that must be explicitly stated in workplace policies.

Safe storage and deletion

Footage should only be kept for as long as necessary to fulfil its original purpose. For many standard offices, a retention period of 14 to 30 days is usually sufficient. After that period, the system should automatically overwrite or permanently delete older files. Footage should be stored securely, encrypted where possible, and only accessible by trained, authorised personnel.

Legal steps to install office security cameras

1. Identify the need: Document exactly why CCTV is required in the workplace, such as crime prevention, health and safety, or asset protection.
2. Assess privacy risks: Document DPIA screening before installation. Complete a DPIA where processing is likely high risk; consider one as good practice in other cases.
3. Consult your team: Discuss plans with staff or trade union representatives so monitoring is transparent and understood.
4. Draft a CCTV policy: Create and distribute a written workplace monitoring policy covering purpose, access, retention, and Subject Access Requests.
5. Check camera placement: Ensure cameras avoid private spaces, minimise unnecessary capture, and do not overlook neighbouring properties unnecessarily.
6. Disable audio: Turn off sound recording unless there is a narrow, documented, legally justifiable reason to use it.
7. Display signage: Install clear signs telling people that CCTV is in operation and who manages the system.
8. Secure the data: Restrict access to authorised users and protect recording systems with strong passwords and appropriate security controls.

Final thoughts

A CCTV system can provide clear benefits for protecting business assets, supporting staff safety, and investigating incidents. However, employers in the UK must balance those benefits against the privacy rights of their team.

By maintaining transparency, following UK GDPR principles, documenting your reasons for monitoring, and keeping communication open, you can create a safer and legally compliant workplace where CCTV supports security without undermining trust.

Q&A

Common questions employers ask before installing workplace CCTV.

Do we need to complete a Data Protection Impact Assessment before installing workplace CCTV?

A DPIA is mandatory where the proposed processing is likely to result in high risk, including large-scale systematic monitoring of publicly accessible areas. Screen the proposed workplace monitoring before installation and record the decision. Where it is not mandatory, a DPIA remains good practice; the controller must still meet the other UK GDPR obligations.

What must our workplace CCTV policy include?

A CCTV policy should explain why CCTV is used, who can access footage, how long recordings are kept, and how employees can make Subject Access Requests. If footage may be used for performance or disciplinary matters, the policy should say so clearly before that footage is relied on.

Where can workplace cameras be placed?

Cameras should be placed only where there is a clear business need. Avoid locations where employees have a full expectation of privacy, including toilets, changing rooms, break rooms, and prayer facilities. Camera placement should also minimise capture of neighbouring properties and unnecessary private areas.

Are covert cameras allowed in the workplace?

Covert cameras are rarely justifiable. UK expectations favour transparency, so visible cameras and clear signage should be used in almost all workplace settings. Hidden cameras should only be considered in serious, specific circumstances and with appropriate legal advice.

Can employers record audio in the office?

Audio should be off by default. Any exceptional use needs a documented lawful basis and evidence that it is necessary and proportionate for a specific need, after considering less intrusive alternatives. Tell staff and others affected clearly, consult the workforce, and complete a DPIA where the processing is likely high risk. See the ICO audio-surveillance guidance.