UK GDPR: CCTV: does it apply to you?
UK General Data Protection Regulation (UK GDPR)
When this applies
CCTV footage constitutes personal data under UK GDPR. You likely need clear signage, a retention policy, access controls, and a reference to CCTV in your privacy notice.
When it does not apply
CCTV obligations do not apply if you do not operate cameras that capture identifiable individuals.
What is at stake
Operating CCTV without proper compliance is a UK GDPR breach. ICO can issue enforcement notices and fines.
What to do
Display clear signage informing people CCTV is in operation. Complete a DPIA if high-risk. Retain footage only as long as necessary and restrict access. Add CCTV to your privacy notice.
Check all 27 regulations for your business
This is one of 27 checks getsorted runs. Answer around 12 questions and see your full compliance picture in three minutes. Free, no account.
Check your business →Reviewed: 2026-06-25 · Source: official guidance