This page explains what's required in plain English. It isn't legal advice — the ICO's own guidance is the definitive source — but it covers what most business owners need to know.
Why does business CCTV count as personal data?
Because footage of an identifiable person is personal data under UK GDPR and the Data Protection Act 2018. The moment your cameras record someone whose face or identity can be made out, every rule that applies to personal data applies to your recordings: you need a lawful reason for it, you can only keep it as long as necessary, you must keep it secure, and people have rights over it.
This catches almost every commercial installation. If you have cameras on a business premises, assume you're in scope.
Is home CCTV different?
Yes. Purely domestic CCTV — cameras covering only your own property — usually falls under the "domestic purposes" exemption, meaning you don't need to register with the ICO.
But there's an important catch: if your home cameras capture anything beyond your own boundary — a pavement, a shared drive, a neighbour's garden, a road — that exemption can fall away and you may take on data controller duties for that footage. This is one of the most common misunderstandings in domestic CCTV, and it's mostly avoidable at the design stage by positioning cameras and using privacy masking so they cover your property and not your neighbour's.
What else do I have to do beyond registering?
Registration is only the first step. In practice, a compliant business CCTV setup also needs:
Signage. Clear signs telling people that CCTV is in operation, who operates it, and why. This is a legal requirement, not a courtesy — and it's one of the most commonly missed items.
A lawful basis. A documented reason why you're recording — usually "legitimate interests" for crime prevention — and evidence you've considered whether it's necessary and proportionate.
A retention period. You can't keep footage indefinitely. Most organisations keep footage for around 30 days unless there's a specific reason to keep it longer, such as an ongoing investigation. Your system should be configured to delete automatically.
A process for footage requests. People have the right to request footage of themselves (a subject access request), and you must respond within one month.
Proportionate camera positioning. Cameras should cover what genuinely needs covering — not neighbouring properties, not public areas beyond what's necessary, and not places where people reasonably expect privacy.
A complaints process. Since June 2026, UK organisations are required to have a process in place for handling data protection complaints under the Data (Use and Access) Act 2025.
Does audio recording change anything?
Yes, significantly. UK law treats audio as more privacy-sensitive than video. Recording conversations is harder to justify than recording images, and in workplaces it's very often considered disproportionate. Many cameras ship with audio enabled by default — if you don't have a specific, documented need for it, it's usually safer to turn it off.
How does a good installer help with this?
Most CCTV compliance problems are designed in, not caused later — and they're much easier to avoid at survey stage than to fix afterwards. A properly planned installation positions cameras to cover only what's genuinely needed, configures retention and automatic deletion correctly, advises on signage from the outset, and leaves you able to explain and justify your setup if anyone ever asks.
ALServices designs every commercial system with this in mind. Compliance isn't an add-on — it's part of specifying the system properly.