If you own or manage commercial property in the UK, CCTV is one of the most effective ways to deter crime and protect your premises. But installing cameras is not simply a case of putting them up and switching them on. There are rules you need to follow, and getting them wrong can lead to fines, complaints, and footage that cannot be used when you actually need it.
This guide covers the key regulations in plain English so you know where you stand before a single camera goes up.
Please note: this article provides general guidance only and does not constitute legal advice. If you have specific concerns about your obligations, we recommend consulting a solicitor or contacting the ICO directly.
Do You Need Permission to Install CCTV?
For most commercial properties, you do not need planning permission to install CCTV cameras. Standard external cameras on business premises are generally classed as permitted development, which means you can go ahead without making a planning application.
However, there are important exceptions. If your building is listed, you will almost certainly need listed building consent before fixing cameras to the exterior. Conservation areas can also bring additional restrictions, particularly if the cameras would alter the appearance of the building or its surroundings.
If you are a tenant rather than the freeholder, check your lease. Some leases require the landlord's permission before making any physical alterations to the building, and that can include mounting cameras.
The short version: for a standard commercial property, you are unlikely to need planning permission. But if the building has any heritage designation, check with your local planning authority first.
UK GDPR and Data Protection
This is where most of the legal weight sits. CCTV footage that captures identifiable individuals is classed as personal data under UK law. That means the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 both apply.
In practical terms, this means several things. First, you need a lawful basis for processing the footage. For most commercial CCTV, this will be "legitimate interests" -- you have a genuine need to protect your property, staff, or visitors, and CCTV is a proportionate way to do that.
Second, if your cameras cover any public areas such as pavements, car parks, or shared access routes, you may need to register with the Information Commissioner's Office (ICO) and pay the data protection fee. Most businesses that use CCTV will need to do this, and the fee is typically modest.
Third, depending on the scale and nature of your surveillance, you may need to carry out a Data Protection Impact Assessment (DPIA). This is essentially a written exercise where you identify the risks your CCTV system poses to people's privacy and explain how you are managing those risks. It is not always required, but it is good practice, and the ICO expects it for any large-scale or systematic monitoring.
Signage Requirements
You must tell people they are being recorded. This is not optional. Clear, visible signs need to be displayed in areas covered by your cameras, and they need to be positioned where people can read them before they enter the monitored zone.
A compliant CCTV sign should include the name of the organisation operating the system, the purpose of the recording (for example, "for the prevention and detection of crime"), and contact details so that people know who to get in touch with if they have questions or want to exercise their rights.
Simply putting up a sign that says "CCTV in operation" is not enough. The ICO's CCTV code of practice makes it clear that signs need to give people enough information to understand who is watching and why.
Get your signage right from the outset. It is one of the simplest parts of CCTV compliance, and one of the first things an inspector or complainant will look at.
Recording and Storage Rules
Once your cameras are recording, you have a responsibility to handle the footage properly. There is no single legal requirement for how long you must keep footage, but the general principle is that you should not keep it for longer than necessary.
For most commercial properties, a retention period of around 30 days is standard. After that, footage should be automatically overwritten or securely deleted unless it is needed for a specific reason, such as an ongoing investigation or an insurance claim.
Storage needs to be secure. If footage is stored on-site, the recording equipment should be in a locked room or cabinet with restricted access. If it is stored in the cloud, make sure your provider offers encryption and that servers are located in a jurisdiction with adequate data protection standards.
Access to footage should be limited to authorised personnel only. Keep a log of who accesses recordings and when, because you may need to demonstrate this if a complaint is raised.
You should also be aware of subject access requests (SARs). Under UK GDPR, anyone captured on your CCTV has the right to request a copy of the footage that shows them. You have one calendar month to respond, and you cannot charge a fee in most cases. Having a clear process for handling SARs will save you significant time if one comes in.
Audio Recording
Video and audio are treated differently under UK law, and audio recording is generally subject to stricter scrutiny. Recording conversations can engage the Regulation of Investigatory Powers Act 2000 (RIPA) and the Telecommunications (Lawful Business Practice) Regulations 2000, depending on the context.
For most commercial CCTV, audio recording is unnecessary and best avoided unless you have a specific, documented reason for it. If your cameras have built-in microphones, consider disabling them unless audio is genuinely needed for security purposes.
Covert audio recording -- recording people without their knowledge -- requires an especially strong justification and is very difficult to defend legally. In almost all commercial property scenarios, it is not appropriate. If you believe covert recording is necessary, take legal advice before proceeding.
Employee and Tenant Rights
If your commercial property has staff working on-site or tenants occupying parts of the building, there are additional considerations around CCTV.
For employees, you should consult with your workforce before installing cameras in areas where they work. While you are not legally required to obtain consent (legitimate interests can still apply), springing surveillance on employees without any discussion can damage trust and may attract complaints to the ICO.
Cameras should not be placed in areas where people have a reasonable expectation of privacy, such as toilets, changing rooms, or break rooms. The principle of proportionality applies: you need to balance your security needs against people's right to privacy, and you should always choose the least intrusive option that achieves your aim.
For tenants, check whether your lease allows CCTV in communal areas and be transparent about what is recorded and why. Tenants have the same rights as any other data subject under UK GDPR, including the right to make subject access requests.
Document your decisions. If you can show that you considered proportionality, consulted where appropriate, and had a legitimate purpose, you are in a much stronger position if a question is ever raised.
Getting It Right From the Start
The easiest way to stay on the right side of CCTV regulations is to get things set up properly from day one. That means choosing camera positions that cover what you need without overreaching, configuring retention periods correctly, putting up compliant signage, and having a written policy that covers how footage is stored, accessed, and deleted.
Working with a professional installer who understands the regulatory landscape makes a real difference. A good provider will not just mount cameras and run cables -- they will help you think through your obligations and make sure your system is compliant before it goes live.
At Beyond Property, we install and manage CCTV systems for commercial and vacant properties across the UK. We handle the technical side, but we also make sure you are covered on the compliance side too.
Need CCTV That's Fully Compliant?
We install and manage CCTV systems that meet all UK regulatory requirements.