CCTV for businesses: UK rules and best practice
Businesses using CCTV are data controllers. You will usually need to pay the ICO data protection fee, display signs, limit what you record and respond to requests for footage.
Businesses using CCTV are data controllers. You will usually need to pay the ICO data protection fee, display signs, limit what you record and respond to requests for footage.
The short answer
Unlike most homeowners, a business using CCTV is processing personal data and must comply with the UK GDPR and the Data Protection Act 2018. The ICO says businesses using non-domestic CCTV are likely to need to pay a data protection fee (ICO).
The data protection fee
The fee depends on the size and turnover of your organisation. Fees rose by 29.8% across all tiers in 2025 (GOV.UK), and a small or medium organisation using CCTV is currently charged £78 a year (ICO fee self-assessment). Use the ICO's self-assessment tool to confirm your tier.
What compliance looks like in practice
- A clear purpose. Write down why you use CCTV, such as crime prevention or staff safety, and position cameras for that purpose only.
- Signs telling people that CCTV is in operation, who operates it and how to contact you.
- Proportionate coverage. Avoid areas where people expect privacy, such as toilets and changing areas.
- Defined retention. Keep footage only as long as you need it, then delete it automatically.
- Secure storage and access, limited to named people, with an access log.
- Requests for footage. People can ask for footage of themselves, and you need a process to respond.
- Audio. Recording conversations is highly intrusive and rarely justified.
- Staff. Tell employees about CCTV and how footage may be used.
The ICO's CCTV checklist is a good starting point.
Designing a compliant system
- Camera placement and privacy masking agreed against your stated purpose.
- Local recording with automatic retention settings.
- User accounts per person rather than shared logins.
- Network separation, so cameras cannot be used as a route into business systems.
- Hardware from manufacturers that publish security update periods, as UK product security law requires for consumer connectable products (GOV.UK).
Mixed homes and businesses
If you run a business from home, or a property has both a home and business premises, the domestic and business rules can overlap. Our domestic CCTV guide covers the home side.
This guide is general information, not legal advice. For complex sites, take advice from a data protection professional.
Common questions
Does a small shop with one camera need to pay the ICO fee?
If it uses CCTV for business purposes such as crime prevention, it is likely to need to. The ICO self-assessment tool will confirm.
How long should we keep CCTV footage?
Only as long as needed for your purpose. There is no single legal period, so set and document a retention period you can justify.
Can we use CCTV to monitor staff performance?
This is intrusive and needs strong justification and transparency. Take advice before using CCTV for anything beyond security.
Related services
Sources
- ICO: CCTV checklist
- ICO: Data protection fee self-assessment
- GOV.UK: Data protection fee regime, government response
- GOV.UK: Consumer connectable product security regulations
Last reviewed 1 November 2026. Prices ex. VAT unless stated.
More guides
Smart home technology for developers and housebuilders
Specify infrastructure as standard and offer features as upgrades. A good cabling and network backbone adds little to build cost and keeps every buyer's options open.
An architect's guide to specifying a smart home
Involve the integrator at concept or spatial coordination stage. Smart systems need space, cable routes and coordination with lighting, joinery and M&E, all of which are cheaper to resolve on paper.
Smart technology for landlords, HMOs and student accommodation
In multi-occupancy buildings, smart technology earns its place through keyless access, controlled heating, early warning of leaks and damp, and a network residents can rely on.
Ready to start your journey?
Tell us about your home and we will reply within one working day to arrange a free 15-minute discovery call.