CCTV & Video Surveillance Compliance Check

Why this matters

Footage of identifiable people is personal data, so any business that runs CCTV, a video doorbell, body-worn cameras or dashcams is a data controller under the UK GDPR and the Data Protection Act 2018. That means you need a lawful basis (usually legitimate interests, supported by a documented assessment), clear signage and privacy information under Article 13, a sensible retention period, secure storage, and a process for handling subject access requests for footage. Businesses using CCTV must also pay the ICO data protection fee, and the ICO can issue fines of up to £17.5 million or 4% of global turnover for serious breaches.

Cameras are one of the most common sources of data protection complaints against small businesses, particularly where they cover staff areas, toilets, car parks shared with neighbours or public pavements, or record audio. Public bodies and others covered by section 33 of the Protection of Freedoms Act 2012 must follow the Surveillance Camera Code of Practice, and the ICO’s video surveillance guidance expects every business to be able to show why cameras are necessary, proportionate and regularly reviewed. Adding facial recognition or analytics raises the bar further and usually requires a Data Protection Impact Assessment.

What you'll need

• A list of all cameras in use, including doorbell cameras, dashcams and body-worn devices
• Details of where cameras point and whether any record audio
• Your current CCTV signage and privacy notice wording
• Information on how long footage is kept and who can access it

What you'll get

A personalised compliance report covering: a score out of 100, an executive summary, a list of findings ranked by severity, and a prioritised action plan with timeframes.