CCTV and data protection in the UK: a guide for homes and businesses

Does data protection law apply to your CCTV?

The law is the UK GDPR and the Data Protection Act 2018, and the regulator is the Information Commissioner’s Office (ICO). For businesses, the boundary makes no difference: cameras inside a shop, office or warehouse that see customers, staff or visitors are covered just as much as cameras on the street. At home, the “household exemption” covers cameras that stay within your own property, even if visitors, family or delivery drivers appear on them. If you run a business from home or employ people there, such as a cleaner or nanny, take advice, as the exemption may not cover filming them.

Capturing beyond your boundary doesn’t make home CCTV unlawful. It means the data protection rules apply to those images. In Ryneš (2014), the European Court of Justice decided that a homeowner whose camera also covered a public footpath was within data protection law, and it accepted that protecting his family and home could be a legitimate reason to record there. In other words: you can do it, you just need to follow the rules.

Data controllers and data processors

Every CCTV system has a data controller: whoever decides why the cameras are there and how they’re used. The controller is legally responsible for getting it right.

• Businesses and organisations are the controller for their own CCTV, even when someone else installed it.
• Landlords and managing agents are usually the controller for cameras in shared areas of flats, HMOs and business parks.
• Homeowners are the controller for home CCTV that captures beyond their boundary.
• Joint controllers: where two organisations decide together how a system is used, such as a landlord and a tenant, both are responsible.

A data processor handles footage on the controller’s behalf and only on their instructions: a company that maintains the system with remote access, a cloud service storing recordings, or an alarm receiving centre monitoring the cameras. The controller must have a written contract with each processor covering security, confidentiality and what happens to the footage. An installer who only fits the equipment, and never handles your footage, isn’t a processor.

Signs: what a compliant CCTV sign must say

People must be told they’re being recorded. A clear sign is the usual way, and the ICO expects it to include:

• That CCTV is in operation, with words and, ideally, the camera symbol
• Who runs it: the name of the business or organisation (the controller)
• Why: for example crime prevention and public safety
• How to get more information: a phone number, email address or website
• That audio is recorded, if it is

Put signs where people will see them before they enter the area being recorded, such as at gates, entrances and car park barriers, and make them big enough to read easily. Keep fuller details, such as your retention period and how to request footage, in a privacy notice on your website or at reception.

An example, based on the ICO’s own wording: “Images are being monitored and recorded for the purposes of crime prevention and public safety. This system is controlled by [your business name]. For more information, call [phone number] or visit [website].”

At home, if your cameras or video doorbell capture beyond your boundary, the ICO expects you to let people know you’re using CCTV, for example with a sign. Use the same kind of sign as a business: CCTV in operation, who runs it (your name is enough), why, and how to contact you. Put it where people will see it before they’re recorded, such as at your gate, front door or drive. Telling your neighbours is a good courtesy, but it doesn’t replace a sign.

Can you record outside your property boundary?

Yes, but you must be able to explain why, and keep it to a minimum. There’s an important difference between public or shared areas and other people’s private property:

• The street, pavement or a shared drive: often justifiable, where it’s needed to cover your own property, such as your front door, your gate or your car parked outside. Capturing passers-by along the way is usually acceptable if you have a genuine reason.
• A neighbour’s home, garden or windows: very hard to justify. Position cameras to avoid them, and use privacy masking to black out anything that can’t be avoided. Deliberately recording a neighbour’s private space can be unlawful, and in Fairhurst v Woodard it contributed to a finding of harassment.

Good reasons to capture beyond your boundary include covering your car, seeing who comes to your front door or gate, and watching a route intruders have used before.

If you do, you’re a data controller for those images, so:

1. Write down your reasons

   A short note of why you need to capture beyond your boundary, in case your neighbours or the ICO ask.

2. Capture no more than you need

   Angle cameras carefully and use privacy masking to black out neighbours’ windows, doors and gardens.

3. Put up a sign

   Telling people who runs the cameras, why, and how to contact you.

4. Delete footage automatically

   Set the recorder to overwrite after a short period.

5. Turn off audio recording

   Especially on video doorbells, which often record sound by default.

6. Be ready for requests

   People you record can ask for their footage, ask you to delete it, or object to being recorded.

Who has to register with the ICO?

There’s no separate CCTV register. Instead, data controllers pay the ICO’s annual data protection fee, which also adds them to the ICO’s public register, unless they’re exempt.

From 17 February 2025 the fee is £52 a year for micro organisations (up to 10 staff or turnover up to £632,000), £78 for small and medium organisations and £3,763 for larger organisations. The ICO can issue fines for not paying.

Do homeowners need to pay the ICO fee or register?

No. Using CCTV or a video doorbell at your own home, for your household’s security, doesn’t require the data protection fee, and there’s nothing to register, even if your cameras capture the street or beyond your boundary. What does apply, if they capture beyond your boundary, is everything else in this guide: a clear reason, minimal coverage, a sign, sensible retention and answering requests for footage.

How long can you keep CCTV footage?

There’s no fixed legal period. The ICO says your purpose should decide how long you keep footage, and it should be the shortest time that purpose needs, not however long your recorder happens to hold. Many businesses settle on around 30 days, which is usually long enough to notice an incident and save the clip. Set the recorder to overwrite automatically, and keep a clip for longer only when there’s a reason, such as a police investigation or an insurance claim.

Can you record audio?

Only rarely, and not usually at home. Recording conversations is far more intrusive than video. The ICO says audio should be switched off by default and only used where you’ve identified a specific need that only audio can meet, with signs that say audio is being recorded. In Fairhurst v Woodard, below, a video doorbell’s video was lawful but its audio wasn’t. Many video doorbells and cameras record sound out of the box, so check the settings.

Your other responsibilities

• Keep footage secure: limit who can view it, protect the recorder and app with strong passwords and two-factor sign-in, and keep firmware up to date.
• Answer subject access requests: normally within one month, extendable by up to two months for complex requests. You can’t charge for them, except a reasonable fee where a request is manifestly unfounded or excessive, or for extra copies; the old £10 fee was abolished in 2018. Blur other people who can be identified. Modern systems make it quick to find and export a clip from the app.
• Handle disclosures properly: you can give footage to the police to help prevent or detect crime. Keep a note of what you gave, when and why.
• Don’t post footage online: sharing identifiable people publicly can be unlawful, and it can harm a police investigation.
• Assess the risks: for most business CCTV, the ICO says a data protection impact assessment (DPIA) is a legal requirement.
• Tell staff about CCTV in the workplace and why it’s there. Covert monitoring is only justified in exceptional cases, such as suspected crime.
• Review it: check every year or so that each camera is still needed and still pointing where it should.

Landmark case: Fairhurst v Woodard (2021)

The case that made UK homeowners take notice. In October 2021, in Oxford County Court, Her Honour Judge Melissa Clarke found that Jon Woodard’s home cameras had broken data protection law and harassed his neighbour, Dr Mary Fairhurst.

• The cameras: a Ring video doorbell, a camera on his shed overlooking a shared car park, and one covering a shared driveway.
• The doorbell’s video was lawful: it captured the street only incidentally, while doing a legitimate security job.
• The doorbell’s audio wasn’t: it picked up conversations from more than 40 feet away, nearly all of Dr Fairhurst’s property, which the judge found excessive. She said the doorbell would have been just as effective for security with no audio at all.
• The camera covering the shared driveway was unlawful: there was no good reason for it to capture what it did.
• Misleading the neighbour counted against him: he hadn’t been open or honest about what the cameras recorded, which breached the requirement to process data fairly and transparently.
• Harassment: his conduct, including the cameras, amounted to harassment under the Protection from Harassment Act 1997.
• Nuisance failed: following the Court of Appeal’s decision in Fearn v Tate Gallery, being overlooked wasn’t a nuisance. (The Supreme Court later overturned Fearn, in 2023.)

Damages were decided separately, and press reports at the time suggested the total cost to Mr Woodard could reach around £100,000. The lessons: point cameras at what you need to protect, turn off audio, and be honest with your neighbours.

Other cases worth knowing

• Ryneš (European Court of Justice, 2014): a home camera that also covered a public footpath was within data protection law, and the court accepted that protecting a family and home can be a legitimate reason for recording there. Home CCTV beyond the boundary is allowed, with the rules applied.
• Peck v United Kingdom (European Court of Human Rights, 2003): a council released CCTV footage of a man in distress in a town centre to the media, without hiding his identity. The court found a breach of his right to respect for private life: a reminder to think before sharing footage.

A quick checklist

• Decide and write down why you need each camera
• Angle cameras and use privacy masking so they capture no more than they need to
• Put up clear signs: CCTV in operation, who runs it, why and how to contact you
• Turn off audio unless you have a specific, evidenced need
• Set the recorder to overwrite automatically after a short period
• Secure the recorder, app and remote access
• Businesses: pay the ICO data protection fee and complete a DPIA
• Know how you’ll answer a request for footage within one month

The ICO also publishes a checklist for small CCTV systems.

How we help

We design CCTV systems for businesses and homes across Kent and beyond that cover what you need and nothing you don’t: cameras positioned and masked to keep out neighbours’ property, audio off unless it’s justified, sensible retention, secure remote viewing, and advice on signs. We’re NSI Systems Silver approved for CCTV.

Questions