GDPR Q42
Can I still use CCTV cameras?
Q42. Can I still use CCTV cameras?
Category: Surveillance
CCTV can support safety and security, but it must be used proportionately and transparently under GDPR.
In simple terms
- Have a clear purpose and lawful basis.
- Inform people they are being recorded.
- Control access, retention, and sharing carefully.
Planning CCTV use
Carry out a DPIA to assess necessity, proportionality, and alternatives. Decide on camera locations, retention, and viewing rights.
- Avoid filming private areas such as toilets or break rooms.
- Use signage explaining who operates the cameras and how to contact them.
- Limit recording times if continuous monitoring is not needed.
Managing footage
Restrict access to authorised staff, secure storage, and delete footage once it is no longer required unless needed for investigations.
- Respond to SARs by providing footage of the requester where feasible.
- Share footage only when legally justified (e.g., law enforcement requests).
- Log access and disclosures.
Practical steps to take
- Document the purpose and lawful basis for CCTV.
- Install signage and update privacy notices.
- Train staff on how to handle footage securely.
- Set retention periods (often 30 days) and delete automatically where possible.
- Review the system annually to ensure it remains necessary.
Real-life examples
Retail security
A shop uses CCTV to deter theft, keeps footage for 30 days, and provides a contact address on signage.
Car park monitoring
A housing association records entrances, retains footage for 14 days, and supplies clips to residents who request evidence of vandalism.
Helpful reminders
- Audio recording is rarely justifiable—avoid it unless clearly necessary.
- Mask neighbouring properties if cameras could capture them.
- Test requests handling by simulating SARs for footage.
Key takeaway
Use CCTV responsibly—define purposes, inform people, and manage footage securely.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.