Privacy notice for a business using CCTV

CCTV footage of identifiable people is personal data, and a business that films its shop, its car park, its reception or its warehouse is a controller that needs a lawful basis, signage, a retention period, a way of handling requests from the police and from the people it has filmed, and an impact assessment where the monitoring is systematic. The privacy notice has to say all of that, deal with the cameras that watch staff as well as customers, and draw the line at audio recording and facial recognition. I draft the privacy notice and the cookie notice for the business, with guidance on the consent mechanism, for a fixed fee of £595, delivered in five working days.

Who this is for

Shops, offices, warehouses, hospitality venues, gyms, car parks, workshops and any business in England and Wales with cameras on its premises, whether the system was installed yesterday or a decade ago.

What matters in a CCTV privacy notice

CCTV as personal data and the notice it needs

Footage in which a person can be identified is personal data, and Article 13 of the UK GDPR requires the business, as controller, to tell the people it films that they are being filmed, why, who operates the system and how to find out more, which is done by signage at the entrance and in the areas covered, backed by the full notice on the website or available on request; the Information Commissioner's guidance on video surveillance sets what the regulator expects (a documented purpose, an assessment, signage, retention, access controls and a process for requests), and the notice should reflect it, because a system installed by a contractor with no documentation is a system the regulator treats as unassessed.

The lawful basis, the purposes and the impact assessment

The usual basis is legitimate interests under Article 6(1)(f) of the UK GDPR (the prevention and detection of crime, the safety of staff and customers, the protection of property, the investigation of incidents), with the interest stated and the balance against the people filmed recorded, and Article 35 requires a data protection impact assessment before systematic monitoring of a publicly accessible area on a large scale or where the processing is likely to result in a high risk, which a business with more than a few cameras should carry out and keep; the notice should state the purposes and should not list purposes the business does not have, because footage used for a purpose the notice did not state (monitoring staff productivity, say) is processing without a basis.

Signage, retention and who may see the footage

Signs should be visible before a person enters the area filmed, should say that CCTV is in operation, who operates it and why, and how to contact the business, with the full notice referenced; footage should be retained for a stated short period (commonly a matter of weeks) and overwritten unless an incident requires it to be kept, with the retention stated in the notice and applied by the system; access to the footage should be limited to named staff with a log of viewing and export, the system secured against remote access by the installer or others, and the notice should say who may see footage and in what circumstances.

Requests from the police, insurers and the people recorded

The notice should explain that the business discloses footage to the police where it is requested for the prevention or detection of crime (under the exemption in Schedule 2 to the Data Protection Act 2018, with the request recorded and the business satisfied that it is justified), to insurers and solicitors for the investigation of incidents and claims, and to the courts where ordered, and that a person who appears in footage may make a subject access request under Article 15 of the UK GDPR for the footage of themselves, which the business must provide within one month with other people obscured where that is possible, or explain why it cannot; a business that hands footage to anyone who asks, or refuses it to the person filmed, has got it the wrong way round.

Workers, monitoring and the cameras that watch staff

Cameras that cover staff areas (the till, the stockroom, the kitchen, the workshop floor) monitor workers as well as customers, and the Information Commissioner's guidance on monitoring workers expects the business to tell staff what is monitored and why, to have a lawful basis and an impact assessment, to use footage for the stated purposes (safety, security, incident investigation) and not for routine performance monitoring unless the staff have been told, and never to film changing rooms, toilets or rest areas; the notice and the staff privacy notice should both cover the cameras, and the handbook's policies should say how footage may be used in disciplinary matters.

Audio, facial recognition and the systems that go further

Audio recording is more intrusive than video and should be switched off unless the business can justify it (a specific risk, a specific area, signage that says so), facial recognition and other biometric systems process special category data under Article 9 of the UK GDPR requiring explicit consent or a substantial public interest condition, an impact assessment and, in practice, a justification few businesses can show, body-worn cameras and dashcams need their own assessment, and the notice should state what the system does and does not do; the Surveillance Camera Code of Practice under the Protection of Freedoms Act 2012 binds public bodies and is voluntary for businesses, and the notice can say the business has regard to it; the business should be registered with the Information Commissioner's Office under the Data Protection (Charges and Information) Regulations 2018, which the notice can say, and should cover the individual's rights (access, rectification, erasure, restriction, portability, objection), how to exercise them, the one-month time limit, and the right to complain to the Information Commissioner's Office.

What it costs

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

Do we need a data protection impact assessment for a few cameras in a shop?

Where the monitoring is systematic and covers a public area, the regulator expects one, and it is the document that shows the business thought about the purposes and the retention. The notice reflects it; the assessment is the business's.

A customer has asked for the footage of themselves. Do we have to give it?

The footage of themselves must be provided within one month, with other people obscured where possible, under the right of access. The notice explains the process.

Can we use CCTV to monitor staff performance?

Only if staff have been told that is a purpose, with a basis and an assessment, and never in private areas. Footage from cameras installed for security used for performance monitoring is processing without a basis.

Related guidance and services

• Data protection agreements and privacy terms, £595, the service this page describes
• Terms and conditions drafting, £995
• SaaS and technology contracts, £995
• Privacy notice for a gym or fitness business
• Employee privacy notice

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.