By using well-defined boundaries as a basis, CCTV can be a valuable tool. However, it doesn’t prevent a crime from being committed and does have limitations.

CCTV linked to a smartphone will alert you to someone crossing your boundary.

Most importantly, CCTV is no substitute for good quality physical security such as secure doors and windows.

Some cameras work by day and by night and record when they detect movement. Some can be remotely viewed from a smartphone.

Position cameras where they are best able to obtain good quality facial images. Could you recognise or identify someone from the footage?

There is legislation for home CCTV use, so always seek advice from an accredited installer first to ensure your system complies with the law.

Place signage up warning that CCTV is in use.

For advice and approved suppliers of CCTV visit the National Security Inspectorate and the Security Systems and Alarms Inspection Board

Installing CCTV? Things you need to do first

These basic steps about installing CCTV have been written for SMEs, small businesses, and small organisations of any type including schools, libraries and community centres.

If you’re thinking about installing CCTV, you’ll need to think about data protection, too. People care about how you treat their personal data and that includes video footage captured by CCTV.

By following these basic steps, we hope you’ll feel confident that your use of CCTV complies with data protection law. You’ll also demonstrate to your customers, staff, members, and visitors how seriously you take your data protection obligations. 

Step one:

Think about how you’ll respect people’s privacy and uphold their rights

People have a right to privacy, so if you’re thinking about installing CCTV, you have to consider how it could impact them.

More info

It’s not unusual to see security cameras in the doorway of a bank or a nightclub, but people don’t expect to be filmed all the time.Generally speaking, CCTV shouldn’t be running in areas considered private – such as in toilets and changing rooms. In most cases, using CCTV here wouldn’t be fair or proportionate, meaning it wouldn’t be compliant.

If you employ staff, you should listen to any concerns they may have about being filmed. Before installing CCTV, you should explain why you’re doing it. If you install CCTV for security reasons, it may not be fair on your staff to use it to monitor or discipline them without warning. If you want to use CCTV to monitor your staff, you’ll need to make this clear to them and have a strong reason for doing so. Staff members can complain to the ICO if they feel you’re using CCTV unfairly. You can the ICO if you’re unsure about the right thing to do in your situation.

As long as you’re using CCTV, you also need to know about people’s information rights and your responsibilities. One of the most common rights that you’re likely to come across is the right of access. This means that people can ask you for copies of their own personal data, including video recordings. The CCTV system you choose therefore needs to be able to retrieve and edit footage so that this right can be upheld.

If you plan to use CCTV but you’re worried that people might complain to the ICO when you tell them it’s there, you should probably consider other security options before making the investment. 

For example, Margaret runs a small boutique. She’s worried about shoplifting. She considers putting CCTV cameras in the fitting rooms but she’s concerned it would be too intrusive. Instead, she decides to start using security tags on her merchandise and introduces a new policy where a member of staff logs how many items of clothing a customer takes into the fitting rooms.

Step two:

Consider if you need to use audioMany cameras can record sound – but this doesn’t mean you should. You should consider whether it’s necessary in the situation you want to use it in.

More info

Some of the key concepts in data protection law concern transparency, fairness and proportionality. Because recording conversations can be particularly intrusive, capturing audio is difficult to justify in most everyday situations. In most cases, you won’t need to listen to anyone, and you’re unlikely to find a lawful basis to do so. 

Step three:

Create a document which explains your decisionYou now need to set out why you think you need CCTV and how you plan to minimise the impact it will have on people’s privacy.  

More infoYou need to create a document which explains your decision to use CCTV instead of any other options you’ve considered and which sets out an assessment of how it will impact people’s privacy. This is an important document to have in writing and it’s known as a data protection impact assessment (DPIA). All organisations – large and small – should create their own DPIA before installing CCTV. 

For example, Lucy is a local business owner and has decided to install CCTV after a spate of vandalism that has damaged her cafe. She thinks about installing security lighting, but notices that other local businesses had been vandalised, even with security lighting. She decides that CCTV is the best fit for her business to prevent her property from being damaged. She documents this as part of a DPIA.

Step four:

Update your policiesYou need to pull together the information you’ve gathered in steps one, two and three and use it to update your policies.

More infoEvery company, no matter the size, will have policies in place for how they do things. It’s important that you update your privacy notice to reflect that you’re now using CCTV. You also need a separate CCTV policy.In your CCTV policy, you need to explain the reasons why you’re using CCTV, outline any staff responsibilities, and record any security measures you put in place to keep your footage secure.A shorter version of this should be included in your privacy notice. You can create your own privacy notice using our template, if you haven’t already got one.Being on top of your policies is not only efficient, but will also make the right impression on your customers, members and clients, particularly if they ask you questions about keeping their personal data safe. This can help to reassure them that you’re a trustworthy company.

Step five:

Pay attention to how your CCTV is set-upBefore you start using your CCTV, you need to check the camera angle, put up signs to tell people it’s there and register with the ICO.

More info

When your CCTV system is being installed, make sure it only captures what you need it to – and nothing more. A slight adjustment of the camera angle could make a big difference to what’s included in the shot. You also need to check the footage is clear and detailed, otherwise it will be of limited use to you.Once your CCTV system is set-up, you need to put up signs to let people know that you’re filming them. The signs should make it clear that CCTV is in operation and should be displayed in noticeable areas, such as a shop window. Your signs should be one of the first things people see when they approach your premises. This could also help to improve your security through deterrence.Make sure you include your contact details on your CCTV signs so that people know who is recording. Your signs are important so people know what you’re doing and why. Most organisations that use CCTV also need to pay the data protection fee. For most SMEs this will be either £40 or £60 a year. 

For example, James runs a bar with an outside terrace on a busy public road. There have been incidents on the terrace including fights and theft, so he decides to install CCTV. He chooses a CCTV system that records high quality footage and positions the cameras so they cover only his terrace and entrance and exit, and not people passing by outside. He puts up signs at the entrance and around the terrace, to both act as a deterrent and to let those using the terrace know that the CCTV is there. He also registers with the ICO and sets up an annual direct debit payment to make sure his data protection fee is never overdue.If another fight breaks out on his terrace, James could use the system to identify those responsible and take the necessary action. James will know fairly quickly if an incident happens, either as a result of his staff, his customers or the police telling him, and he can then review the footage. But, if nothing happens, he won’t need to keep that footage for very long. As a result, James decides to introduce a six-week retention policy for the CCTV footage.

Step six:

Keep on top of the footage you captureYou shouldn’t keep the CCTV footage for longer than you need it and you need to keep it safe while you have it.

More info

If the CCTV footage that you capture falls into the wrong hands, your customers could be at risk and you may need to notify us of a personal data breach. You can avoid this by keeping the footage in a secure place.You should only keep CCTV footage for as long as you need it. Most CCTV systems will have an overwrite feature, so make sure you turn this on or find another way to make sure the footage is deleted securely. 

For example, Mike runs a local community centre and wants to install CCTV to prevent crime. When choosing his CCTV system, he makes sure it suits the community centre’s needs, by checking the footage quality and looking at how long the system keeps the recordings for. He then puts up signs in the windows and entrance, to make sure staff, volunteers and visitors are aware that CCTV is being used before they enter. He makes sure the staff and volunteers know what to do if someone asks for more information about their CCTV, or asks for a copy of the footage. He also trains a trusted staff member on how to use the system itself, so that they can manage the CCTV in his absence.

The CCTV system and the footage are security protected using passwords and the system controls are in a locked private room. Mike only needs the footage if an incident occurs, so he keeps the footage for three months before securely deleting it.