CCTV at work: the rules an employer has to meet

A camera usually goes up for a reason that sounds obvious at the time. Stock went missing. An insurer asked. Someone was threatened on a late shift. It works, and nobody writes down what it is for. Two years later a manager wants last Tuesday's footage to settle an argument about lateness, and nobody can answer the question that matters: what was this system installed to do?

This post covers what United Kingdom law asks of an employer running CCTV at work, from the lawful basis to using footage in a disciplinary case. It names no products, and it is general information about the United Kingdom position, not legal advice.

These duties fail at the handover, not at the decision. See how New Dynamics workflows give each step an owner and a due date, including the review date that decides whether a camera stays switched on.

Two pieces of Information Commissioner's Office guidance apply at once: guidance on video surveillance, including CCTV and guidance on monitoring workers. Checked on 7 November 2026, both carried the note that "this guidance is under review and may be subject to change" after the Data (Use and Access) Act, and every quotation below is as it stood that day. The law behind it is the UK GDPR and the Data Protection Act 2018. Our post on employee monitoring software covers monitoring tools.

You need a lawful basis before the camera records

Film an identifiable person and you are processing their personal data. The ICO is explicit: "For any use of surveillance systems, you need to identify and document a lawful basis under Article 6 of the UK GDPR." Article 6(1), in the version on legislation.gov.uk, says "Processing shall be lawful only if and to the extent that at least one of the following applies", then lists six grounds. Most private employers land on legitimate interests. Because genuine consent is hard to obtain, "it is likely the appropriate lawful basis will be either legitimate interests, or a reliance on public task" for a public authority.

Legal obligation fits where a rule outside data protection law requires the recording, such as tachographs for drivers' hours, but it "does not apply to contractual obligations". Where an employer wrote video surveillance for productivity into its contracts, the ICO found "other less intrusive ways of improving productivity" were available.

Why consent is the wrong answer at work

Consent is listed first in Article 6, which is why it is reached for first, and it is usually wrong: "consent is not usually appropriate in the employment context, due to the imbalance of power between you and your workers." It works only where "workers have a genuine choice and control over the monitoring". A camera on the only entrance is not a genuine choice, and a signed policy does not fix it: "Excessive monitoring set out in a policy does not make it lawful, just because it is documented."

When an impact assessment stops being optional

For cameras the guidance does not leave this open. If you are considering video or audio monitoring you must "complete a DPIA, as this will help you assess whether the benefits justify the adverse impact". The general trigger sits alongside it: "You must carry out a DPIA before undertaking any processing likely to cause high risk to workers' and other people's interests." Facial recognition pulls that trigger on its own, because the ICO says it presents "a high risk". How to run the assessment is a subject of its own and is not covered here.

What staff must be told, and where the signs go

Transparency is the duty you can test by walking the site. "Apart from in very exceptional circumstances where covert monitoring is justified, you must inform workers about any monitoring." Awareness is maintained rather than announced once, "through your organisation's intranet or signage in areas subject to monitoring".

Signs should be "clearly visible and readable" and sized for the context. Place them "prominently before the entrance to the system's field of vision" and repeat them inside, because it is unfair for someone to read a warning about intrusive surveillance "if the system has already captured them whilst reading it". You are also expected to consult the workforce, "eg staff and/or trade unions", during the DPIA.

Covert cameras: the part employers get most wrong

Covert monitoring is "monitoring in a way designed to ensure workers are unaware that it is taking place", and the ICO starts from a refusal: "It is unlikely that you will be able to justify covert monitoring in most usual circumstances." One door is left open, "if covert monitoring is necessary to enable you to prevent or detect suspected criminal activity or gross misconduct".

The conditions are tight.

• "Covert monitoring should only be authorised by senior management."
• "You must carry out a DPIA."
• You should be satisfied "that informing workers about the monitoring would prejudice its prevention or detection".
• Target it "at obtaining evidence within a set timeframe, limited to the shortest time possible", and stop "after the investigation is complete".

That is a short, authorised investigation with an end date, not a hidden camera left running in case something turns up. Our post on workplace investigations covers the process it feeds into.

Places a camera is very hard to justify

Some areas are off the table: "You should not use covert audio or video monitoring in areas where workers would reasonably expect to be private, such as toilets or changing rooms." Staff rest areas fail too, because video there "would not generally be expected by staff". In the ICO's example, workers report thefts from staff changing rooms and cameras inside them are ruled out: "The adverse effect of filming workers when they would reasonably expect privacy means this monitoring is unfair." The employer films "the door outside the changing room" instead, signs it with the purpose, and limits it "to the duration of the investigation". The siting rule is one line: "confine it to areas where expectations of privacy are low."

How long you can keep footage

There is no number, and the ICO says so: "The UK GDPR and the DPA 2018 do not prescribe any specific minimum or maximum retention periods which apply to surveillance systems or the personal data you may process. Rather, it is the purpose of your processing that should determine your retention period."

Any figure quoted as a legal maximum is somebody's house rule. You do have to set a period and keep to it, and it "should be the shortest period for that purpose". The guidance names the usual mistake: footage "shouldn't be kept for six months merely because the manufacturer's settings" allow it. Our post on employee records retention covers the schedule the deletion step hangs off.

Using footage in a disciplinary case

This turns on purpose, not on how damning the footage looks. You "can only use the personal data for a new purpose if: this is compatible with your original purpose; you get consent from individuals; or you have a clear obligation or function set out in law."

So a camera installed to deter theft at a loading bay is not automatically an attendance record; the ICO calls that drift "function creep". If footage is used as evidence the worker can ask for it, and "you may need to be able to redact third parties from the footage", so keep access narrow, as our post on access levels for HR data describes.

Audio is treated more strictly than video

Most systems can record sound. The default should be off. Audio "is considered more privacy intrusive than purely visual recording", so you "require a much greater justification if you use it" and "should switch off by default any capability to record audio". There is a ceiling for the pair: "Continuous audio and video recording can be highly intrusive and you are unlikely to be able to justify it in most circumstances."

Vehicles and homeworkers

Work vehicles. Monitoring is allowed, with a line at private use: "if you allow workers to use the work vehicle for private use, you will rarely be able to justify monitoring during private use." Driver facing cameras raise the bar again: it "is harder for you to justify driver monitoring, such as monitoring driver behaviour and driving style". Dashcams follow the same audio rule, and you must "inform workers and passengers of any vehicle monitoring". Where the device is a worker's own phone, our post on a bring your own device policy covers the boundary.

Homeworkers. ONS reported that "More than a quarter of workers in Great Britain (28%) were hybrid workers between 8 January and 30 March 2025" in Who has access to hybrid work in Great Britain?, released on 10 June 2025. Wider figures sit in our HR statistics hub. The standard rises at home: "workers' expectations of privacy are likely to be higher at home than in the workplace." An always on webcam fails that test in almost every case.

Frequently asked questions

Can my employer watch me on CCTV at work?

Yes, within limits. Filming identifiable staff is processing personal data, so a United Kingdom employer needs an Article 6 lawful basis, has to tell workers, and must confine cameras to areas of particular risk where expectations of privacy are low.

Does an employer need consent to use CCTV at work?

Usually no, and consent is usually the wrong basis. The ICO says it is not appropriate in the employment context because of the imbalance of power between an employer and its workers. Legitimate interests, or public task for a public authority, is the likely basis.

Is covert CCTV in the workplace ever lawful?

Only in exceptional circumstances, such as preventing or detecting suspected criminal activity or gross misconduct. It must be authorised by senior management, covered by an impact assessment, targeted for the shortest possible time, and stopped once the investigation ends. Toilets and changing rooms are excluded outright.

How long can an employer keep CCTV footage?

No official source sets a figure. The ICO says the UK GDPR and the Data Protection Act 2018 do not prescribe any minimum or maximum retention period for surveillance systems, and that the purpose determines it. A recorder's default capacity is not a justification.

Can CCTV footage be used in a disciplinary hearing?

Only if the new purpose passes the reuse test: compatible with the original purpose, consented to, or required by a clear obligation set out in law. Footage from a camera installed to deter theft is not automatically an attendance record.

Your next step

1. Walk the site and write one sentence per camera saying what it is for. A camera without a sentence is a decision to make, not a camera to keep.
2. Record the lawful basis for each zone, with the legitimate interests assessment where that is the basis.
3. Complete the impact assessment before anything new goes in, and set retention in the recorder rather than in a reminder.
4. Put the covert exception, the authorisation level and the reuse rule in the policy now, while nothing is under investigation.

For the wider duties around employee data, read and download our employee data protection guide. The guide is free to read, and the PDF uses our short download form.

Want the policy, the review date and the owner in one place? Book a New Dynamics demo and bring your camera list, or email contact@new-dynamics.com.