Is CCTV allowed in the workplace? UK laws on employee surveillance explained

CCTV at work: a quick summary

Many workers ask: "Can an employer install cameras without telling me?" The short answer is no. Under the UK GDPR and Data Protection Act 2018, employees have the right to be informed whenever monitoring is taking place.

Businesses in the UK may use CCTV in the workplace to:

• Prevent theft, vandalism, or unauthorised access.
• Protect employees and visitors from threats.
• Monitor entrances, exits, and high-risk areas.
• Support health and safety obligations.

Skip ahead for more details on employers' legal obligations with CCTV.

What UK laws cover workplace CCTV?

Several rules for CCTV in the UK protect employees from intrusive or unfair workplace surveillance. Employers must understand how these frameworks interact before introducing any CCTV system.

1. The Data Protection Act 2018 and UK GDPR

The Data Protection Act 2018, which incorporates the UK General Data Protection Regulation (GDPR), sets the foundation for CCTV use. Because CCTV footage can identify individuals, it is legally classified as personal data.

This means employers must:

• Have a lawful basis for collecting and processing footage (usually legitimate interest).
• Process images fairly and transparently.
• Store footage securely with restricted access.
• Keep footage no longer than necessary.
• Respond to employees' Subject Access Requests (SARs).

If footage is used or shared unlawfully, employers may face heavy fines, reputational damage, and employee claims.

2. The Human Rights Act 1998

Article 8 of the Human Rights Act protects the right to respect for private and family life. Even at work, employees have an expectation of privacy. Any surveillance must therefore be justified, necessary, and proportionate.

3. The Employment Practices Code (ICO guidance)

The Employment Practices Code is published by the ICO (Information Commissioner's Office), the UK's independent authority responsible for enforcing data protection law. It oversees how organisations handle CCTV footage, investigates complaints, and can issue enforcement notices or fines for non-compliance.

Employers should regularly review ICO guidance and use it as the benchmark for lawful and ethical workplace surveillance.

The ICO's Employment Practices Code provides detailed recommendations for monitoring workers. It encourages employers to be transparent, consult staff, and assess the impact of monitoring on privacy.

It also makes clear that covert monitoring, hidden cameras in the workplace, or secret recordings should occur only in exceptional, time-limited circumstances, such as when criminal activity is suspected.

What are an employer's legal obligations when using CCTV at work?

Employers are responsible for ensuring their CCTV systems comply with UK data protection law. Employers must clearly explain the reasons for surveillance, provide appropriate signage, and set out how recordings will be stored and used.

If employers install cameras without justification, this can breach privacy rights and may lead to enforcement action by the Information Commissioner's Office (ICO).

The ICO recommends several key steps for lawful implementation.

1. Define a legitimate purpose

Before installing CCTV at work, employers must document exactly why surveillance is needed. Common purposes include crime prevention, asset protection, and ensuring staff safety. Using CCTV to monitor productivity or employee behaviour is rarely justifiable.

The purpose must be clearly stated in company documentation and visible notices. Is it illegal to watch staff on CCTV in the UK? No. But doing so without a lawful reason may well be.

2. Conduct a Data Protection Impact Assessment (DPIA)

A Data Protection Impact Assessment identifies potential privacy risks and demonstrates that CCTV use is necessary and proportionate.

It should outline:

• The purpose and benefits of CCTV.
• Locations of cameras in the workplace and coverage areas.
• The lawful basis for data collection.
• Privacy risks and how they will be mitigated.

Employers should also consult with staff or their representatives as part of this process.

3. Inform employees and visitors

Do employers have to tell staff about CCTV? Yes. Transparency is mandatory. Under the UK GDPR, employees have a right to know when and why they are being monitored with CCTV.

Employers should explain:

• What areas are being recorded.
• The purpose of surveillance.
• How long footage will be stored.
• Who can view footage.
• Whether footage may be shared with third parties.

Typically, this information is communicated through employment contracts, staff handbooks, policies, or internal communications.

Visitors should also be informed through clear signage that includes:

• The presence of CCTV.
• The purpose of recording.
• The organisation responsible for data control.
• Contact details for further information.

4. Avoid surveillance in private areas

Is CCTV in staff rooms or toilets legal? No. CCTV should never be installed in locations where individuals reasonably expect privacy, such as toilets, changing rooms, or staff rest areas.

Cameras should be aimed only at necessary business areas such as entrances, corridors, and stockrooms.

5. Restrict access to footage

Who can view CCTV footage at work? Only authorised personnel.

Footage should be stored securely, encrypted where appropriate, and protected with passwords or other security controls. Any sharing of footage, including with law enforcement, should follow legal requirements.

How long can CCTV footage from workplaces be kept?

The ICO recommends storing footage only for as long as necessary to fulfil its intended purpose.

In many cases, footage should be deleted after 30 days unless it is required for an ongoing investigation or disciplinary process.

Employers should:

• Set a formal retention policy.
• Regularly review stored footage.
• Delete or anonymise recordings when retention periods expire.

Footage kept indefinitely or reused for different purposes may breach data protection principles. Read our guide, "How Long Can You Keep CCTV Footage? Understanding UK Storage Laws", for more information.

Covert surveillance

Hidden or secret cameras in the workplace are only lawful in exceptional circumstances, such as where criminal behaviour is strongly suspected and overt monitoring could undermine an investigation.

Covert surveillance should be:

• Approved by senior management.
• Strictly time-limited.
• Targeted to a specific issue or location.
• Stopped immediately once the investigation ends.

Best practice checklist for workplace CCTV compliance

How Verisure helps UK businesses stay secure and compliant

At Verisure, we help businesses across the UK strike the right balance between protection and privacy.

Our commercial security systems are designed with UK GDPR, Data Protection Act 2018, and industry best practice in mind.

Privacy-first security technology

• Encrypted recording and storage to prevent unauthorised access.
• Strict access controls for CCTV data.
• Professional signage and expert compliance guidance.
• Secure cloud infrastructure to protect footage from loss or misuse.

Integrated workplace protection

Our business security solutions combine CCTV, intruder alarms, motion detectors, and 24/7 professional monitoring.

Verisure systems are ideal for:

• Offices and corporate environments.
• Retail and hospitality premises.
• Warehouses and industrial sites.
• Healthcare, education, and public sector buildings.