If you are looking for a CCTV policy to download, you will undoubtedly have obligations under the UK General Data Protection Regulation (GDPR). The GDPR does not refer to closed circuit television (CCTV) explicitly. However, CCTV footage usually identifies individuals and is therefore classed as personal data. For this reason, it is subject to the rules of the GDPR and Data Protection Act 2018.
CCTV is not the only form of video surveillance system used by public and private sector organisations. Automatic number plate recognition (ANPR), body worn video cameras, drones, facial recognition software and dashcams can all record footage of an individual.
It is therefore important to understand your legal obligations and responsibilities regarding processing personal data.
Register with the ICO
If your business uses CCTV in or around the workplace, you are required to register your details with the Information Commissioner’s Office (ICO). You will also need to pay an annual data protection fee relevant to the size and scope of your business. You can visit the ICO website to see if you need to pay the data protection fee and how much this is.
Signposting CCTV Usage
If you are using CCTV, you have a legal obligation to notify people that they are or may be recorded. It is mandatory to ‘signpost’ such notifications in and around your premises. Such signs must be clearly visible and easy to read and understand.
It is considered best practice to display signs in areas that can be seen before an individual is recorded. For example, on vehicular entry to the car park or at the main door when entering a building.
Additionally, you should ensure it is clear who is responsible for the operation or use of the CCTV. If this is not obvious (i.e. an external security company operating CCTV inside a hospital), the relevant contact details should be displayed on the sign(s).
Privacy Notice for CCTV
You will need to either draft or buy a Privacy Notice Template if you use CCTV in or for your business. You will also need to have separate privacy notices for individuals and employees. Moreover, both of these need to detail the use of CCTV (if applicable).
To ensure compliance with the UK GDPR, the privacy notice should include specific information. Firstly, it must state the reasons for using CCTV. Secondly, the legal basis relied on for processing must be documented. Thirdly, information must be provided explaining how to request access to the personal data.
CCTV Policy Template to Buy
You don’t have to spend time and resources drafting a compliant CCTV policy. Our professional, customisable template is suitable for all business types. Furthermore, it provides simple to edit sections to add your own content and reasons for usage.
Our CCTV policy also comes with an exclusive self-assessment CCTV audit checklist. The gap analysis tool contains 78 questions for assessing your compliance with the GDPR for CCTV usage. Join 11,000+ businesses who already use our policy templates and benefit from high quality, market leading GDPR policies and controls.


