Installing a camera is easy. Operating it lawfully takes a little thought. The installer puts the equipment in; the person or business that uses it is the one responsible under data protection law. Here is the ICO guidance in plain words, for homes first and then for workplaces. The ICO page for domestic CCTV is linked at the end.
Cameras at home
If your cameras only capture images within the boundary of your own property, including your garden, data protection law does not apply. You are free to record.
The moment a camera captures beyond your boundary, the pavement, the road, a shared path or a neighbour's garden, UK GDPR and the Data Protection Act 2018 apply and you become a data controller. That is not a ban. It means you have responsibilities. You need a legitimate reason for capturing that area, usually the security of your home. You should capture as little of other people's space as the equipment allows, by angling cameras or using privacy masking. You should put up a sign so people know recording is taking place. You should keep footage only as long as you need it and delete it routinely. You must not share it widely, for example posting clips online, unless there is a good reason. And if someone asks for footage of themselves, they are entitled to it, normally within a month, with other people's images obscured.
Doorbell cameras count. They often record audio as well as video, and audio is harder to justify, so switch it off if you do not need it. Talk to neighbours before you install. Most disputes about cameras start with a surprise, not with the camera itself.
Cameras at work
For a business, charity or landlord, data protection law applies in full. The main points are these.
- Register with the ICO and pay the data protection fee unless you are exempt. Most organisations using CCTV are not exempt.
- Have a clear purpose for each camera and write it down. Security of people and property is the usual one. Cameras in places where people expect privacy, such as toilets and changing rooms, are almost never justified.
- Put up signs that say CCTV is in operation, who operates it and how to contact them.
- Carry out a data protection impact assessment where the monitoring is likely to be high risk, which includes most workplace monitoring of staff and any system covering public areas at scale.
- Set a retention period and stick to it. Many operators keep around thirty days; the right figure is as long as you need to deal with incidents and no longer.
- Control who can view footage, keep a log of access and exports, and secure the recorder and any remote viewing app with proper passwords.
- Respond to subject access requests within one month, redacting other people.
- Tell staff in writing that cameras are used, where and why. Covert monitoring is only justified in rare, serious cases and should be decided at senior level with a record kept.
Sharing footage
The police can ask for footage and you can give it to them for the prevention or detection of crime. Insurers can be given footage relevant to a claim. Handing footage to a neighbour, a customer or a journalist, or posting it online, is a disclosure you have to be able to justify. When in doubt, give it to the police instead.
What the installer should do
A good installer will position cameras to cover what you need and as little else as possible, show you the views before fixing anything, set the retention on the recorder, secure the remote access and leave you with documentation. They should also tell you plainly that the legal responsibility sits with you as the operator, because it does.
Read the ICO guidance for domestic CCTV at ico.org.uk/for-the-public/domestic-cctv-systems/. The ICO also publishes guidance for organisations using video surveillance.