CCTV Policy Template for UK Businesses
CCTV footage is personal data under UK GDPR. If your business operates cameras — in your premises, car park, or as a doorbell camera — you need a written CCTV policy that meets ICO requirements.
Instant PDF & Word download · 14-day money-back guarantee
What is a CCTV policy?
A CCTV policy sets out the rules for how your business operates its surveillance camera system. Because CCTV footage can identify individuals, it is personal data under UK GDPR — which means the same rules that apply to customer records apply to surveillance footage.
The ICO's surveillance camera code of practice sets out expectations for businesses: clear signage, limited access, defined retention periods, and a process for handling requests from individuals who want to see footage of themselves. A written policy is how you demonstrate you are meeting those expectations.
What your CCTV policy should cover
- The purpose of your CCTV system (security, health and safety, evidence gathering)
- The lawful basis for processing footage under UK GDPR
- Where cameras are located and what areas they cover
- Who has access to live and recorded footage
- How long footage is retained before being overwritten or deleted
- Signage requirements to notify individuals they are being recorded
- How to handle subject access requests for footage
- Data breach procedures for footage loss or unauthorised access