Shop CCTV and the law: what UK businesses must do

Shop CCTV is not covered by the home exemption. As a business, UK GDPR and the Data Protection Act 2018 apply to you in full. In practice that means: pay the ICO data protection fee unless you are exempt, put up proper signs, have a clear reason for each camera, tell staff, keep footage secure and delete it when you no longer need it.

None of this is complicated, but most small shop owners have never been told. This guide covers the essentials.

This is general guidance, not legal advice. The ICO’s own CCTV checklist for small organisations is the best place to check your setup.

1. The ICO data protection fee

Businesses that use CCTV to prevent crime usually have to pay the ICO an annual data protection fee, unless they are exempt. The fee depends on your size and turnover. For most small businesses it is a modest annual amount, but not paying when you should can lead to a fine.

Check whether you need to pay, and how much, using the ICO’s online fee checker on the ICO data protection fee page.

2. Signs

Your signs must:

• be clearly visible before people enter the area being recorded
• say that CCTV is in operation
• say who operates it (your business name)
• give a way to contact you

A sign at the entrance and one at any rear or staff entrance covers most shops.

3. A clear reason for every camera

You need a legitimate reason for recording, such as preventing theft, protecting staff or investigating incidents. Write it down. It only needs to be a short note for each camera saying what it covers and why.

Then record no more than you need:

• point cameras at your premises, not the street or neighbouring businesses
• use privacy masking for areas you do not need
• do not record audio

4. Filming staff

This is the area that catches most businesses out.

• Tell staff about the cameras, where they are and why. Put it in writing.
• Cameras over the till or shop floor for crime prevention are generally fine. Using CCTV to monitor staff performance is much harder to justify.
• Covert (hidden) cameras are only justified in exceptional cases, such as a specific suspected crime, and for a limited time.
• Never put cameras in toilets, changing rooms or similar private areas.

If you are monitoring staff in any detail, the ICO expects you to assess the impact first. The checklist linked above walks you through it.

5. How long to keep footage

There is no fixed legal period. Keep footage only as long as you need it for the reason you recorded it. Most small businesses set their recorder to overwrite automatically after a few weeks, and keep specific clips longer only when there is an incident.

6. Keeping footage secure

• Keep the recorder somewhere locked and out of sight.
• Use strong passwords and two-step login on the app.
• Limit who can view and download footage.
• Do not share clips on social media to name and shame people. It can land you in trouble even if they did steal.

7. Requests for footage

People caught on your cameras can ask for a copy of footage of themselves. You must normally respond within one month. You may need to blur other people in the clip before handing it over.

The police can request footage to investigate a crime. You can give it to them. Keep a short record of what you shared, when and with whom.

Quick compliance checklist

For choosing and placing cameras, read our CCTV for small shops buyer’s guide and where to put CCTV in a shop. For home cameras, see is my CCTV legal if it sees next door?

Want a system set up correctly from day one? We install shop and small business CCTV across Worcestershire and the West Midlands. Get a quote.