Employer Requirements & Responsibilities When Installing & Managing CCTV Systems

CCTV: Employer Requirements & Responsibilities Under the DPA / UK GDPR

1. Lawful Basis & Purpose – Employers must:
   1. Identify a lawful basis for CCTV (usually legitimate interests).
   2. Define a clear purpose for its use (e.g., crime prevention, safety, property protection).
   3. Ensure purposes are necessary and proportionate, not excessive.
   4. Avoid uses that are unfair or intrusive, such as monitoring staff in areas where privacy is expected (toilets, changing rooms, break areas, etc.).
2. Data Protection Impact Assessment (DPIA) – Before installation, employers must:
   1. Conduct a Data Protection Impact Assessment because CCTV involves systematic monitoring of public/employee areas.
   2. Assess:
      1. The necessity and proportionality of CCTV.
      2. Risks to individual privacy.
      3. Measures to mitigate those risks (restricted access, clear retention periods, secure storage).
   3. Keep the DPIA on record and update it as needed.
3. Transparency & Signage – Employers must:
   1. Inform individuals clearly that CCTV is in operation.
   2. Use visible and understandable signage, showing:
      1. That CCTV is in use.
      2. The purpose of monitoring.
      3. The data controller’s contact details.
      4. Where relevant, who operates the system on the employer’s behalf.
   3. Provide fuller privacy information (e.g., in staff notices or a privacy policy).
4. Limitation of Use – Employers must:
   1. Only use CCTV for the stated and lawful purpose.
   2. Avoid using recordings for unrelated purposes, such as:
      1. Monitoring productivity.
      2. Disciplinary purposes not aligned with the original purpose (unless clearly justified and communicated).
5. Data Minimisation – Employers must:
   1. Position cameras to capture only what is necessary.
   2. Avoid capturing:
      1. Neighbouring property.
      2. Public highways (unless unavoidable).
      3. Private spaces where people expect privacy.
   3. Use masking or privacy zones if needed.
6. Security of Footage Employers must:
   1. Store all CCTV footage securely:
      1. Encryption where appropriate.
      2. Password protection.
      3. Restricted access.
   2. Ensure only authorised staff can access or download footage.
   3. Keep an access log for accountability.
7. Retention Periods – Employers must:
   1. Set a unique retention period based on necessity (commonly 30 days, but depends on purpose).
   2. Delete footage automatically when no longer required.
   3. Retain footage longer only if:
      1. Needed for ongoing investigations.
      2. Required by law.
   4. Document retention rules in the organisation’s CCTV policy.
8. Subject Rights
   1. Employers must respect the rights of individuals, including:
      1. Right of access (SAR): individuals may request copies of footage.
      2. Right to erasure: applies only if no lawful basis exists to keep the footage.
      3. Right to object: individuals can challenge unjustified monitoring.
      4. Right to information: individuals must be told how their data is used.
   2. For SARs involving third parties in the footage, employers must:
      1. • Blur or redact others, or
      2. • Withhold footage if redaction is not feasible.
9. Third-Party Processors & Contractors – If using an external company for installation, monitoring, or data storage:
   1. Employers must have a data processing agreement (DPA/GDPR Article 28 contract).
   2. Ensure contractors:
      1. Follow data protection rules.
      2. Provide adequate security measures.
      3. Access footage only when authorised.
10. Regular Review – Employers must:
    1. Review the necessity and proportionality of CCTV regularly.
    2. Check equipment performance and ensure it is functioning as intended.
    3. Update signage, policies, and DPIAs as needed.
11. Policies & Documentation – Employers must maintain:
    1. A CCTV policy (purpose, access, retention, SAR process).
    2. A DPIA.
    3. A Record of Processing Activities (ROPA) if required.
    4. Training records for staff who handle CCTV data.
12. Summary: Core Responsibilities – Employers must ensure that CCTV:
    1. Has a clear purpose and lawful basis.
    2. Is necessary and proportionate.
    3. Is transparent to staff and visitors.
    4. Is secure and access controlled.
    5. Is retained only as long as necessary.
    6. Respects individuals’ data rights.
    7. Is supported by proper policies and documentation.

Our team aims to deliver expert customer care, from site survey to completion through to ongoing maintenance. Developing a lasting relationship with a partner you can trust to protect you and your premises whilst ensuring your businesses and organisations are fully compliant to the latest legal requirements. We are CHAS accredited, BAFE registered and, SSAIB certificated with BS EN ISO 9001:2015 & Construction Line approved, so your organisation can be assured that all our fire, security and safety equipment is designed, supplied, installed and maintained in accordance with the latest British Standards.

#CCTVSystems #FireAlarms #FireRiskAssessment #FireSafetyEquipment #FireAlarmMaintenance #AccessControl #CCTV #SSSystems