CCTV policy, signage and retention
Running CCTV that captures customers or staff makes you a data controller under UK GDPR.
Running CCTV that captures customers or staff makes you a data controller under UK GDPR. You need visible signage telling people they are being recorded, a written policy covering why you record, who can view footage, how long you keep it, and how someone can request their own footage.
Many premises licences (and licensing boards) make working CCTV a condition of the licence, so a broken camera or missing footage can be a licence compliance issue on top of a data protection one. The ICO can also act directly on unlawful or excessive retention.
Use this to write your policy and check your signage and retention period are compliant.
Who this is for
Any venue running CCTV covering public areas, tills, or entrances — which in practice is most licensed premises.
Applies as soon as cameras capture identifiable individuals, regardless of venue size or staff numbers.
What you’ll hold
- Written CCTV policy
- Photo of signage in place
- Retention schedule (typically 30 days unless an incident is flagged)
Watch out for
- Recording audio as well as video without realising it needs extra justification. Continuous audio recording is considered particularly intrusive and is harder to justify than video alone.
- Keeping footage indefinitely "just in case." Retention has to be proportionate — most venues settle on around 30 days unless footage is flagged for an incident.
- Forgetting subject access requests. Someone can ask to see footage of themselves, and you need a process to find, review and hand over (or redact) it within a month.
Sources
- ICO — Guidance on video surveillance including CCTV checked 2026-09-02
See also
This is item 11 of 66 in the free UK Launch Checklist. See the whole list →