How should commercial CCTV systems protect personal data?

Commercial CCTV protects personal data when the system is designed around data protection principles from the outset, rather than treating compliance as a matter of adding signs after installation. The organisation operating the cameras should be able to explain why surveillance is necessary, what areas are monitored, who can view footage, how long recordings are kept and how individuals can exercise their rights.

For most businesses, the organisation using the CCTV is the data controller because it determines the purpose and operation of the surveillance. An installer or monitoring provider may be a separate data processor, depending on the services it provides. Responsibilities should be recorded clearly, particularly where footage is hosted remotely, monitored by another organisation or shared with a landlord, security company, insurer or law-enforcement body.

A documented assessment should be completed before cameras are specified. This should consider:

• the security problem the cameras are intended to address;
• whether CCTV is necessary and proportionate compared with less intrusive measures;
• which locations and fields of view are justified;
• whether the system captures employees, visitors, neighbours, passers-by or areas outside the site; and
• the potential impact on people whose images are recorded.

A data protection impact assessment may be appropriate where surveillance is extensive, systematic or likely to create a high risk to individuals. It is especially important to assess systems using analytics, facial recognition, automatic number plate recognition or other features that make decisions about people. Such functions should not be enabled simply because the equipment supports them; their purpose, necessity and legal basis require separate consideration.

Camera positioning is one of the most effective privacy controls. Cameras should be aimed at entrances, restricted areas, loading points, cash-handling locations or other places connected with the stated security purpose. Privacy masking can block windows, neighbouring property and other irrelevant areas. Pan, tilt and zoom functions should be restricted where they could allow operators to inspect spaces that do not need to be monitored.

Audio recording normally creates a greater privacy intrusion than video alone. It should not be enabled as a default feature unless there is a specific, documented justification and the organisation has considered the effect on staff and visitors. Covert surveillance also requires a particularly strong justification and should not be used as a routine alternative to visible CCTV.

Privacy information should be available at the point where people enter a monitored area. Signage should identify that CCTV is in use, state the purpose in understandable terms and provide a way to obtain fuller information, such as the identity of the operator and relevant contact details. Employees should receive separate information where cameras form part of workplace monitoring, performance management or investigations. Policies should explain the system's purpose and make clear that footage will not be repurposed without proper consideration.

Access controls should reflect each user's role. For example, an installer may need technical access during configuration, while a manager may need to review incidents and an administrator may manage user accounts without viewing routine footage. Individual accounts, strong authentication, audit logs and prompt removal of leavers' permissions help establish who has accessed or exported recordings. Shared passwords and unrestricted administrator access make it difficult to investigate misuse and should be avoided.

Recorded footage should be protected throughout its lifecycle. Suitable measures can include secure network configuration, firmware and software updates, encrypted connections, protected recording equipment, encrypted storage where appropriate and secure handling of exported files. Remote access should be limited to authorised users and reviewed periodically. Any exported footage should have a documented purpose, a controlled recipient and a secure transfer method rather than being sent through an unprotected personal account.

Retention should be based on the time reasonably needed to identify and investigate incidents, not on the maximum capacity of the recorder. The policy should distinguish routine deletion from footage preserved for a specific incident, complaint, insurance matter or legal process. A retention schedule and automatic deletion settings can reduce the risk of keeping personal data longer than necessary, but preserved footage should still be reviewed and deleted when the reason for retaining it ends.

Organisations should have a procedure for handling requests from people who want to know whether they have been recorded or seek access to their personal data. The procedure should cover identity checks, locating footage, identifying third-party images, applying any relevant exemptions and responding within the applicable legal timescales. If footage is disclosed, other individuals may need to be obscured unless disclosure is justified. Staff should also know how to deal with complaints, correction requests and requests to restrict processing.

Footage sharing needs its own controls. A request from the police, an insurer, a solicitor or another organisation should be recorded and assessed before disclosure. The recipient, reason for sharing, material supplied and date should be documented. Sharing footage on social media or displaying it to people who have no security-related need is unlikely to be compatible with a properly defined CCTV purpose.

Testing should cover more than whether a picture appears on a monitor. A responsible review should check camera views, privacy masks, date and time accuracy, recording continuity, user permissions, audit trails, remote connections, storage capacity, deletion rules and the ability to export relevant evidence without altering its integrity. Changes to the premises, lighting, access arrangements or security risks should trigger a review of the system and its privacy documentation.

For a commercial installation, these requirements should be reflected in the specification, commissioning records and operating procedures. RJW Electrical can support the technical installation of commercial CCTV systems, while the organisation operating the system remains responsible for determining its purposes, policies and legal compliance. UK GDPR, the Data Protection Act 2018 and current guidance from the Information Commissioner's Office should be considered when preparing the final documentation.