CCTV in the workplace UK: what you have to do before you switch it on

The higher maximum fine under the Data Protection Act 2018 is £17.5 million, or 4% of worldwide turnover. It opens every article about cameras at work. It is a ceiling, not a forecast for a business with four vans.

Here is what the regulator did in a year. The Information Commissioner’s Office received 42,315 data protection complaints in 2024/25, concluded 43 UK GDPR investigations, delivered nine reprimands and issued two UK GDPR penalty notices. These are separate annual totals, not stages of the same cases. They show that UK GDPR fines were uncommon.

Go looking for a monetary penalty against a private business over cameras pointed at staff and you will not find one in the ICO’s public enforcement register, checked 11 September 2026. The register would not list in full, so that is a search finding and not proof. It is also not a quiet life. An order to stop is a real outcome, as Serco Leisure found in February 2024 over scanning staff faces for attendance. Your workers can complain and seek compensation. And one will ask why the entrance camera watches his bench.

CCTV in the workplace UK rules start with data protection, not security

The rules for CCTV in the workplace UK businesses follow do not live in a CCTV Act, because there is not one, and there is no licence to apply for. The UK GDPR sets the lawful basis, the duty to tell people and the limit on how long you keep anything. The Data Protection Act 2018 carries the enforcement and the fee. It catches more than people expect: watching identifiable people live on a screen is processing even when nothing is saved, which covers the app showing you the yard and the camera on a pair of smart glasses at work.

The ground is moving, too. On 11 September 2026 every page of the ICO’s video surveillance guidance carried an under review banner, put there by the Data (Use and Access) Act 2025, and Article 6 gained a seventh lawful basis in February 2026. The ICO’s general guide lists seven. Its worker monitoring guidance still says six. When the regulator’s own pages disagree, you can stop feeling slow for finding this confusing.

£52 a year, and the fine that actually lands

Switch on a camera that records identifiable people and you almost certainly owe the ICO a fee, even if payroll and accounts kept you exempt until now. Security is not on the list of exempt purposes, and the exemption only holds while everything you do is on it.

Tier 1 is £52 a year, for no more than 10 staff or turnover up to £632,000, either one on its own. Tier 2 is £78, up to 250 staff or £36 million. Tier 3 is £3,763 and catches anyone who meets neither; the ICO treats your business, the controller responsible for the footage, as tier 3 until told otherwise. Set against the number at the top of this article, £52 is your entire registered relationship with the regulator.

Not paying costs £400 at tier 1 and £600 at tier 2. Even that is rare: the ICO’s lists name one company in all of 2025 and six so far in 2026, and leave out sole traders and partnerships.

Before you switch it on, write down why

The legitimate interests test is compulsory; writing down its outcome is recommended, not specifically required by law. What happens is that six months from now you cannot explain why the camera points where it points.

Legitimate interests is the basis you will end up on, and it carries a three part test: purpose, necessity, and the balance against your workers’ rights. The middle one is where these fall over, because necessary does not mean useful. It means you could not have got the same result a less intrusive way. Doing the test is a must; writing down what you concluded is a should, tied to your duty to demonstrate it later. Consent will not rescue you, nor will the contract.

A data protection impact assessment (DPIA) is a separate check of privacy risks and how to reduce them. The ICO requires one for video monitoring of staff; failing to complete a required DPIA is itself an infringement. Seek and document your workers’ views unless you have a good reason not to, and then record that reason.

Where the camera does not go, and where the sign does

The sign is the cheapest part of this job and the one people get backwards. It goes before the point where somebody walks into shot, not on the wall they reach after, and it carries your business’s name, why you are recording and who to contact. A page on your website does not do it.

Behind it sits a separate CCTV policy, with a shorter version in your privacy notice: why the cameras are there, where they point and where they do not, your lawful basis, who may look, how long you keep footage and who to complain to. It will not launder the system, mind. “Excessive monitoring set out in a policy does not make it lawful, just because it is documented,” says the ICO’s monitoring guidance.

CCTV in the yard is one thing. Toilets and changing rooms are out, and so, in ordinary circumstances, is a camera nobody is told about. The ICO’s worked example is a business losing things from the staff changing room that puts the camera on the door outside, with signs, running only for the investigation. Mess rooms and canteens are the honest gap: the guidance does not mention them.

The microphone stays off and footage needs a deletion date

The letter that lands on your desk is not from the regulator. It is from an employee who wants a copy of the footage, and you normally have a month, free of charge. A written summary will not do, and you may have to blur other people out first, which the ICO says you should have checked before buying the system.

The microphone is on because it came on. That is the entire reason on most workshop kit, and it is not an argument. Audio goes off by default, and switching it back on needs an evidenced problem less intrusive methods cannot solve, a separate warning that sound is captured, and exceptional use rather than open all shift.

Retention is the other setting nobody touches. There is no minimum or maximum in law, which sounds like freedom and is really a decision you make and write down: the shortest period that serves your purpose, with somebody checking the deletion happens. Hard drive capacity is not a reason to keep it. A police request is.

Nobody in your trade is going to tell you how to do this

Nothing you are accredited for covers it. NICEIC’s scheme rules hand data protection compliance back to you. Gas Safe’s registration policy mentions photographs only for the engineer’s licence card. The Considerate Constructors Scheme’s 2022 code does not contain the word camera, and filming appears nowhere in the HSE’s list of what site rules should cover. It is the gap that runs through the rest of the tools and technology for trades businesses that arrive with a duty attached and nothing about it on the box. The same silence runs through the AI products sold to your trade: not one of the supplier pages checked says who carries the responsibility when the answer is wrong.

Your staff have not decided it is nothing: in ICO commissioned research in 2023, 70% of people said monitoring at work would feel intrusive. And the harder question is coming. A camera that moves with a person is held to a stricter standard than one on a wall, yet the ICO’s index of surveillance technologies covers body worn video, dashcams, drones and doorbells and has no entry for glasses. That silence is not clearance. The body worn rules apply by analogy, alongside whatever a site will sign off for smart glasses for construction workers.

The ICO’s helpline is 0303 123 1113 and its Data Protection Essentials training is free. The question worth taking to either is the awkward one: whether moving the entrance camera ten degrees protects the door just as well without watching the apprentice’s bench.