Recording in a customer's home: who answers for each camera

A phone camera in the technician’s hand is framing a boiler’s data plate. Over the technician’s shoulder, the customer’s indoor camera is recording the technician doing it.

Who answers for recording in a customer’s home depends on whose camera it is. Your business answers for what your technician records there, sole trader included: under the ICO’s key terms page for small organisations, read on 6 October 2026, anyone using personal data beyond personal or household purposes is the controller, the one responsible. The customer generally answers for their own camera, though the ICO text behind that is not public guidance but an internal knowledge-base entry, released in 2024 under a freedom of information request. It calls a quick plumber’s visit more likely household activity, and puts monitoring people who provide routine or ongoing services within UK GDPR.

The quote photo on your technician’s phone

Your technician takes a phone photo to price the work or record the property’s condition, and the business answers for it as it would for CCTV in the workplace.

In the ICO’s guidance on information that “relates to” someone, information about a house is often linked to an owner or resident, and then it is personal data about that person. A photograph of a data plate on its own is about the boiler; filed under the customer’s name and address, it can identify them.

TrustMark’s Code of Conduct V1.2, dated June 2026, calls taking photos a good way to note the existing condition of the property, and lists photographs and any record of the work among a customer’s personal information.

The ICO’s minimisation rule keeps the frame on the work, leaving out faces, letters, family photographs and the address. Privacy information is due when data is obtained, observation included, so the technician says what the photo is for as it is taken, and the business’s privacy notice says the same in writing; the ICO’s small-business pages generate one. Wherever the photo sits, on the technician’s own phone or in the job file, the business keeps it secure and deletes it once the job no longer needs it.

For the Boiler Upgrade Scheme in England and Wales, Ofgem’s installer guidance V5, published on 28 April 2026, says evidence of the existing heating without a valid EPC would typically include photographs of it, where available. Those photographs must show the heat source, its make and model, such as the boiler’s nameplate, and its location. Ofgem may ask for before-and-after photos in an audit, and the installer keeps the information relied on for six years from the application date, which is how long those photos are needed.

A head camera belongs to the business

A head-mounted camera, smart glasses on a plumber included, is the business’s camera just as the phone is; what it costs and delivers is covered in smart glasses at work. Inside someone’s home, the question “are smart glasses allowed at work” has its own rules. The business settles whether and when the camera runs before the technician reaches the door, as it would for any of its tools and technology, and the customer hears that it is a camera before it records.

When the office joins your video call

The office asks for a view of the fault, or manufacturer support wants to see the appliance. The call and its recording are separate decisions.

The ICO’s Data sharing advice addresses meetings a business hosts; applying it to a call from a kitchen is our reading. Recording needs a valid purpose beyond what a less intrusive method, such as notes, achieves, and the lawful basis for it, the ICO’s term for a valid reason, has to be recorded and justified.

The guarantee terms read from Worcester Bosch, Vaillant, Viessmann, Daikin and Tesla, and MCS’s heat pump installation standard, ask for no photograph, so none of them is a reason to record the call. Vaillant’s boiler terms ask for the Benchmark logbook, completed at installation and kept on site.

When a call is recorded, the customer is told, before it starts, the reason and how long the recording will be kept, and the camera stays on the appliance.

Before-and-after photos on the website

Once a quote photograph goes on your website, it has a new purpose, and the ICO’s purpose-limitation principle keeps personal data to the reasons it was collected. In an example from its small-business marketing guidance, a business wants to use photographs of customers or staff in marketing. The original lawful basis cannot cover that extra use; the business chooses consent.

Three of the trade texts read on 6 October 2026 address permission or privacy for photographs in customers’ homes. TrustMark classes the photographs as personal information. Which? Trusted Traders’ advice puts the customer’s permission before marketing use, and Checkatrade’s member standard shares images of a customer’s home only with permission. The FMB’s 2022 code asks only that website pictures show the member’s own work. The published texts of NICEIC and NAPIT, RECC’s code and the FMB’s 2023 rules say nothing on the subject; Gas Safe Register’s site could not be read.

So permission comes before publication. Asked as consent, it has to meet the ICO’s test: freely given, specific and informed, a positive opt-in kept apart from the quote’s terms, and easy to withdraw. A separate photograph framed on the work keeps the quote image with its original purpose.

Camera	Whose it is	Who answers for the recording	What the technician does
Technician’s phone, quote photo	Business	Business, including sole trader	Frames the work; says what it is for
Head-mounted camera or glasses	Business	Business	Follows the business’s policy; tells the customer
Office or manufacturer video call	Business	Business, if recording	Explains before recording
Website before-and-after photo	Business	Business	Asks the customer first
Customer’s doorbell or indoor camera	Customer	Customer; one-off visit more likely household use, per ICO internal entry	Works as if recorded; can ask for a copy
Customer’s phone	Customer	Customer, while use stays personal	Continues the job

When the customer’s camera is recording in their home

The homeowner’s own camera is what the knowledge-base entry disclosed on 8 February 2024 (ICO reference IC-281826-G6M4) is about.

It calls recording a quick plumber’s visit “more likely” household activity, while a camera used to monitor someone providing a commercial service routinely or on an ongoing basis brings the homeowner within UK GDPR, even inside their home. It sets no number of visits, so a job lasting several days sits between its examples without a settled answer. A camera trained on work continuing for weeks may fit the internal entry’s routine or ongoing description.

The ICO’s public Home CCTV systems page gives a boundary rule: a doorbell capturing the street brings data protection law into play. Consent is rarely required for home CCTV, it says.

So on any visit, annual or weekly, the working assumption is that an indoor camera may be recording. Where data protection law applies, your technician can ask the camera’s owner for a copy of footage showing them, and the owner should usually respond within one calendar month under the ICO’s public guidance; the ICO says it generally cannot or will not retrieve footage for you.

From a phone gallery to a public post

In the customer’s phone gallery, a clip may stay purely personal: the ICO’s exemptions guide, last updated 8 March 2024, puts pictures taken “for your own enjoyment” outside UK GDPR. Once uploaded to a public platform, under the internal entry, the clip leaves purely personal or household use, and data protection law applies to it.

The job carries on as it would with the customer in the room. The camera belongs to the customer, and so does the choice of recording in their own home; the ICO says it generally cannot or will not force a CCTV owner to remove or reposition a camera.

What stays in your hands is the business’s own cameras: what they frame, how long the recordings are kept and whether any of it reaches your website.