15 July 2026

CCTV Compliance for Small Businesses Made Clear

A camera above the till may deter opportunist theft. A camera covering a shared entrance can help establish what happened after an incident. But if either camera records staff, customers, neighbours or the public, it also creates responsibilities. CCTV compliance for small businesses is not about filling a site with warning stickers or buying the most expensive recorder. It is about using the right level of surveillance, for a clear reason, and keeping the footage under proper control.

For a shop, office, nursery, managed block or small warehouse, the most sensible starting point is the risk you need to manage. That might be unauthorised entry, theft from stock, vehicle damage, safeguarding, or repeated antisocial behaviour at a communal door. Once that purpose is defined, the system can be designed around it – with useful coverage, clear accountability and no unnecessary intrusion.

What CCTV compliance for small businesses means

In the UK, CCTV images of identifiable people are personal data. A business using cameras will normally be a data controller under UK data protection law. The practical duties come from the UK GDPR and the Data Protection Act 2018, alongside the Information Commissioner’s Office guidance for video surveillance.

This does not mean a small business cannot use CCTV. It means you should be able to explain why each camera is there, why its view is proportionate, who can see the recordings and how long they are kept. A well-planned system is often easier to manage and more defensible than a wide-angle installation that records far more than the premises require.

In many cases, preventing crime and protecting people, premises or property will provide a legitimate reason for CCTV. The exact lawful basis depends on the circumstances. A nursery or care-related environment, for example, may need particular care because children and vulnerable people may be recorded. Where monitoring is likely to create a high risk to people’s rights and freedoms, a Data Protection Impact Assessment may be required before installation.

If you are unsure whether your business needs to pay the ICO data protection fee, check your position before the system goes live. The exemption rules are limited, and recording for crime prevention can still require registration.

Start with a purpose, not a camera list

A professional site survey should begin by identifying vulnerable points: entrances, rear doors, delivery areas, vehicle gates, stock rooms, reception desks or poorly lit approaches. It should also identify areas that should not be watched, including toilets, changing rooms and staff break areas. Cameras in these private spaces will rarely be justifiable.

Placement matters as much as image quality. A camera pointed at a doorway should capture usable facial detail at the point people enter, not simply a broad view of the room. Perimeter coverage may need smart illumination or intrusion-triggered colour night coverage so an event can be understood after dark. This can improve the quality of evidence without adding cameras that serve no clear purpose.

Avoid casually capturing neighbouring gardens, private windows or a large section of public pavement. Sometimes a small amount of incidental capture cannot be avoided, particularly at a shared entrance or car park. In that case, use camera angles, privacy masking and carefully selected lenses to reduce the view as far as reasonably possible.

Audio recording deserves separate consideration. It is much more intrusive than video and is rarely necessary for ordinary commercial security. Unless there is a specific, documented reason for it, do not enable it by default.

Employee monitoring needs a fair approach

CCTV can protect staff as well as the business. It may help investigate aggression at a counter, unauthorised access, vandalism or a health and safety incident. It should not become a hidden method of measuring every minute of a person’s working day.

Tell employees where cameras operate, why they are used and what may happen to recordings. Put this in a clear CCTV policy and, where appropriate, staff privacy information. If cameras are introduced in a workplace with representatives or a recognised union, consultation may be appropriate. Covert monitoring is exceptional and should only be considered where there is a serious, time-limited concern and no less intrusive way to investigate it.

Make the system visible and understandable

People should know that CCTV is operating before they enter the monitored area. Place clear signs at entrances and in relevant areas. The sign should state that CCTV is in use, identify the organisation responsible and explain how people can obtain further information. A sign that merely says “CCTV in operation” is not always enough on its own.

Your fuller privacy notice can set out the purpose of the cameras, the lawful basis relied upon, how long recordings are retained, who they may be shared with and how someone can make a data protection request. Keep the wording plain. A visitor should not need legal training to understand what is being recorded and why.

For multi-occupancy buildings, responsibility needs to be agreed before installation. A managing agent, freeholder, residents’ management company and commercial tenant may all have an interest in the system, but there should be no uncertainty over who controls the footage, responds to requests and pays the data protection fee.

Secure footage as carefully as the premises

A camera system is only useful if footage can be found, viewed and exported when it is needed. It is also a store of personal data. Give access only to named, trained people and use individual user accounts where the system supports them. Strong passwords, changed from default credentials, are essential. Remote viewing should be configured securely, not left open for convenience.

Footage should be retained for no longer than necessary. There is no universal number of days that suits every site. A busy retail site may need a short rolling retention period because incidents are usually identified quickly. A site with irregular access or delayed reporting may have a reasonable case for keeping footage longer. Set a period, document the reason and ensure recordings overwrite automatically unless an incident requires preservation.

If an event occurs, save the relevant clip promptly and record why it has been retained. Limit copies. If footage is shared with the police, insurers or legal advisers, keep a record of what was disclosed, to whom and on what date.

Be ready for requests

A person can ask for CCTV footage of themselves through a subject access request. You need a process for receiving, identifying and responding to these requests within the required timescale. Before releasing a clip, consider whether it also shows other identifiable people. It may be necessary to blur third parties or provide a still image rather than unrestricted footage.

There will also be occasions when someone asks for footage after an accident, allegation or dispute. Do not promise a copy immediately at reception. Preserve the recording, confirm the request in writing and allow the person responsible for data protection to assess it properly.

Keep a simple compliance record

Small businesses do not need paperwork for its own sake. They do need evidence that their decisions were considered. A short record should cover the purpose of each camera, areas covered, whether public space or neighbouring property may be captured, retention periods, access permissions, signage locations and the process for requests or disclosures.

Review that record when the premises change. A camera that was appropriate for a rear delivery door may no longer be justified after an extension, new tenancy or change in working arrangements. Test footage regularly too. There is little reassurance in discovering after a break-in that a camera was obscured, the recorder was full or the night image did not identify anyone.

Get the installation right from day one

Compliance works best when it is built into the design, not added after the cameras are on the wall. NRI Security can assess the practical risks at a free site survey, specify coverage that supports your legitimate security aim and explain how the system will be used day to day. The right answer may be a focused CCTV installation, improved entrance control, better lighting, or a combination of all three.

Choose equipment and placement that give you usable evidence, then give the recordings the same care you would give keys, access fobs or alarm codes. That is how CCTV becomes a dependable part of your protection, rather than another responsibility left unmanaged.