A practical guide to UK data protection and CCTV: when the rules apply, business responsibilities, the household exemption and privacy settings for smart doorbells.

CCTV captures images of identifiable people, and that makes the footage personal data. As soon as personal data is being processed, UK GDPR and the Data Protection Act 2018 apply — unless one of a narrow set of exemptions covers the situation.

For businesses, the rules are clear and consistent. For homeowners, the situation is more nuanced: a household exemption can apply, but it’s easier to lose than most people realise. This guide covers both contexts and where the line sits.

Does GDPR apply to CCTV?

Decision tree — does UK GDPR apply to my CCTV

In almost every business setting, yes. If a camera captures recognisable people — staff, customers, contractors, members of the public — the operator is a data controller processing personal data, and UK GDPR applies. The same is true for any technology that captures images or audio: traditional fixed CCTV, automatic number plate recognition (ANPR) systems, body-worn cameras, dash cams in fleet vehicles, drones, and smart doorbells.

There is one important carve-out, sometimes called the “household exemption” under Article 2(2)(c) of the UK GDPR. The regulation does not apply to processing carried out “by a natural person in the course of a purely personal or household activity”. For domestic CCTV that records only the homeowner’s own property — driveway, garden, the front of the house — the exemption usually applies and GDPR does not.

The household exemption is conditional, not absolute. The moment a domestic camera captures shared space, neighbours’ property, the pavement, or a public road, the exemption falls away. From that point, the homeowner is treated as a data controller for everything the camera records.

CCTV requirements for businesses

Any organisation operating CCTV needs to identify a lawful basis for processing under Article 6 of the UK GDPR. For most security applications, that basis is legitimate interests — preventing crime, protecting staff and property, deterring antisocial behaviour. The lawful basis must be supported by a documented assessment that the processing is necessary and proportionate to the purpose.

Several specific obligations follow:

Signage

People need to be told they are being recorded. Visible signs at the entrance to a monitored area should identify the operator, the purpose, and a contact point for queries. The signs are part of meeting the right to be informed under Articles 13 and 14.

Data Protection Impact Assessment

A DPIA is required where the proposed processing is likely to result in a high risk to people's rights and freedoms. Systematic monitoring of publicly accessible areas on a large scale is expressly included. Assess the actual scope and intrusiveness rather than assuming every small retail CCTV installation meets that specific large-scale test.

Retention

Set the shortest retention period justified by the purpose and document it. UK GDPR does not prescribe a standard 7-, 14- or 31-day CCTV period. Particular footage may need longer retention for an identified incident or investigation.

Access control

Only authorised people should be able to view recorded footage. Live monitoring should be limited to those who need it. The ICO expects access to be logged.

Security

Footage must be stored securely — password-protected recording systems, encrypted storage where appropriate, physical security for any recorders on premises.

Special category data

Biometric processing for unique identification is special category processing and requires both an Article 6 basis and an Article 9 condition. A relevant Schedule 1 condition and additional safeguards are needed for some, but not all, Article 9 routes. Assess the need for a DPIA before deployment.

The data protection fee

Operating CCTV usually triggers the obligation to pay the ICO’s data protection fee, which depends on the size of the organisation.

CCTV that crosses property boundaries — for example, a shop’s camera that captures the public street outside — requires extra care. The lawful basis assessment should consider whether the wider field of view is genuinely necessary, or whether the camera could be repositioned or have a privacy mask applied to limit intrusion.

Relevant authorities, including specified police bodies and local authorities in England and Wales, must have regard to the Surveillance Camera Code of Practice under the Protection of Freedoms Act 2012. Other operators can use its twelve principles as guidance. It does not replace their UK GDPR obligations.

Domestic CCTV and the household exemption

For homeowners, the household exemption is the deciding factor. If your cameras record only your own property, GDPR does not apply, and you are not a data controller. You don’t need to register with the ICO, you don’t need a lawful basis, you don’t need a privacy notice. Personal-use CCTV stays personal.

The exemption falls away if cameras capture beyond the property line. This includes:

  • A neighbour’s garden, drive, or windows.
  • A shared space — a communal car park, a shared driveway, a building entrance.
  • A public space — the pavement, the road, a passageway.

Where the household exemption does not apply, the owner must comply with the data protection duties relevant to the processing. Recording beyond a boundary is not automatically unlawful, and it does not make every duty designed for large organisations applicable to a homeowner.

Some domestic cameras capture shared or public space. Review the actual field of view and audio range rather than assuming the equipment's location settles the question. The ICO recommends steps including:

  • Position cameras to minimise capture of areas outside your property.
  • Use privacy masks or zones where the camera software supports them.
  • Be transparent with neighbours about the system you have installed.
  • Delete recordings as soon as you no longer need them.
  • Respond appropriately to access requests from people recorded, considering identification, third-party information and any applicable exemptions.

Smart doorbells and neighbour concerns

Domestic CCTV household exemption diagram from Fairhurst v Woodard

Smart doorbells can capture images and conversations beyond the entrance they are intended to protect. Review the actual recording area and audio settings, rather than assuming that a small domestic device is outside data protection law.

The ICO’s home CCTV guidance recommends limiting recording to the property where possible and using filters or privacy blockers to reduce unnecessary intrusion. Recording shared or public areas is not automatically prohibited, but it needs justification and appropriate safeguards.

People recorded can request their information and exercise relevant objection or erasure rights. These rights have conditions; an objection does not automatically require every camera to be removed. Explain decisions and respond within the applicable timeframe.

Before installing or changing a smart doorbell, check the following practical points:

  • Check what the camera actually records — both video and audio range.
  • Adjust the field of view to focus on the owner’s property where possible.
  • Disable audio recording unless there is a clear reason to keep it on.
  • Be honest with neighbours about the camera’s capabilities.

If a neighbour raises a concern, discuss what the system records and consider reasonable changes. The ICO can consider data protection complaints, but generally will not remove cameras or take court action on a person’s behalf.

Body-worn cameras and dash cams

Body-worn video (BWV) used by businesses — door staff, security guards, delivery couriers — falls squarely within UK GDPR. The same requirements apply as for fixed CCTV: a lawful basis, signage where possible, a clear retention policy, secure storage, and a DPIA where the use creates high risk to individuals.

A dash cam used solely for personal or household purposes can fall outside UK GDPR. Business use and wider publication need a separate assessment. Do not assume that filming only what the driver can see, or sharing a recording with an insurer, automatically decides whether the household exemption applies.

Subject access requests for CCTV footage

People can request their personal information in CCTV footage under Article 15. Respond without undue delay and normally within one calendar month, subject to the statutory rules on necessary identity information, clarification, extensions and exemptions.

Consider other people's rights before disclosure and redact where necessary; blurring every other person is not an absolute rule in all circumstances. Preserve relevant footage when a request arrives so routine overwriting does not frustrate it. If footage had already been lawfully deleted before the request, explain that clearly.

Operators should keep a written record of every subject access request, the search performed, and the response given.

Retention periods for CCTV footage

There is no fixed UK GDPR retention period for CCTV. Set a period supported by the recording purpose, use deletion or overwriting controls, and retain particular footage longer only where a documented lawful need justifies it.

The retention period should be documented in the operator’s policy and reviewed periodically. There is no GDPR-mandated maximum, but the longer footage is held without a clear reason, the harder it is to defend if challenged.

For more on retention generally, see our GDPR data retention guide. For broader scope questions about who GDPR applies to, see our scope guide.

Frequently asked questions

Can my neighbour’s CCTV record my property?

If their camera captures your garden, your windows, or you in shared spaces, they are likely outside the household exemption and processing your personal data. They need a lawful basis and must be transparent. If you object, you can raise it with them directly, and if that fails, complain to the ICO.

Do I need a sign for home CCTV?

If your camera records only your own property, no — the household exemption applies. If it captures beyond the boundary, yes. Signs identifying the operator and purpose are part of meeting the right to be informed.

Can I record audio on CCTV?

You can, but audio is particularly intrusive. The Fairhurst v Woodard case found that audio recording beyond a property boundary was disproportionate to a security purpose. Audio should be disabled by default and turned on only where you have a clear, documented reason.

How long can I keep CCTV footage?

Keep footage only for the period justified by its purpose. There is no universal GDPR 7- to 31-day rule. Document the period, review it, and retain incident footage longer only where a specific lawful need remains.

Can someone request CCTV footage of themselves?

Yes. A person can request their own information in footage. Respond normally within one calendar month, applying the relevant deadline rules and exemptions. Consider whether third-party information needs redaction or can lawfully be disclosed.

Do I need to register CCTV with the ICO?

There is no separate CCTV register. A business using CCTV normally pays the data protection fee unless exempt. Domestic CCTV used for household purposes is exempt from the fee, even where recording beyond a boundary brings data protection duties into play.

Make sure everyone who handles personal data is trained to do it safely and lawfully.

Explore the GDPR & Data Protection Course →

Sources & references

Mark McShane
Mark McShane
Health & Safety Training Specialist, Online CPD Academy

Mark writes about data protection, GDPR compliance and accredited online training for GDPR & Data Protection Course, part of Online CPD Academy.