When: operating some CCTV systems in a public place, all of the following must be put into practice and suitable documentation kept to record the methods used:

  • Monitors displaying images from areas in which individuals would expect privacy should not be viewed by unauthorised persons
  • Access to recordings should be restricted to authorised persons
  • Viewing of recordings should take place in a restricted area in private conditions
  • All persons with access to images should be aware of procedures when accessing recordings
  • All operators should be trained in their responsibilities
  • All access to the medium on which the images are recorded should be documented
  • No recorded images should be disclosed to third parties except for limited or prescribed circumstances
  • All requests for access to data should be documented. Data subjects should be provided with a leaflet which gives information about the recorded images
  • The manager of the scheme has to make certain decisions regarding disclosure and duty of confidence
  • All staff involved in operating the equipment must be able to recognise a request from an individual to prevent processing likely to cause damage to that individual
  • A manager or designated member of staff should undertake regular reviews of the documented procedures to ensure compliance
  • The operator should ensure that correct documentation is completed for any images that are removed for evidence

From the above (Remember they are all Law with a maximum penalty of a £5000 fine for non-conformity), it is evident that proper documented records are essential in order to ensure compliance. 

Our Data Protection pack has all of the necessary documentation personalised to your needs. Cost £57 for download in PDF format.


Not recording?

If you have a business CCTV system that does not use any recording method, but even so you are processing personal data, you still have to conform to the Act.  You still need to comply with all of the rules that are relevant to your system, and consequently you might need to register and you are advised to document your use of the system. 

Good Practice

As well as the laws briefly outlined above, there are an equal number of recommendations that the Office of the Data Protection Commissioner offers as 'Good Practice'. 

Adopting all of these principles is straightforward and sensible. 

We provide you with everything you need to operate a quality system that encompasses all of the recommendations and the law.


Our description of the laws as outlined above are not complete, nor written in the proper legal manner. They are shown merely as a means of advising you of some of the issues that need to be addressed before operating a surveillance system if you are doing so for protection of a business premises. Not all business premises need to register, but it is still advisable to keep proper records. A full description of the law and recommendations for good practice can be normally obtained by application for the CCTV Code of Practice by email to 

To check the official Code of Practice for CCTV, with guidance for correct installation and operation procedures, see the Home Office Surveillance Camera Code of Practice HERE.


Make sure your CCTV system is legal
Check the ico website here