CCTV Policy for the Workplace: A Practical UK Guide for Employers

Workplace CCTV is not just a data protection issue — it's an employment issue. The moment your cameras capture employees, you're conducting workplace monitoring, and that introduces obligations that don't apply to a camera pointing at your car park.

Most employers install workplace CCTV for legitimate reasons — security, theft prevention, health and safety. The problems start when there's no policy, no employee notification, and no documented justification for why cameras are necessary in each specific area. This guide covers what UK law requires of employers operating workplace CCTV.

What Makes Workplace CCTV Different

Standard CCTV compliance — signage, retention, DPIA, policy — applies to every camera regardless of who it records. Workplace CCTV adds three layers:

1. Employee expectations. Employees spend 8+ hours a day in your building. Continuous recording of their working environment is more intrusive than recording a customer who passes through for 10 minutes. The proportionality test is harder to satisfy.

2. Employment law interaction. Footage used in disciplinary proceedings, redundancy decisions, or performance reviews becomes employment evidence. How you collected, stored, and disclosed it matters for employment tribunal admissibility.

3. Union and consultation rights. Trade union recognition agreements may require consultation before installing monitoring equipment. Even without a recognised union, the ICO expects consultation with affected employees before cameras go live.

What Your Workplace CCTV Policy Must Cover

Purpose — Specific and Honest

Every camera needs a documented purpose. The common purposes for workplace CCTV are:

• Building security — deterring and detecting break-ins, controlling access to restricted areas
• Theft prevention — monitoring high-value stock, cash handling areas, secure storage
• Health and safety — monitoring hazardous areas, loading bays, manufacturing floors
• Evidence for investigations — capturing incidents for subsequent investigation

What's not a valid purpose: General monitoring of employee behaviour, checking whether people are working hard enough, or tracking break times. If your actual reason for the cameras is to monitor productivity, say so — and then assess whether that purpose is proportionate (in most cases, it won't be).

The ICO's video surveillance guidance is clear: covert monitoring of employees is only justified in exceptional circumstances (typically where criminal activity is suspected and less intrusive methods have been tried).

Proportionality — Camera by Camera

You must demonstrate that each camera is necessary and proportionate for its stated purpose. This assessment belongs in your DPIA and should be summarised in your policy.

Areas where workplace cameras are typically proportionate:

Location	Purpose	Proportionality Notes
Building entrances and exits	Security, access control	Proportionate — minimal privacy impact, clear security benefit
Warehouse / stockroom	Theft prevention, safety	Proportionate if limited to stock areas, not break areas
Cash handling areas (tills, safes)	Theft prevention	Proportionate — high-value area with specific risk
Loading bays	Safety, delivery verification	Proportionate — operational area with safety risks
Car parks	Vehicle security	Proportionate — low privacy expectation in car parks
Reception / public areas	Security	Proportionate — visitors and staff expect recording in lobbies

Areas where cameras are hard to justify:

Location	Why It's Problematic
Staff break rooms / kitchens	High privacy expectation — employees are on break, not working
Offices / desks	Continuous monitoring of computer work is rarely proportionate
Changing rooms / toilets	Never lawful regardless of purpose
Union meeting rooms	Monitoring union activity is specifically problematic
Smoking areas	Designated break space — same privacy concerns as break rooms

The key test: For each camera, ask: "Could we achieve the same aim without recording this area?" If better locks, restricted access, stock checks, or other measures would achieve the purpose, CCTV in that location may not be proportionate.

Employee Notification — Before Cameras Are Installed

Under UK GDPR and employment law principles, employees must be informed about workplace monitoring before it begins:

What to tell employees:

• Where cameras are located (every camera, not just "we have CCTV")
• What purpose each camera serves
• Who has access to footage
• How long footage is retained
• How to submit a subject access request
• Where to find the full CCTV policy
• That footage will not be used for purposes beyond those stated

How to notify:

• Staff meeting with documented minutes (date, attendees, questions raised)
• Written notification (email, letter, or internal memo) — retained on file
• Reference in employment contract or staff handbook
• Compliant signage at every entrance to surveilled areas

Existing employees vs. new starters: For existing staff, notification must happen before cameras are installed. For new starters, include CCTV monitoring information in the induction process and reference it in the offer letter or contract.

Using Footage in Disciplinary Proceedings

If a camera captures an incident — theft, assault, a health and safety violation — you may need to use the footage in a disciplinary investigation. This is lawful, provided:

1. The footage was collected for a legitimate purpose. If the camera exists for security and captures an employee stealing, using it in the disciplinary investigation is consistent with the security purpose. If the camera was installed specifically to monitor one employee's behaviour without their knowledge, using that footage is on much shakier ground.

2. The employee has a right to see the footage. Under natural justice principles (and most disciplinary procedures), an employee facing disciplinary action is entitled to see the evidence against them. This includes CCTV footage. If other employees are visible in the footage, you may need to redact them — but you cannot refuse to share the footage entirely.

3. Retention covers the investigation timeline. If your standard retention is 30 days and the disciplinary hearing is scheduled for day 45, the footage will have been deleted. Preserve relevant footage immediately when an incident is identified. Document the reason for preservation.

4. Chain of custody is defensible. If footage is challenged at an employment tribunal, you need to demonstrate it hasn't been tampered with. Export the original file from the NVR, record when it was exported and by whom, and store the export securely. Screen recordings of a monitor playback are less defensible than direct digital exports.

Covert Monitoring — The Exception, Not the Rule

The ICO's CCTV guidance permits covert monitoring only when:

• There is a reasonable suspicion of criminal activity or gross misconduct
• Informing employees about the monitoring would prejudice the investigation
• The monitoring is time-limited (not indefinite)
• A specific DPIA has been completed for the covert monitoring
• Senior management has authorised it in writing

Covert monitoring must be a last resort — not a first response to a suspicion. If you suspect theft, visible cameras and stock audits should be tried first. Covert cameras are justified only when other methods have failed or would alert the suspect.

Risk warning: Covert monitoring that doesn't meet these tests can result in ICO enforcement, unfair dismissal claims (if used as evidence), and damage to wider employee relations. Get legal advice before installing covert cameras.

Handling Employee Subject Access Requests

Employees can request copies of footage showing them — and they often do during grievance or disciplinary processes. The process is the same as any CCTV subject access request, with some workplace-specific considerations:

• Timeliness is critical. An employee in a disciplinary process who submits a SAR is likely building a defence. Delays or refusals will be noted by the tribunal.
• You can't use the SAR process against the employee. The information you provide in response to a SAR is for the employee's use. You cannot then use the fact that they submitted a SAR, or the timing of it, as evidence against them.
• Redact third parties. Other employees visible in the footage have their own data protection rights. Redact or blur them unless they consent to disclosure.

The deadline is one calendar month from receipt of a valid request. The Data (Use and Access) Act 2025's "stop the clock" provision applies if you need the employee to clarify which dates, times, or cameras they're requesting.

Connecting CCTV to Your Wider Employment Practices

Workplace CCTV doesn't exist in a vacuum. It interacts with:

• Staff handbook / employment contracts — should reference CCTV monitoring and point to the full policy
• Disciplinary procedure — should describe how CCTV evidence is used and preserved
• Grievance procedure — should note that employees can request footage via SAR
• Privacy notice — your employee privacy notice must list CCTV as a category of personal data processed
• Data retention schedule — CCTV retention must be consistent with your wider data retention policy
• Trade union agreement — if applicable, may impose consultation or notification requirements beyond the legal minimum

Action Plan for Employers

If you operate workplace CCTV and don't have a specific workplace policy:

1. Audit your cameras. Walk the site. Document every camera, its location, what it covers, and whether it captures employee working areas.
2. Complete a DPIA with specific attention to employee monitoring proportionality. Use our DPIA guide and template.
3. Write your workplace CCTV policy covering every section above. Use our policy generator as a starting point.
4. Notify employees in writing and in a meeting. Document both.
5. Remove or reposition disproportionate cameras. If your audit reveals cameras in break rooms or other areas you can't justify, removing them is cheaper than defending them.
6. Check overall compliance with our free compliance checker.

For the full regulatory context, read our UK CCTV regulations guide.

This guide covers workplace CCTV obligations under UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025, current as of March 2026. Employment law varies by jurisdiction and circumstance — this guide covers England and Wales. It is not legal advice.

Sources

• ICO — Video surveillance guidance (including CCTV)
• ICO — CCTV for your organisation: things you need to do
• Data Protection Act 2018 — legislation.gov.uk