CCTV Signage Requirements UK: What You Must Display and Where

A "CCTV in operation" sticker on your front door doesn't meet UK signage requirements. Under UK GDPR and the Surveillance Camera Code of Practice, your signs must tell people specific things before they walk into a monitored area — and most business signs miss at least one.

Here's exactly what your signs need to include, where to place them, and the mistakes that leave you non-compliant.

What UK Law Requires on CCTV Signs

The signage obligation comes from two sources: UK GDPR (the transparency principle, Articles 12–14) and the Surveillance Camera Code of Practice (Principle 2: the use of a surveillance camera system must take into account its effect on individuals and their privacy).

Together, they require that anyone entering a monitored area is informed clearly and in advance.

Five Things Every CCTV Sign Must Include

1. The data controller's identity

Your sign must name the organisation responsible for the CCTV system. For most SMEs, this is your business name or trading name — not your installer or security company.

Right: "Operated by ABC Retail Ltd" Wrong: "CCTV in operation" with no name

2. The purpose of recording

State why the cameras are there. Keep it specific to your actual reason for recording.

Right: "For the prevention and detection of crime and to ensure the safety of staff and customers" Wrong: No purpose stated, or a vague "for security purposes"

3. Contact details

Provide a way for people to contact the data controller — a phone number, email address, or postal address. People need to know how to ask questions, make a complaint, or submit a subject access request for footage of themselves.

4. Where to find more information

Reference your CCTV policy or privacy notice. This can be a URL, a QR code, or a physical location ("Our full CCTV policy is available at reception"). If you don't have a CCTV policy yet, generate one with our free policy generator.

5. A clear statement that recording is taking place

The sign must make it obvious that CCTV cameras are operating in the area. This sounds obvious, but signs hidden behind doors or obscured by foliage don't count.

Example Compliant Sign Wording

Based on industry practice, a compliant CCTV sign might read:

CCTV IN OPERATION

Operated by: ABC Retail Ltd

Purpose: For the prevention and detection of crime and to ensure the safety of staff and customers

Contact: data@abcretail.co.uk / 0123 456 7890

Our full CCTV policy is available at reception or at www.abcretail.co.uk/cctv-policy

Adapt the wording to match your business, purposes, and contact details. The key is that all five required elements are present and clearly readable.

Where to Place CCTV Signs

Signs must be visible and readable before someone enters the monitored area. Place them:

At every entrance to a building, car park, or fenced area where cameras operate
At eye level — typically 1.5 to 1.7 metres from the ground
Before the camera's field of view — the person must see the sign before the camera sees them
At each distinct monitored zone if your premises has separately monitored areas (e.g., warehouse and reception have different camera systems)

Sign sizing guidelines

There's no legal minimum sign size, but the ICO expects signs to be "clearly visible and legible." In practice:

Internal doorways and corridors: A4 minimum
External building entrances: A3 minimum
Perimeter gates or car park entrances (vehicles approaching): A2 or larger, with text readable from a vehicle

If in doubt, stand where a visitor or employee would approach and check whether you can read the sign comfortably. If you have to squint, it's too small.

Common Signage Mistakes

Missing data controller name. The single most common failure. Your installer might have left a generic sign that says "CCTV in operation" — it doesn't name your business, so it fails the transparency requirement.

No contact details. Without a phone number, email, or address, people have no way to exercise their data rights. This is a UK GDPR Article 13 failure.

Signs placed after the camera. If someone is already being recorded before they see the sign, you haven't given them fair notice. The sign must come first.

Outdated business name. If your business has rebranded, changed its legal name, or moved premises, your signs need updating. A sign naming a business that no longer exists doesn't identify the current data controller.

Signs obscured or damaged. A faded, dirty, or blocked sign isn't "clearly visible." Check your signs regularly — especially outdoor ones exposed to weather.

What Happens If Your Signage Is Non-Compliant

Non-compliant signage doesn't automatically mean the ICO will fine you. But it creates three risks:

ICO complaints. If someone requests their CCTV footage (a DSAR) and discovers they weren't properly informed they were being recorded, the ICO is likely to investigate your wider CCTV compliance — not just the signage.
Employee tribunal evidence. In workplace disputes, non-compliant signage can undermine your ability to use CCTV footage as evidence. If the employee wasn't properly informed, the footage may be challenged.
Broader compliance failures. If your signage is wrong, it often signals other gaps — missing DPIA, no retention policy, no documented CCTV policy. The ICO looks at the whole picture.

Signage Checklist

Run through this for every monitored entrance on your premises:

Sign names the data controller (your business)
Sign states the purpose of recording
Sign includes contact details (phone, email, or postal address)
Sign references where to find the full CCTV policy
Sign is placed before the camera's field of view
Sign is at eye level and legible from a normal approach distance
Sign is clean, undamaged, and current

Use our CCTV compliance checker to assess your overall compliance, including signage. For the complete picture of UK CCTV obligations, read our full regulations guide.

This guide covers CCTV signage requirements under UK GDPR and the Surveillance Camera Code of Practice as of March 2026. It is not legal advice.