What is GDPR-compliant CCTV?

GDPR compliance in CCTV is the process of ensuring that your CCTV system complies with the UK GDPR. According to the UK GDPR, organisations need to be upfront about handling personal data and get permission from users before gathering their personal info. To comply with UK GDPR, you must also make sure your CCTV system meets these basic requirements:

1. Have a clear purpose statement

Your CCTV system must have a clear purpose statement describing why it’s being used by the organisation (i.e., safety and security purposes).

2. Retrieve footage only if there’s suspicion

The footage from cameras should be retrieved only if there’s suspicion that an individual may have committed an offence (i.e. if it matches existing video footage from other sources).

3. Store footage securely

Any footage collected must be stored securely so unauthorised individuals or third parties cannot access it without consent from the individuals featured (i.e., via a password or biometric identifier).

Why might workplace CCTV monitoring be useful for your organisation?

The need for CCTV monitoring depends on each organisation. If you have storage units containing valuable items and sensitive information, CCTV may be useful in monitoring access and maintaining a log of activities around these areas. Other organisations may choose to only install CCTV following previous security incidents.

The monitoring of employees through video surveillance isn't required by the GDPR. It is left to the discretion of the data controller (your organisation) to identify a need for CCTV and decide.

How can you ensure your CCTV is GDPR compliant?

When we think about personal information, our first thought is written documentation, such as banking details and forms of identification. But it's important to remember that images and videos may also include personal information, a key consideration for CCTV systems under the GDPR. To stay compliant, remember these key points when using and sharing CCTV footage:

Maintain transparency around how/why CCTV is used

The GDPR is rooted in transparency, and you must inform people that they are under surveillance using visible signs. Signs should also include the following details:

1. Why this data is being collected/its purpose, for example: “CCTV currently in operation to ensure public safety”
2. Contact details of the data protection officer (DPO)
3. Information about your organisation (data controller)
4. Means to access other details upon request (via QR code, for example)

Aim to collect minimal data 

Article 5(1)(c) of the GDPR stipulates that data collection should be “adequate, relevant and limited to what is necessary” in line with its stated purpose. Be sure to review your CCTV practices and delete unnecessary footage regularly.

Ensure access to footage is limited to specific individuals

Only those who need access to surveillance footage should be allowed access, i.e. those in management roles and others who require this data to perform their duties. To facilitate this, cloud-based systems can store CCTV footage securely in an encrypted format that those with permission can access.

Conduct a data protection impact assessment (DPIA)

Before you set up your CCTV cameras and begin surveillance, you should identify and minimise any potential data processing risks. Gather this information through a DPIA - learn more about carrying out a DPIA and download a DPIA template. A DPIA should be conducted whenever CCTV equipment is newly installed or moved. 

Comply with reasonable access requests

Individuals should be allowed access to CCTV footage that concerns them. These requests can be formal or informal, and you are expected to respond to requests within one month. The requested footage should be provided in a secure and easily accessible way, with the identities of other subjects blurred to ensure their privacy.

When done effectively, CCTV can be a valuable tool in maintaining workplace security and protecting the confidentiality, availability, and integrity of sensitive information. However, there are a few risks you should consider before choosing to install CCTV. 

Watch our on-demand webinar: Master the GDPR compliance audit: A comprehensive guide

What are the risks associated with workplace CCTV monitoring?

Though not inherently risky, there are a few things you should aim to avoid before choosing to install CCTV at your workplace:

Breach of employee-employer trust

Monitoring workplace activities may damage your relationship with your employees, so they must be informed of any CCTV devices. Uninformed/non-consensual surveillance may result in complaints and staffing issues.

GDPR infringement

Your organisation might violate the GDPR and incur heavy fines if the collected data isn't adequately protected. This could damage your organisation’s reputation and put it at significant financial risk.

Human Rights Act violation

Ensure that the means of surveillance are not overly intrusive so as not to violate your employees' privacy. Such violations can result in legal action.

What fines can you get for CCTV GDPR non-compliance?

The ICO takes data privacy violations seriously, which extends to poor CCTV practices. GDPR violations can result in fines amounting to €20 million or 4% of an organisation’s annual global turnover – whichever is greater.

Take steps to make your CCTV GDPR-compliant

When reviewing how your organisation handles personal information, don't overlook that video surveillance might capture personally identifiable images. Following GDPR guidelines safeguards your organisation against unauthorised sharing of sensitive data, breaches, and hefty fines. 

Find out how to keep your organisation GDPR compliant and how our experts and platform can help you along the way. And if you’re ready, don’t hesitate to reach out: