Can I Use CCTV To Monitor Staff In My Shop?

Can you use CCTV to monitor staff in your shop, cafe or restaurant in the UK? Yes, you usually can, but only if you have a clear, lawful reason and you handle the footage properly.

It's completely understandable to want visibility over what's happening at work. You might be dealing with missing stock, customer complaints, till discrepancies or health and safety risks. CCTV can be a sensible part of managing those issues.

The catch is that staff monitoring sits across both employment law and data protection law. That means you need more than cameras on the wall. You need fair notice, a lawful basis under the UK GDPR, sensible limits and a plan for handling footage if someone asks for it.

Can I Use CCTV To Monitor Staff In The UK?

Yes, you can use CCTV to monitor staff in the UK if it's necessary, proportionate and transparent. The main legal framework is the UK GDPR and the Data Protection Act 2018, with guidance from the Information Commissioner's Office, known as the ICO.

In practice, that means you should be able to explain why you're using CCTV and why a less intrusive option wouldn't solve the issue. For example, general security monitoring in a shop is usually easier to justify than placing a camera directly over one staff member's workstation all day.

Your reason might be to:

• Prevent theft, vandalism or unauthorised access
• Protect staff and customers from aggressive behaviour
• Investigate cash handling issues or till discrepancies
• Support health and safety management
• Check compliance with specific workplace procedures, where needed

What you shouldn't do is use CCTV as a hidden performance management tool. If the real purpose is to monitor staff productivity, break times or every movement on shift, you'll need a very strong justification and clear notice. In many small retail and hospitality settings, that level of monitoring will be hard to justify.

You should also avoid using CCTV in areas where staff have a higher expectation of privacy, such as toilets, changing rooms or staff rest areas. Cameras in those areas will almost always be high risk and may be unlawful unless you're dealing with a truly exceptional situation and have taken tailored advice.

What Are The CCTV In Workplace Rules In The UK?

The main rule is that your monitoring must be fair, lawful and proportionate. That sounds legalistic, but for a shop or hospitality venue it comes down to a few practical steps before you press record.

Under the UK GDPR, CCTV footage of identifiable people is personal data. If you're collecting it for your business, you're likely acting as a data controller. That means you need to take responsibility for how it's collected, stored, used, shared and deleted.

Step 1: Work Out Your Purpose

Write down what the cameras are for. Be specific. For example, to protect staff and customers from incidents at the front counter is clearer than to monitor the workplace.

Step 2: Choose A Lawful Basis

Many businesses rely on legitimate interests for workplace CCTV. This means you have a genuine business interest, the CCTV is necessary for that interest, and the impact on staff is balanced and reasonable.

Consent is usually not the best basis for employee monitoring because staff may not feel free to say no. If you're relying on legitimate interests, it's sensible to complete a legitimate interests assessment and keep it with your records.

Step 3: Complete A Data Protection Impact Assessment Where Required

A data protection impact assessment, often called a DPIA, is required before high risk monitoring. For workplace video or audio monitoring of staff, you should complete and document a DPIA before you deploy the system.

This includes CCTV used to monitor workers, audio recording, facial recognition and covert monitoring. The DPIA should explain your purpose, why the monitoring is necessary, what less intrusive options you considered, the privacy risks for staff and the safeguards you'll use.

Do I Need CCTV Signs And A Privacy Notice?

Yes, you should use clear CCTV signs and give staff a proper privacy notice. Signs alone usually aren't enough where you're monitoring employees.

Your signs should be easy to see before someone enters the monitored area. They should say that CCTV is in operation, who operates it and why it's being used. For example, a sign near your shop entrance might say CCTV is used for safety and security by your business.

For staff, you should go further and provide a CCTV privacy notice or staff monitoring notice. This can sit inside your staff handbook, onboarding pack or workplace surveillance policy, as long as staff can easily access it.

Your staff privacy notice should cover:

• Where cameras are located and which areas they cover
• Why you're using CCTV
• Your lawful basis, such as legitimate interests
• Who can view footage and in what circumstances
• How long footage is kept
• When footage may be shared, such as with police or insurers
• Staff rights, including the right to request access to their personal data
• Who staff can speak to if they have concerns

Say you run a small cafe in Manchester with 12 staff.

You install two cameras: one covering the customer entrance and one covering the till. Your sign at the entrance tells customers and staff that CCTV is used for safety and security. Your staff privacy notice explains that till footage may also be reviewed if there's a cash discrepancy. You keep routine footage for 30 days, then delete it unless it's needed for an incident. That's much easier to justify than vague monitoring with no written explanation.

Can I Use CCTV Footage For Disciplinary Action?

Yes, you can use CCTV footage for disciplinary action if the footage was collected lawfully and using it for that purpose is fair in the circumstances. Problems usually arise when staff were never told that footage could be reviewed for workplace investigations.

If your privacy notice says CCTV is only used for customer safety, then using it later to discipline staff for minor lateness or slow service may feel unfair and could be challenged. If you might use footage for investigating theft, serious misconduct, health and safety breaches or cash handling issues, say that clearly up front.

You should also follow a fair process. ACAS guidance is useful here, especially around investigations, disciplinary meetings and giving staff a chance to respond. CCTV footage can support an investigation, but it shouldn't replace proper process.

Before using footage in a disciplinary matter, ask yourself:

• Was the camera location and purpose made clear to staff?
• Is the alleged issue serious enough to justify reviewing footage?
• Are you only reviewing the footage needed for the incident?
• Have you kept a record of who viewed the footage and why?
• Will the employee have a fair chance to respond to what the footage shows?

For example, Priya runs a boutique in Leeds and notices £180 missing from the till at closing time. Her CCTV policy says till footage may be reviewed for cash discrepancies. She checks only the relevant 45-minute period, keeps a note of who viewed it, and uses the footage as part of a wider investigation. That approach is much safer than trawling through a full week of staff footage hoping to find unrelated issues.

Is Audio Recording Staff Different From CCTV?

Yes, audio recording is much more intrusive than video only CCTV and you should be very cautious before using it. Recording conversations can capture sensitive personal data, private discussions and information about customers or staff that you don't need.

For most shops, cafes and restaurants, continuous audio recording will be difficult to justify. The fact that a CCTV system has an audio function doesn't mean you should switch it on.

Audio may create extra risks because it can record:

• Private conversations between staff members
• Discussions about health, disability, family issues or complaints
• Customer payment or personal details spoken out loud
• Trade union discussions or protected workplace conversations

If you think audio is necessary, you should carry out a careful assessment first and get advice on your specific setup. You'd need a clear purpose, strong justification, prominent notices and strict access controls. You should also consider whether a less intrusive option would work, such as panic buttons, body worn cameras in limited situations, better incident reporting or silent CCTV.

Covert recording is even riskier. Hidden cameras or microphones should only be considered in exceptional circumstances, such as where you reasonably suspect serious wrongdoing and open monitoring would prejudice the investigation. Even then, it should be targeted, time limited and carefully documented in a DPIA. Covert monitoring shouldn't become a normal management tool.

What Should A Workplace Surveillance Policy Include?

Your employee monitoring notice or workplace surveillance policy should explain what you monitor, why you monitor it and how you'll handle the footage. A clear policy helps staff know where they stand and helps you make consistent decisions if an incident happens.

Templates can be a helpful starting point, but they often miss the details that matter for your business, such as your camera locations, retention period and who can access footage. A lawyer should tailor the CCTV privacy policy before you use it with staff.

Workplace CCTV Policy Outline

1. Purpose Of CCTV: State the specific reasons you use CCTV, such as safety, security, theft prevention or incident investigation.
2. Camera Locations: List monitored areas and confirm that private areas aren't monitored.
3. Lawful Basis: Explain the UK GDPR basis you rely on, such as legitimate interests, and summarise your reasoning.
4. Who Can Access Footage: Name roles, not just people, such as the owner, general manager or authorised HR contact.
5. When Footage Can Be Reviewed: Set out the triggers, such as a reported incident, cash discrepancy or health and safety concern.
6. Retention Period: Say how long routine footage is kept, for example 30 days, unless needed for an investigation or legal claim.
7. Sharing Footage: Explain when footage may be shared with police, insurers, advisers or regulators.
8. Staff Rights: Explain how staff can request access to footage or raise concerns.
9. Security Measures: Describe password protection, restricted access and secure deletion.
10. Review Date: Set a date to review the policy, especially if you move cameras or change systems.

You should also check whether you need to pay the ICO data protection fee. Many organisations that process personal data electronically need to pay it unless an exemption applies. The current tiers are £52, £78 and £3,763, with a £5 reduction if you pay by direct debit. Most SMEs pay £52 or £78, but you should use the ICO self-assessment because exemptions and tier criteria can apply.

What If An Employee Asks For CCTV Footage?

If an employee asks for CCTV footage of themselves, you should treat it as a data subject access request if they're asking for their personal data. Under the UK GDPR, you generally have one month to respond.

The request doesn't need to use legal wording. If a staff member says, Can I see the CCTV from my shift last Friday?, that may be enough to trigger your obligations.

Here's a practical order to follow:

1. Record The Request Date: Note the day you received it so you can calculate the one month deadline.
2. Clarify The Scope: Ask for the date, time, location and reason if you need that to find the footage.
3. Preserve Relevant Footage: Stop it being automatically overwritten while you review the request.
4. Check Other People's Privacy: Consider whether customers or other staff appear in the footage.
5. Redact Where Needed: Blur or obscure other people if disclosure would unfairly affect their rights.
6. Respond Securely: Provide the footage or explain why you can't provide all of it.

You usually can't charge a fee for responding to a request. You may be able to charge a reasonable fee or refuse a request if it's manifestly unfounded or excessive, but you should be cautious and get advice before relying on that.

If police ask for footage, don't panic. Check the request is genuine, record what you've shared and why, and only provide what is relevant. If the request is informal or unclear, ask for it in writing before handing anything over.

Key Takeaways

• You can use CCTV to monitor staff in the UK, but you need a clear and lawful reason.
• Legitimate interests is often the right UK GDPR basis, but you should document your reasoning.
• A DPIA is required before high risk workplace monitoring, including CCTV used to monitor workers, audio recording, facial recognition and covert monitoring.
• CCTV signs are useful, but staff also need a privacy notice or workplace surveillance policy.
• Staff can request CCTV footage of themselves, and you usually have one month to respond.
• A tailored policy helps you use footage fairly if an incident, complaint or disciplinary issue comes up.

If you'd like help with CCTV privacy notices, workplace surveillance policies, DPIAs or handling a footage request, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.