Is It Legal to Have Workplace Cameras and Surveillance?

Many UK businesses want cameras in the workplace for sensible reasons, security, stock control, health and safety, or investigating incidents. The legal trouble usually starts when cameras go in without a clear purpose, staff are not told properly, or the system collects more footage than the business actually needs. Another common mistake is treating CCTV as just a facilities issue, when it is also a data protection and employment issue.

The short answer is yes, workplace cameras and surveillance can be legal in the UK, but only if your business uses them fairly, transparently and proportionately. That means thinking about why you need surveillance, where cameras are placed, how long footage is kept, who can access it, and what you have told workers. This guide explains when workplace monitoring is allowed, what rules usually apply, and what founders and managers should sort out before they spend money on setup or roll out a new monitoring system.

Overview

UK businesses can use workplace cameras and other surveillance tools, but they cannot monitor staff however they like. Surveillance at work usually involves personal data, so employers need a lawful basis, a genuine business reason, and a setup that is proportionate to the risk they are trying to manage.

Employment expectations also matter. Even where monitoring is justified, staff should usually know what is happening, why it is happening, and how the information will be used.

Define the business purpose for CCTV or monitoring, such as security, safety, or investigating specific incidents.
Check whether the same goal can be met in a less intrusive way.
Tell staff clearly about the cameras, audio recording, or other monitoring tools.
Review your privacy notice, staff policies and, where relevant, employment contracts.
Limit camera locations, access to footage, and retention periods.
Take extra care with covert monitoring, audio recording and high privacy areas.
Keep records showing why the surveillance is necessary and proportionate.

What Is It to Have Workplace Cameras and Surveillance Means For UK Businesses

For a UK business, workplace surveillance means monitoring workers or visitors through tools such as CCTV, door entry systems, dashcams, body-worn cameras, audio recording, screen monitoring, GPS tracking, or software that logs activity. The legal point is not just whether a camera exists, but what personal data it captures, why it is used, and whether the monitoring is fair.

In practice, this sits mainly within UK data protection law, including the UK GDPR and the Data Protection Act 2018. If your cameras record identifiable people, you are processing personal data. That triggers duties around transparency, lawful processing, security, retention, and individual rights.

Why CCTV at work is a privacy issue

A lot of business owners think CCTV is purely about preventing theft or protecting premises. It can do that, but if the footage shows employees, contractors, visitors or customers, the business is handling personal data. If the cameras also record sound, vehicle registration details, facial images, or behaviour patterns, the privacy impact can be greater.

This means your business needs to be able to explain why surveillance is necessary. A vague statement like “for general management oversight” is often too broad. A clearer reason, such as preventing unauthorised access to a warehouse, monitoring a high risk cash handling area, or investigating repeated stock losses, is easier to justify.

Lawful, fair and proportionate use

The main question is whether your monitoring is lawful, fair and proportionate. Lawful means you have a valid legal basis for processing personal data. Fair means people are not being watched in ways they would not reasonably expect, especially in more private settings. Proportionate means the monitoring matches the problem and does not go further than needed.

For example, a camera covering the entrance to a stockroom may be justified where there have been theft concerns. Continuous audio recording of staff conversations across an office is much harder to justify. Likewise, cameras in toilets or changing rooms are generally not acceptable because privacy expectations are far higher.

Transparency usually matters

Employers should usually be open about workplace surveillance. Staff should know that monitoring is happening, what type of monitoring is used, the reason for it, and how footage or data may be reviewed. Clear signage can help for visible CCTV, but signage alone is not usually enough. Your staff privacy notice and internal policies should explain the position in more detail.

This is where founders often get caught. They install cameras after a break-in, but never update their employee privacy notice or handbook. Months later, footage is used during a disciplinary process and staff argue they were never told that could happen. The issue is not just the camera, it is the lack of proper notice and documentation.

Covert monitoring is high risk

Hidden or covert surveillance is not automatically lawful just because a business suspects misconduct. In the UK, covert monitoring is treated as especially intrusive and should usually be limited to exceptional circumstances, such as a time-limited investigation into suspected serious wrongdoing where telling staff in advance would prejudice the investigation.

Even then, the business should be very cautious. Covert monitoring should be tightly scoped, targeted, and kept under review. It is not a general management tool. Before you sign off on hidden cameras, it is wise to think carefully about necessity, alternatives, location, duration, and whether a documented assessment supports the decision.

When This Issue Comes Up

Workplace surveillance questions usually come up when a business changes premises, grows its team, has a security incident, or starts using new technology. The legal risk increases when the decision is rushed and no one stops to ask whether the monitoring is actually justified.

Installing CCTV in an office, shop or warehouse

This is the most common scenario. A founder takes on a retail unit, office, studio or warehouse and wants visible CCTV to deter theft, monitor access, and provide evidence if something goes wrong. That can often be legitimate, but the setup still needs thought.

Camera placement matters. Filming entrances, exits, loading bays or till areas is easier to justify than filming desks all day with no clear reason. If cameras capture public areas outside your premises or neighbouring properties, that can increase privacy concerns and may require tighter positioning and controls.

Using footage in a staff investigation

Another common moment is after suspected misconduct, a safety breach, or missing stock. Businesses often want to pull footage and use it in a disciplinary process. That may be possible, but only if the footage was collected lawfully and handled properly.

Problems tend to arise where footage was originally installed for one purpose but later used for another without clear notice. A business should think about whether the secondary use is compatible with the original reason for collection and whether staff were told this could happen.

Monitoring remote or hybrid workers

Surveillance is not limited to physical cameras. Some businesses use software to monitor log-ins, screenshots, keystrokes, browsing activity, time on task, or webcam checks for remote staff. These tools raise similar, and often more sensitive, privacy issues.

If you are considering digital monitoring of home workers, proportionality becomes even more important. Monitoring that might be acceptable in a secure call handling environment may be excessive for a small creative team working flexibly from home. Before you spend money on setup, be clear about the problem you are trying to solve.

Vehicle tracking and mobile workforce management

Businesses with vans, delivery drivers, field technicians or sales teams often use GPS tracking, dashcams or telematics. These tools can support route planning, driver safety, insurance requirements, and asset security. They can also become a form of employee monitoring.

Your business should be clear whether tracking operates only during working hours, whether data is reviewed routinely, and whether private use of vehicles is allowed. If private use is permitted, all-hours tracking can create extra privacy concerns.

High risk sectors and sensitive environments

Some sectors have stronger reasons for surveillance, such as hospitality venues handling cash late at night, healthcare settings with access controls, manufacturing sites with safety risks, or businesses storing high value goods. A stronger reason does not remove the need for fairness and proportionality, but it can affect the balance.

The reverse is also true. A business operating in a more sensitive environment, or employing staff in spaces where there is a stronger expectation of privacy, should be particularly careful. Break rooms, prayer spaces, changing areas and toilets are obvious examples where intrusive monitoring can create serious legal and employee relations problems.

Practical Steps And Common Mistakes

The safest approach is to treat workplace surveillance as a planned compliance project, not a last-minute hardware purchase. Most legal problems come from poor scoping, weak documentation, and using monitoring far more broadly than first intended.

Set a clear purpose before installation

Start with the business reason. If your answer is too vague, the project probably needs more thought. Good reasons are usually specific and evidence-based.

Preventing theft in a stockroom after repeated losses.
Protecting staff at a reception desk where there have been threats.
Controlling entry to a restricted manufacturing area.
Reviewing incidents involving health and safety risks.

If your real reason is “I want to keep an eye on everyone”, that is where the main risk is. General employee supervision rarely justifies intrusive monitoring.

Check whether a less intrusive option works

You do not always need surveillance to solve a business problem. Sometimes better locks, access cards, stock procedures, managerial checks, or targeted audits will do the job. Where a less intrusive step would reasonably work, broad surveillance is harder to justify.

This is especially relevant for audio recording and remote monitoring software. These tools can feel efficient, but they often create a bigger privacy impact than business owners first expect.

Carry out a written assessment

If monitoring could significantly affect privacy, a documented assessment is a sensible step and may be expected in practice. This helps you record the purpose, the risks to individuals, the scope of monitoring, and the measures used to reduce intrusion.

Your assessment should usually cover:

What the system records, such as video, sound, location or device activity.
Why the monitoring is needed and what evidence supports that need.
Who may be affected, including staff, contractors and visitors.
Whether there are less intrusive alternatives.
How footage or monitoring data will be secured and who can access it.
How long data will be kept.
What information will be given to workers.

Tell people clearly and in the right place

Transparency is not just a sign on the wall. Your business should explain monitoring in the places workers actually look for information, such as privacy notices, staff policies, onboarding materials and, where relevant, contracts or workplace rules.

That information should usually cover:

What monitoring takes place.
Why it takes place.
Where cameras or tools are used.
Whether audio is recorded.
How data may be used, including investigations or disciplinary processes.
How long data is retained.
Who to contact with questions or requests.

If a system changes, your documents should change too. A business that starts with front door CCTV and later adds internal cameras, vehicle tracking or desktop monitoring should not rely on outdated notices.

Limit access and retention

Footage should not be open to anyone who asks. Access should be limited to people who genuinely need it, such as senior management, HR, compliance personnel or a nominated security lead. There should be a process for reviewing, exporting and deleting footage.

Retention is another area where SMEs often slip. Keeping everything forever is rarely justified. Set a sensible data retention period linked to the purpose of the system, and keep footage longer only where there is a specific reason, such as an ongoing investigation or insurance issue.

Avoid high privacy areas and overreach

Some placements are so intrusive that they are likely to create legal trouble unless there are very unusual facts. Cameras in toilets and changing rooms are the clearest example. Staff rest areas may also raise concerns unless there is a very strong and specific justification.

Audio recording deserves separate caution. Constant sound recording often captures far more personal information than video alone. Many businesses do not actually need it.

Use suppliers carefully

If an external company installs or manages your CCTV, stores footage in the cloud, or provides staff monitoring software, your contract matters. The supplier may be handling personal data on your behalf. Your agreement should deal with security, instructions, confidentiality, access, retention, and what happens when the service ends.

This is one of those founder moments where people focus on the monthly subscription and ignore the legal paperwork. Before you sign, check who controls the data, where it is stored, and how quickly you can retrieve or delete it.

Common mistakes businesses make

Installing cameras without a documented reason.
Filming wider areas than necessary.
Failing to update staff privacy notices or policies.
Using covert monitoring too casually.
Keeping footage indefinitely.
Letting too many people access recordings.
Recording audio when video would have been enough.
Using monitoring for new purposes without reviewing fairness and transparency.

These issues can lead to complaints, regulator attention, employee distrust, and weaker footing in disciplinary processes. Even where a business had a legitimate concern to address, poor implementation can create avoidable risk.

FAQs

Can an employer put CCTV in the workplace in the UK?

Yes, often they can, if there is a genuine business reason and the monitoring is lawful, fair and proportionate. Employers should usually be transparent about CCTV, limit it to what is necessary, and handle footage in line with data protection rules.

Do employers need to tell staff about workplace cameras?

Usually yes. Staff should normally be told about visible workplace monitoring, why it is used, and how footage may be used. Signs can help, but they are usually not enough on their own without proper privacy information and internal policies.

Can employers use hidden cameras at work?

Sometimes, but only in limited and high risk situations. Covert monitoring is generally only justifiable where there is suspected serious wrongdoing, telling staff in advance would undermine the investigation, and the monitoring is tightly targeted and time-limited.

Is audio recording at work allowed?

It can be, but it is more intrusive than video-only CCTV and often harder to justify. Businesses should be especially careful about recording conversations unless there is a strong, specific need and clear notice has been given.

How long can workplace CCTV footage be kept?

There is no single fixed period for every business. Footage should be kept only for as long as needed for the purpose it was collected, with longer retention reserved for specific situations such as an active investigation, claim or security incident.

Key Takeaways

Workplace cameras and surveillance can be legal in the UK, but only where the monitoring is justified, fair and proportionate.
Visible CCTV for security, safety and access control is often easier to justify than broad employee monitoring or constant audio recording.
Most workplace surveillance involves personal data, so UK GDPR and Data Protection Act duties usually apply.
Staff should usually be told what monitoring happens, why it happens, and how the data may be used.
Covert monitoring is high risk and should generally be reserved for exceptional, tightly controlled situations.
Your business should document the purpose, limit coverage, restrict access, and set sensible retention periods.
Policies, privacy notices, supplier contracts and investigation processes should all line up with how the monitoring actually works.

If your business is dealing with is it to have workplace cameras and surveillance and wants help with privacy notices, CCTV and monitoring policies, supplier contracts, employment documentation, you can reach us on 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.

Official Sources to Check

Rules and regulator guidance can change. Check the current official material most relevant to this issue before relying on the article: