cctv

Can CCTV record areas where staff take breaks in a commercial building? UK Offices and Commercial Buildings CCTV rules explained 2026

Published on

Can CCTV record areas where staff take breaks in a commercial building? UK Offices and Commercial Buildings CCTV rules explained 2026

Can CCTV record areas where staff take breaks in a commercial building? UK Offices and Commercial Buildings CCTV rules explained 2026

The short answer is that blanket recording in staff break areas is highly problematic and may constitute unlawful surveillance. CCTV monitoring must be proportionate and strictly limited to areas where there is a genuine safety or security risk, not for general monitoring of employee movements. Under the Data Protection Act 2018 (DPA 2018) and GDPR, you must demonstrate a clear lawful basis, and monitoring a break room rarely meets this threshold. The Information Commissioner's Office (ICO) strongly advises that staff changing rooms, toilets, and designated break areas should be excluded from camera coverage entirely. If recording is absolutely necessary (e.g., due to a specific, documented risk like theft from the kitchen), clear signage must be displayed, and staff must be informed in the privacy notice that the area is monitored. Always conduct a Data Protection Impact Assessment (DPIA) before installing or adjusting camera fields of view to ensure compliance and minimise intrusion.

More questions about Offices and Commercial Buildings:

Must I tell employees that CCTV is operating?

Yes, transparency is a legal requirement. You must display clear, visible signage at all entry points stating that CCTV is in operation, who the footage is monitored by, and the purpose of the recording. Furthermore, this information must be included within your formal employee privacy policy and staff handbook, ensuring every employee is aware of the surveillance system from the outset. Failure to inform staff can lead to complaints and demonstrate non-compliance with the ICO's guidelines on transparency.

What is the maximum time I can keep CCTV footage?

Data retention must be proportionate. While there is no single fixed legal maximum, the ICO recommends that footage should only be kept for the minimum period necessary to achieve the stated purpose. For general incident monitoring, a typical retention period of 30 days is common practice, but this must be reviewed based on your specific risk assessment. Once the data is no longer required for operational or investigative purposes, it must be securely deleted.

Does CCTV count as 'personal data' under GDPR?

Absolutely. Any footage that captures identifiable people-whether they are employees, clients, or visitors-is considered personal data. This means the system falls under the scope of the GDPR and DPA 2018. Therefore, you must implement robust security measures, limit access to the footage, and have clear policies detailing how the data will be stored, processed, and deleted.

Can I use CCTV to monitor staff performance and punctuality?

Using CCTV solely to monitor general staff performance or punctuality is usually disproportionate and violates employee trust, making it legally risky. While CCTV can be used as part of a security risk assessment (e.g., preventing unauthorized entry), its use must be directly related to security, not management control. If performance issues arise, disciplinary action should be managed through HR processes that do not rely on continuous surveillance footage.

Phone: 07830 638 337 for free surveys

GitHub: https://github.com/gazpearce/gary-ai-assistant

Pillar Guide: CCTV Systems Compliance

Gary Pearce | 07830 638 337 | https://github.com/gazpearce/gary-ai-assistant