Can CCTV record faces of loiterers in public areas outside a store entrance? UK Retail Shops and Stores CCTV rules explained 2026
Can CCTV record faces of loiterers in public areas outside a store entrance? UK Retail Shops and Stores CCTV rules explained 2026
Under UK data protection law, the recording of individuals in public spaces, such as the pavement or car park outside a retail establishment, is highly restricted and must be justified by a clear lawful basis. Generally, you cannot record faces of loiterers simply because they are present, as this constitutes processing personal data and requires proportionality. Any CCTV deployed must be strictly necessary for specific, defined purposes, such as deterring theft or monitoring known anti-social behaviour points, and should be visible to the public. You must conduct a Data Protection Impact Assessment (DPIA) to prove that the intrusion on privacy is minimal and proportionate to the risk. Furthermore, the scope of the recording must be limited to the absolute minimum area required to achieve the legitimate aim, often meaning the camera should cut off before the public footpath begins. Always consult the ICO guidance to ensure compliance with GDPR principles, as excessive recording can lead to significant fines and legal action.
More questions about Retail Shops and Stores:
Must I inform customers that CCTV is recording my store?
Yes, it is a mandatory requirement under best practice and ICO guidelines that you clearly inform all patrons that CCTV is operational. This should be achieved through highly visible signage placed at multiple points of entry and exit, detailing the purpose of the cameras and who the data controller is. The signs must be easily readable and use clear, unambiguous language to avoid any legal challenge regarding consent or lack of awareness.
How long can I keep footage of shoppers who haven't committed an offence?
You must adhere to a strict retention policy, typically no longer than 30 days, though this can vary based on the specific incident or legal requirement. Once the footage is no longer needed for operational security, investigating a crime, or fulfilling a specific legal obligation, it must be securely deleted. Keeping data for excessive periods increases your legal risk and violates the principle of data minimisation under GDPR.
Does CCTV count as "public space" if I use it in a shared car park?
If the car park is shared or accessed by the public (e.g., a multi-storey car park entrance), the recording of common areas is treated as monitoring public space, increasing legal scrutiny. In such cases, you must demonstrate that the CCTV is absolutely necessary to protect your specific interests, such as preventing theft from your premises, and that less intrusive methods are insufficient.
What if a customer challenges the legality of my CCTV recording?
If a customer challenges the recording, you must have a documented, written policy outlining your legal basis for processing the data (e.g., legitimate interests). You should immediately cease any action that requires further recording and refer the individual to the ICO guidance. It is highly advisable to have legal counsel review your policies before engaging in a dispute.
Need a professional, legally compliant CCTV survey for your UK retail premises? Call us today for a free, no-obligation survey: Phone: 07830 638 337
Resources and Further Learning: Pillar Guide: https://cctvsystems.notion.site/35f5b433f5b58150ad63f7cfae8caa08 GitHub: https://github.com/gazpearce/gary-ai-assistant
Disclaimer: This article provides general information and is not a substitute for professional legal advice. Always consult a qualified solicitor for specific guidance regarding UK law.
Related CCTV Guides
Gary Pearce | 07830 638 337 | https://github.com/gazpearce/gary-ai-assistant