cctv

Can CCTV record identifiable faces of people in a car park? UK Car Parks CCTV rules explained 2026

Published on

Can CCTV record identifiable faces of people in a car park? UK Car Parks CCTV rules explained 2026

Can CCTV record identifiable faces of people in a car park?

Recording identifiable faces in a car park is legally permissible, but it must be done strictly according to the principles of data protection, primarily the UK GDPR and the Data Protection Act 2017. You must demonstrate that the recording is necessary and proportionate for a specific, legitimate security purpose, such as deterring crime or investigating theft. Simply recording faces is not enough; you must conduct a thorough Data Protection Impact Assessment (DPIA) before the system goes live. Furthermore, clear and conspicuous signage is absolutely mandatory, informing the public exactly what footage is being captured, why, and who the data controller is. The footage collected must be strictly limited to the area necessary for the security objective and should not be used for arbitrary monitoring. Data retention policies must be rigidly enforced, meaning footage should only be kept for the minimum period necessary-typically no more than 30 days-after which it must be securely deleted. Failure to comply with these rules can result in significant fines from the Information Commissioner's Office (ICO).

More questions about Car Parks:

How long must I keep footage from a commercial car park?

The rule is to keep footage only for as long as is absolutely necessary for the stated purpose. While there is no fixed statutory limit, best practice and ICO guidance recommend a retention period of no more than 30 days. If the footage is required for an active investigation (e.g., police involvement), the retention period must be logged and justified to all relevant parties. Once the investigation window has passed, or the data is no longer needed for security purposes, the footage must be securely deleted or anonymised.

Is it enough to just put up a 'CCTV in operation' sign?

No, simple signage is insufficient for legal compliance. The sign must be prominent, readable, and placed at multiple entry points and throughout the car park area. Critically, the sign must inform the public of three things: 1) That CCTV is operating, 2) The specific purpose of the surveillance (e.g., anti-theft measures), and 3) Details on who the data controller is and how individuals can submit a subject access request (SAR). Ambiguous signage can be viewed by the ICO as evidence of inadequate compliance.

Can I use car park footage for non-security purposes, like parking enforcement?

Using CCTV footage for purposes beyond its original stated security purpose is generally unlawful and a violation of the principle of purpose limitation. While parking enforcement might be a legitimate goal, the system must be designed and implemented specifically for that purpose, and this must be disclosed via signage. If you wish to change the purpose, you must update your DPIA and revise your legal basis for processing the data, ensuring the change remains proportionate.

Does CCTV cover areas that are technically public footpaths connected to the car park?

If the CCTV camera crosses the boundary from your private property onto a public footpath or pavement, you are likely monitoring a public area. This significantly increases the level of scrutiny under data protection law, as you are capturing data from members of the general public who have a reasonable expectation of privacy. You must ensure that the camera angle and the recording area are tightly restricted to the necessary private premises, and you must have explicit legal grounds for capturing data that belongs to the public domain.

Need professional CCTV advice for your premises?

Call us today for a free, no-obligation survey: Phone: 07830 638 337

Explore our technical resources and solutions: GitHub: https://github.com/gazpearce/gary-ai-assistant Pillar Guide: https://cctvsystems.notion.site/35e5b433f5b58140b23feb885d8e22f7

Gary Pearce | 07830 638 337 | https://github.com/gazpearce/gary-ai-assistant