cctv

Can I record conversations in public corridors using CCTV? UK Offices and Commercial Buildings CCTV rules explained 2026

Published on

Can I record conversations in public corridors using CCTV? UK Offices and Commercial Buildings CCTV rules explained 2026

Can I record conversations in public corridors using CCTV? UK Offices and Commercial Buildings CCTV rules explained 2026

Under UK data protection law, specifically the Data Protection Act 2018 (DPA 2018) and the GDPR, monitoring public corridors is permissible only if it is necessary, proportionate, and has a clear, defined purpose (e.g., crime prevention or theft prevention). While CCTV can record who moves through an area, recording the content of private conversations raises significant issues regarding Article 8 rights (the right to private life). Commercial operators must adopt a 'minimum intrusion' approach, ensuring that cameras are placed to capture actions, not private exchanges. It is highly advisable to review your camera placements to ensure they do not inadvertently capture areas designated as private or confidential, such as staff break rooms or private meeting areas. Clear signage detailing the scope of recording and the lawful basis for monitoring is mandatory to comply with ICO guidance. Failure to do so could result in significant fines and legal challenges regarding disproportionate surveillance.

More questions about Offices and Commercial Buildings:

Must I inform staff if I use facial recognition CCTV?

Yes, the use of facial recognition technology (FRT) is considered high-risk and requires explicit, detailed notification to all affected staff members. Because FRT processes biometric data, it falls under strict GDPR rules, meaning you must establish a lawful basis (e.g., explicit consent or vital interest). You must conduct a full Data Protection Impact Assessment (DPIA) before deployment, and the ICO generally recommends restricting its use to only the most critical security needs.

How long can I keep CCTV footage of staff and visitors?

The guiding principle in the UK is 'data minimization' and prompt deletion. Unless the footage is required for a specific investigation (e.g., an incident report), general surveillance footage should not be retained beyond 24 to 48 hours. For investigation purposes, you must only retain footage for the minimum time necessary to achieve the defined purpose. Keeping footage longer than necessary is a breach of GDPR principles and increases your legal liability.

Do I need specific signage for every camera and every area monitored?

While placing signage at every single camera is impractical, you must have prominent, clear, and highly visible signage at the entry points and in the general monitored area. This signage must clearly state that CCTV is in operation, the purpose of the recording (e.g., "For the prevention of crime"), and who the data controller is. Generic warnings are insufficient; the notice must be specific enough to meet GDPR transparency requirements.

Can I use CCTV to monitor employee behaviour for performance reviews?

Generally, no. CCTV is a security tool, not a performance management tool. Monitoring staff solely for performance review purposes is highly invasive, highly controversial, and often viewed as a breach of the implied term of trust and confidence within the employment contract. If monitoring is absolutely necessary, it must be strictly proportionate, justified by severe security risks, and must be outlined in the employee handbook and employment contract.

Need to review your office CCTV compliance? Call us for a free survey: 07830 638 337

Learn more about our systems: GitHub: https://github.com/gazpearce/gary-ai-assistant

Read our comprehensive pillar guide: https://cctvsystems.notion.site/35f5b433f5b581808431f658b5d46d99

Gary Pearce | 07830 638 337 | https://github.com/gazpearce/gary-ai-assistant