cctv

Can I record customers' faces in the changing rooms under GDPR? UK Retail Shops and Stores CCTV rules explained 2026

Published on

Can I record customers' faces in the changing rooms under GDPR? UK Retail Shops and Stores CCTV rules explained 2026

Can I record customers' faces in the changing rooms under GDPR?

Generally, recording faces in changing rooms is highly restricted and potentially non-compliant with the UK's General Data Protection Regulation (GDPR) and the Data Protection Act 2018. CCTV footage captures biometric data, which is considered a special category of personal data requiring heightened justification. You must demonstrate that the recording is strictly necessary for a legitimate interest, such as preventing theft, and that it is proportionate to the risk. Best practice dictates that cameras should only cover high-risk areas like exits or till points, and explicit signage must inform customers of the scope of recording. If the footage is not strictly necessary for security, you should avoid recording the changing area entirely to maintain customer trust and legal compliance. Always consult the ICO guidelines before deploying cameras in sensitive areas.

More questions about Retail Shops and Stores:

Recording staff members in private break areas is usually considered an invasion of privacy and is highly problematic under UK employment law and GDPR. Monitoring employees must be proportionate, and the expectation of privacy in a private staff area is generally high. If monitoring is absolutely necessary (e.g., for safety reasons), the employee must be fully informed and consent must be obtained, though consent alone may not be sufficient if the monitoring is disproportionate. Focus your cameras on visible operational areas, not private resting spaces.

How long can I keep CCTV footage of a suspected shoplifting incident?

The retention period must be limited to what is necessary for the specific purpose. While you may need footage to identify an individual, you cannot retain footage indefinitely. Typically, footage should be deleted within 24 to 48 hours unless there is an active investigation (e.g., involving the police or insurance company). If you are awaiting police instruction, you must document the lawful basis for the delay and ensure that staff handling the footage are trained in data minimization principles.

Do I need to inform customers that the CCTV camera is pointing at the street entrance?

Yes, you must ensure that all areas covered by CCTV are clearly signposted. While capturing the immediate entrance or car park boundary might be necessary to monitor access points, the signage must specify the exact area covered. Furthermore, if the camera is covering a public thoroughfare, you must ensure the signage clearly indicates that the footage is recorded and that you are only collecting data for legitimate security purposes.

Can I use CCTV footage to investigate an internal employee disciplinary issue?

Using CCTV for internal disciplinary matters is possible, but it requires careful legal consideration to avoid breaching employee privacy rights. The footage must be strictly relevant to the alleged misconduct, and its use must be proportionate. Before viewing the footage, management should consult HR and legal counsel to establish a clear policy and ensure that the employee was fully informed that such monitoring capability existed.

For free CCTV surveys and professional advice, call: Phone: 07830 638 337

For more resources and technical information, visit our GitHub: GitHub: https://github.com/gazpearce/gary-ai-assistant

Read our full guide to CCTV compliance: https://cctvsystems.notion.site/35f5b433f5b58150ad63f7cfae8caa08

Gary Pearce | 07830 638 337 | https://github.com/gazpearce/gary-ai-assistant