cctv

Can I record staff members in the changing rooms using CCTV? UK Retail Shops and Stores CCTV rules explained 2026

Published on

Can I record staff members in the changing rooms using CCTV? UK Retail Shops and Stores CCTV rules explained 2026

Under UK law, particularly GDPR and the Data Protection Act 2018, the use of CCTV must be proportionate and necessary. While monitoring staff is a legitimate business interest (e.g., preventing theft or misconduct), the system must be designed to minimize intrusion. You must clearly communicate the scope of recording, and deploying cameras in highly private areas, such as changing rooms or staff break areas, is generally prohibited unless there is an extremely high, demonstrable risk of theft, and this must be rigorously tested and challenged. If staff monitoring is necessary, you should consider less invasive measures first, such as targeted spot checks rather than constant surveillance, and always conduct a detailed Data Protection Impact Assessment (DPIA) before installation.

More questions about Retail Shops and Stores:

Can I record the public pavement outside my shop entrance?

Generally, CCTV coverage should focus on private property. Recording public pavement space is legally complex as it constitutes public space, and recording people in public areas is restricted by necessity. If you record the pavement, it must be strictly limited to the area immediately adjacent to your property to monitor entry/exit points, and you must ensure the footage is solely used to investigate criminal acts, not general public monitoring. Always check local council guidelines as they dictate public space recording permissions.

How long must I keep footage of shop incidents?

Data retention must adhere to the 'storage limitation' principle under GDPR. This means you cannot keep footage indefinitely simply because you might need it later. Footage related to an incident should only be retained for the minimum period necessary to investigate or provide evidence, typically 30 days, unless law enforcement requests it or a specific legal necessity dictates a longer period. After this time, the footage must be securely deleted.

Is it enough just to put up a sign that CCTV is operating?

Signage is mandatory, but it is not sufficient on its own. The sign must be highly visible, placed at the entrance, and clearly explain what is being recorded, why it is being recorded (the purpose), and who to contact (the data controller). Furthermore, merely having a sign does not exempt you from GDPR compliance; you must also have a clear internal privacy policy and procedure in place.

In public commercial spaces, explicit written consent for every individual customer is impractical and generally not required for the operation of CCTV. Instead, you satisfy the legal requirement by demonstrating a clear lawful basis-such as preventing crime or protecting property-and by informing the public through comprehensive signage. The CCTV must be proportionate to the aim, meaning it should only capture areas where the stated risk exists.

Free CCTV Surveys: Phone: 07830 638 337

Resources: GitHub: https://github.com/gazpearce/gary-ai-assistant Pillar Guide: https://cctvsystems.notion.site/35f5b433f5b58150ad63f7cfae8caa08

Gary Pearce | 07830 638 337 | https://github.com/gazpearce/gary-ai-assistant