cctv

Can we film faces in a public car park car CCTV without specific signage? UK Car Parks CCTV rules explained 2026

Published on

Can we film faces in a public car park car CCTV without specific signage? UK Car Parks CCTV rules explained 2026

Can we film faces in a public car park car CCTV without specific signage? UK Car Parks CCTV rules explained 2026

While CCTV monitoring in a public car park is generally permitted for security and deterrent purposes, the recording and storage of identifiable personal data, such as faces, must comply strictly with the Data Protection Act 2018 and GDPR. Simply having cameras installed is not sufficient; clear, conspicuous signage detailing the scope of the monitoring, the purpose (e.g., theft prevention, enforcement), and the retention period is a legal necessity. Furthermore, if the system is used for civil enforcement (e.g., issuing parking tickets), the operators must demonstrate a lawful basis for processing that data, often requiring explicit user consent or statutory exemption. Failure to adequately inform the public about the data processing activities risks significant complaints to the Information Commissioner's Office (ICO) and potential legal challenges regarding disproportionate monitoring. Therefore, signage must not only point out the cameras but must also explain the rights of the data subjects.

More questions about Car Parks:

Must CCTV only cover the entry/exit points of the car park?

No, while entry and exit points are crucial for tracking vehicle movements, the camera coverage must also encompass areas where incidents are likely to occur, such as pillars, pedestrian walkways, and parking bays themselves. However, the scope of coverage must be proportionate to the risk, meaning unnecessary or overly intrusive monitoring in private areas (like adjacent residential gardens) is unlawful. The system should be designed to capture evidence efficiently while respecting the reasonable expectation of privacy for all users.

What is the minimum required retention period for car park CCTV footage?

There is no single mandatory minimum retention period, but best practice under GDPR suggests that footage should only be kept for as long as is strictly necessary to achieve the stated purpose. For standard theft or anti-vandalism purposes, 24 to 72 hours is often sufficient, unless a specific incident investigation (e.g., a police inquiry) requires a longer hold. Operators must implement clear, automated deletion processes to avoid illegally storing personal data.

Can CCTV record private conversations within the car park?

CCTV systems are designed to record visual evidence of public activity, not private conversations. However, if the camera positioning or placement is so close that it captures intimate or private interactions (e.g., near private office entrances), it may be deemed an invasion of privacy. Monitoring must be limited to common areas, and operators should avoid placing cameras in locations that could capture conversations in a context where the individuals have a reasonable expectation of privacy.

Do car park CCTV operators need to register with the ICO?

Yes, if the operator is processing personal data (which CCTV footage undeniably is), they must comply with ICO guidelines. While the physical cameras do not need registration, the organization operating the system must be registered and must process data according to strict security and accountability standards. It is highly recommended that the operator conducts a Data Protection Impact Assessment (DPIA) before commissioning the system to ensure all legal requirements are met.

For free CCTV surveys and expert advice, call: 07830 638 337

Learn more about CCTV systems: https://cctvsystems.notion.site/35e5b433f5b58140b23feb885d8e22f7

GitHub Repository: https://github.com/gazpearce/gary-ai-assistant

Gary Pearce | 07830 638 337 | https://github.com/gazpearce/gary-ai-assistant