cctv

Can you film guests' faces in public hotel areas without explicit consent? UK Hotels and Hospitality CCTV rules explained 2026

Published on

Can you film guests' faces in public hotel areas without explicit consent? UK Hotels and Hospitality CCTV rules explained 2026

In the UK, while CCTV can be used in public areas of a hotel (such as lobbies, hallways, and car parks) for legitimate purposes like crime prevention, recording identifiable faces of guests requires careful consideration of data protection laws, primarily the GDPR and the Data Protection Act 2018. Generally, public CCTV is permissible, but the use of such footage must be proportionate and necessary. You must clearly display signage informing people that they are being recorded, detailing the purpose and who to contact. Furthermore, any recording of individuals who are not suspects or involved in an incident must be minimised, and the footage should only be retained for the shortest period necessary to investigate an incident. Failure to adhere to these principles could result in significant fines from the ICO and legal action from data subjects.

More questions about Hotels and Hospitality:

Recording staff in changing rooms or private staff areas is generally illegal and constitutes a severe breach of employee privacy and trust. Employees have a reasonable expectation of privacy in these spaces, and CCTV monitoring must be strictly limited to common areas or entry/exit points. If monitoring is necessary, the staff must be fully informed, and the use must be proportionate to the stated purpose, such as investigating theft. Always seek legal advice before implementing monitoring in private accommodation areas.

How long must I keep footage of suspicious activity?

Data retention is governed by the principle of storage limitation. You should only keep CCTV footage for as long as is strictly necessary to achieve the stated purpose, which is usually limited to investigating an incident. Once the investigation is closed, the footage must be securely deleted, unless there is a specific legal requirement (e.g., a police request) to retain it. A standard best practice retention period for general incidents is often 30 days, but this must be documented and justifiable.

Must I notify guests about CCTV in my restaurant?

Yes, clear and visible notification is a legal requirement under data protection principles. You must place prominent signage at all entry points stating that CCTV is in operation, explaining what the cameras cover, the purpose of the recording (e.g., preventing theft), and the name/contact details of the person responsible for the system. This signage acts as your transparency measure, demonstrating compliance with data subject rights.

Can I use facial recognition software in my hotel lobby?

The use of facial recognition technology is highly complex and subject to intense scrutiny from the ICO and courts. While possible, it requires a robust Data Protection Impact Assessment (DPIA) to prove necessity and proportionality. You must demonstrate that less intrusive methods (like traditional CCTV) are insufficient. Implementing such advanced technology needs explicit legal counsel to ensure compliance and avoid accusations of excessive surveillance.

Need a professional, compliant CCTV survey for your UK establishment? Call us today for a free consultation and survey. Phone: 07830 638 337

Resources and Information: GitHub: https://github.com/gazpearce/gary-ai-assistant Pillar Guide: https://cctvsystems.notion.site/35e5b433f5b581d5b5a2d9eff0969ab4

Gary Pearce | 07830 638 337 | https://github.com/gazpearce/gary-ai-assistant