cctv

Can you record common areas like lobbies and corridors without breaching Article 8 rights? UK Hotels and Hospitality CCTV rules explained 2026

Published on

Can you record common areas like lobbies and corridors without breaching Article 8 rights? UK Hotels and Hospitality CCTV rules explained 2026

Can you record common areas like lobbies and corridors without breaching Article 8 rights? UK Hotels and Hospitality CCTV rules explained 2026

Generally, yes, but doing so requires robust legal justification and strict adherence to data minimization principles under the GDPR and DPA 2018. For common areas, the primary lawful basis is usually "legitimate interest," such as crime prevention, asset protection, or managing safety risks for guests and staff. You must ensure that signage clearly informs individuals that they are being recorded, detailing the purpose, scope, and retention period of the footage. Furthermore, the cameras must be positioned to capture only what is necessary for the stated purpose, avoiding 'voyeuristic' angles into private spaces like guest room windows or restrooms. Always conduct a Data Protection Impact Assessment (DPIA) before installation to prove that the public benefit outweighs the intrusion, a requirement emphasized by the Information Commissioner's Office (ICO).

More questions about Hotels and Hospitality:

Must CCTV footage be kept for 30 days, or can I delete it sooner?

While many businesses default to 30 days, the ICO advises that retention periods must be justified by a specific business need. If the footage is only needed to investigate a theft that occurred within 72 hours, keeping it longer is unnecessary and illegal. You should implement a strict, documented deletion policy that automatically purges footage once the defined purpose (e.g., settling an insurance claim) has expired.

The difference is crucial: recording on a public street is highly regulated and requires specific local council permits, as you are capturing public space. In contrast, a private parking lot falls under your control, allowing for more flexibility, but you must still ensure signs are visible and that the cameras do not capture private residential driveways or adjoining properties.

Do I need to notify staff members that their workplace is under CCTV surveillance?

Absolutely. Under UK employment law and GDPR, staff members must be fully aware of any monitoring measures. This notification should be documented in staff handbooks and policy manuals. Simply having a sign near the camera is insufficient; the policy must detail why the recording is happening (e.g., managing cash handling) and how the footage will be reviewed.

Using facial recognition (FRT) is considered a high-risk data processing activity and is heavily scrutinized by the ICO. While some commercial systems are available, you must have a clear, demonstrable legal basis and undergo a thorough DPIA. For most hospitality businesses, the legal complexity and risk of misuse usually mean that simpler, traditional CCTV monitoring is the more compliant and advisable approach.

For free CCTV surveys and compliance checks, call us on: Phone: 07830 638 337

Learn more about compliance best practices: Pillar Guide: https://cctvsystems.notion.site/35e5b433f5b581d5b5a2d9eff0969ab4

Need expert technical help? GitHub: https://github.com/gazpearce/gary-ai-assistant

Gary Pearce | 07830 638 337 | https://github.com/gazpearce/gary-ai-assistant