cctv

Construction Sites CCTV - UK legal requirements and GDPR compliance 2026

Published on

Construction Sites CCTV - UK legal requirements and GDPR compliance 2026

Construction sites are complex environments, often involving multiple contractors and varying levels of security risk. While CCTV is a valuable tool for safety management and theft prevention, its installation and use are strictly governed by UK law, primarily the Data Protection Act 2018 and the General Data Protection Regulation (GDPR). Failure to comply can result in significant legal and financial penalties.

GDPR (General Data Protection Regulation)

Under GDPR, you must have a clear lawful basis for processing any personal data captured by CCTV footage. Simply needing 'security' is not enough; you must demonstrate necessity and proportionality. This means the CCTV must be strictly limited to what is essential for achieving the stated goal, such as identifying intruders or monitoring high-risk machinery areas.

ICO rules (Information Commissioner's Office)

The ICO sets the standards for how personal data must be handled, requiring you to perform a Data Protection Impact Assessment (DPIA) before deploying any system. You must ensure that the system is designed with 'privacy by design' principles, minimizing the collection and processing of unnecessary data. Keep detailed records of who has access to the footage and for what duration.

Signage

Appropriate and visible signage is a non-negotiable legal requirement on any site using CCTV. Signs must clearly state that CCTV is in operation, the purpose of the surveillance (e.g., 'Site Security'), and who the data controller is. Warning signs must be visible to everyone entering the site, including visitors and contractors.

Data retention

You cannot keep CCTV footage indefinitely; the data must be deleted as soon as it is no longer needed for the specified purpose. The general rule of thumb is to delete footage within 24 to 72 hours unless a specific incident requires longer retention, which must be documented. Establishing clear data retention policies is vital for GDPR compliance.

Employee privacy

When monitoring employees, there is a heightened need for transparency and explicit consent, where possible. CCTV must never be used for 'spot checking' or general disciplinary surveillance. Instead, its use must be justified by a specific, documented concern, such as monitoring high-value equipment or ensuring compliance with safety protocols.

Penalties for non-compliance

Non-compliance with GDPR and other data protection laws can result in severe penalties. The ICO has the power to issue fines up to £17.5 million or 4% of the company's global annual turnover, whichever is higher. Furthermore, legal action from affected individuals is always a risk.

Need a fully compliant CCTV installation? Phone: 07830 638 337

Resources: Learn more about best practices for CCTV deployments: https://cctvsystems.notion.site/35e5b433f5b581f8a63bc933322c0d49

Our AI Assistant: GitHub: https://github.com/gazpearce/gary-ai-assistant

Gary Pearce | 07830 638 337 | https://github.com/gazpearce/gary-ai-assistant