How to implement a cctv policy and signage

Get your signs and policy in place

If you use CCTV at your business premises, you are legally required to inform people that they are being recorded. You must do this by displaying clear, visible signs and having a written policy that explains how you manage the recordings. This isn't just red tape; it’s a key part of complying with UK GDPR and protecting people's privacy, as well as your business.

Step 1: Displaying Clear Signage

Your signs are the first line of communication. They must be easy to see and understand. Place them at the entrance to the area covered by CCTV and in other prominent spots.

Your signs must include:

• A clear message that CCTV recording is taking place.
• The specific reason for using CCTV (e.g., "For the purpose of crime prevention and public safety").
• The name of your business (as you are the 'data controller').
• Contact details for anyone wanting more information, such as a website address or phone number.

Step 2: Creating Your CCTV Policy

A CCTV policy doesn't need to be complicated. It’s a simple document that outlines your procedures and shows you are handling data responsibly. Keep it in a safe place where you and any staff can access it.

Your policy should cover the following key points:

1. Purpose of the System: Clearly state why you are using CCTV. Be specific, for example: "To prevent and detect crime," "To ensure the safety of staff and visitors," or "To monitor and secure our stock and premises."
2. Data Controller Details: Name your business as the data controller and provide contact details.
3. Storage and Security: Describe how and where the footage is stored (e.g., on a password-protected digital video recorder in a locked office).
4. Access to Footage: State who is allowed to view the recordings. This should be a very limited number of people, such as the business owner or a designated manager.
5. Data Retention: Specify how long you will keep the footage. A standard period is 30 days. After this, recordings should be securely deleted unless they are needed for an ongoing investigation by the police or for an insurance claim.
6. Responding to Requests: Outline how individuals can request access to footage of themselves (known as a Subject Access Request) and how you will handle requests from the police.

Top Tip: Write your policy in plain English. The goal is clarity, not complex legal language. Once it's written, set a reminder to review it once a year to make sure it's still accurate and relevant to your business operations.