How to register with the ICO if you use CCTV

If your business uses any form of video surveillance, such as CCTV, smart doorbells, or dashcams, to monitor staff or the public, you are legally required to register as a 'data controller' with the Information Commissioner’s Office (ICO). This involves paying an annual data protection fee and is a legal duty under the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018. Failing to do so can result in significant fines.

Why do I need to register?

When you capture and record images of identifiable people, you are processing their 'personal data'. As the business owner deciding to do this, you are considered the 'data controller' and are responsible for protecting that data. The ICO is the UK's independent authority set up to uphold information rights, and your registration fee helps to fund their work in providing guidance and enforcing the law.

This rule applies to almost all businesses and organisations, with very few exceptions. Using CCTV purely for domestic purposes in your home is exempt, but as soon as it captures images beyond your property boundary (like a public pavement) or is used for business, the rules apply.

How to register with the ICO

The process is straightforward and can be completed online in about 15 minutes. Here’s how to get it done:

1. Check if you need to pay: Before you start, use the ICO's online self-assessment tool. It asks a series of simple questions to confirm that you are required to register and pay the fee.
2. Complete the registration form: Go to the ICO website and follow the links to 'pay your fee'. You will need to provide basic details about your business, including its name, address, number of staff, and annual turnover.
3. Pay the data protection fee: The fee is paid annually and is based on the size and turnover of your business. There are three tiers:
   • Tier 1: £40 – for micro-organisations with a maximum turnover of £632,000 OR no more than 10 members of staff.
   • Tier 2: £60 – for small and medium-sized organisations with a maximum turnover of £36 million OR no more than 250 members of staff.
   • Tier 3: £2,900 – for large organisations.

   Most new businesses will fall into the £40 tier. You'll receive a certificate of registration once payment is complete.

Your ongoing responsibilities

Registering is just the first step. You must also comply with data protection principles in how you use your CCTV system:

• Put up clear signs: You must have prominent signs in the area where your cameras are recording. These signs must be easily readable and should state that CCTV is in operation, the reason for its use (e.g., 'for the prevention of crime'), and who to contact for more information (your business name).
• Store footage securely: Ensure the recorded footage is stored securely and can only be accessed by authorised individuals.
• Don't keep data too long: Only keep recordings for as long as you genuinely need them. A typical retention period for a small business might be 30 days. You should have a policy stating how long you keep footage.
• Respond to requests: Individuals have the right to request a copy of any footage you hold of them. This is called a Subject Access Request, and you must respond to it within one month.

Top Tip: Create a simple, one-page document that outlines your CCTV policy. State why you use it, where your cameras are, how you store the footage, and how long you keep it. This is excellent proof that you are taking your data protection duties seriously.