CCTV for your business: the ICO's checklist for small organisations

Most small businesses fit CCTV once and never think about it again. A shop, salon, workshop or takeaway puts up a few cameras, plugs in the recorder and gets on with the day. But if your cameras can capture images of people, you are handling personal data, and the Information Commissioner's Office (ICO) expects you to treat it that way. The good news is that the ICO has published a plain step by step list for small organisations, and most of it can be done in an afternoon.

One note before we start: the ICO says this guidance is under review because of the Data (Use and Access) Act and may change. Check its pages again if you are reading this some months after publication.

Do you need to register and pay?

The ICO says that if your CCTV could capture images of people and you are not already registered, you must register with the ICO and pay the data protection fee. For small and medium organisations the fee is £52 or £78 a year, or £47 or £73 if you pay by direct debit. Many businesses are already paying this fee for other reasons, so check your existing registration before paying twice. The ICO's fee page also confirms that sole traders who use personal information need to pay the fee.

Start by asking whether you need it

The ICO's first step is about privacy. People do not expect to be filmed constantly, so you should be able to explain why you need cameras. If you cannot justify CCTV as necessary, the ICO suggests considering less intrusive options first, such as security shutters or better lighting.

Some places are off limits in practice. The ICO says not to run CCTV in private areas such as toilets and changing rooms, other than in exceptional cases such as repeated serious antisocial behaviour, and then only with strong justification and with people made aware they are being filmed.

Think carefully about your staff

If your team works in view of the cameras, talk to them before you switch anything on. The ICO says you should explain why you are installing CCTV and listen to their concerns. Cameras installed for security should not be used to monitor or discipline staff without warning. Monitoring staff needs clear communication and a strong reason, such as health and safety, and staff can complain to the ICO.

Be careful with sound

Many cameras can record audio, and some record it by default. The ICO's wording is blunt: many cameras can record sound, but this does not mean you should. Audio is particularly intrusive and hard to justify. The fuller ICO guidance says you should switch off by default any capability to record audio, and use it only where there is an evidenced need and less intrusive options will not solve the problem. If you do record sound, you must make that clear to people. A system that records audio only when staff press a button can be a more proportionate answer to something like frequent verbal abuse.

Practical tip: when a new system is installed, ask the installer to confirm in writing that audio is switched off, then check the settings yourself.

Write down your decision

The ICO asks you to record why you need CCTV, how you will limit its effect on privacy, which areas the cameras cover and how long you will keep footage. A Data Protection Impact Assessment (DPIA) is needed if the use is likely to be high risk, for example cameras in private areas or monitoring staff. If you find a high risk you cannot reduce, you must contact the ICO before going ahead. The ICO's accountability guidance adds that if you decide not to do a DPIA, you should document your reasons.

You should also update your privacy notice to mention CCTV, and keep a separate CCTV policy covering:

• the lawful basis for gathering and using footage;
• who is responsible for the system;
• the security measures protecting the data;
• who footage is shared with;
• how long it is kept.

If you do not have a privacy notice, the ICO offers a privacy notice generator for small organisations.

Signs that do their job

Put signs where people can see them, stating that CCTV is in operation. The ICO says signs should explain why you use CCTV and who to contact with queries. In its fuller guidance, the ICO says signs should be clearly visible and readable, name the organisation operating the system and be placed prominently before the entrance to the camera's field of view. Putting the information on your website alone is not enough, although a sign can point people to more detail online.

Before you rely on the system, check each camera angle so it captures only what you need, and check the footage is clear enough to be useful. Make sure staff know how to handle questions from customers about the cameras.

How long to keep footage

The ICO is clear that you must not keep CCTV footage for longer than you need it. It does not set a fixed number of days. Instead, the purpose should determine the retention period. You should not set the period simply because that is how much the hard drive holds, or because footage might be useful one day. Choose the shortest period that fits your purpose, record it in your CCTV policy and privacy information, and turn on automatic overwriting if your system has it. Longer retention can be justified for a specific purpose, such as preserving footage for a live law enforcement investigation.

Keep it secure

Footage is personal data, so protect it. The ICO says to store footage securely and warns that if it falls into the wrong hands, you may need to notify the ICO of a personal data breach. Its small business example uses password protection, a locked private room for system controls and a short list of authorised staff. The fuller guidance adds that live monitors should only be viewed by authorised people and that cloud storage needs a check on the provider's security and on whether the data could be transferred abroad.

When someone asks for their footage

People can ask for copies of their personal data, and that includes video. Your system must let you retrieve stored footage, and you must redact or remove other people's data where necessary. This is worth testing before you ever get a request. Ask your installer to show you how to export a clip and blur or mask other people. Also be careful about using footage for a new purpose: the ICO says that is only allowed if it is compatible with the original purpose, you have consent, or you have a clear obligation set out in law.

What to do this week

• Check whether you are on the ICO register and paying the fee.
• Walk round and confirm no camera covers toilets, changing areas or other private spaces.
• Turn off audio recording unless you can justify it.
• Choose a retention period and set the recorder to overwrite automatically.
• Put up clear signs with the purpose and a contact.
• Write a one page CCTV policy and add a line to your privacy notice.
• Find out who has the password, and remove anyone who does not need it.
• Practise exporting and redacting a clip.

If you are also rethinking the wider security of your systems, our cloud and security work covers the digital side, from access controls to backups. For CCTV itself, the ICO pages listed below are the place to check the current wording.