Home › Answers › Data, privacy and GDPR
Is CCTV footage personal data in the UK?
Short answer
Yes. A CCTV image is personal data under UK GDPR whenever someone can be identified from it, by their face, clothing, car number plate or context. A business using CCTV must have a lawful reason, put up clear signs, keep footage secure, delete it when no longer needed and answer access requests within one month.
What the law expects from a business
The ICO's video surveillance guidance applies to CCTV, smart doorbells, body cameras and AI-based camera systems. In practice you need to:
- Have a clear purpose, such as preventing crime, and use cameras only where they are necessary and proportionate.
- Tell people. Put up visible signs saying recording is taking place, who runs it and how to contact you. Your privacy notice should explain the CCTV too. See do I need a privacy notice?
- Keep footage secure and limit who can view it.
- Set a retention period and delete footage after it, unless it is needed for an incident.
- Answer subject access requests. People can ask for footage of themselves, normally within one calendar month, and you should blur or protect other people in it.
- Pay the ICO data protection fee if you process personal data for business, which most businesses with CCTV do. See do I need to pay the ICO fee?
AI and smart cameras
Cameras with facial recognition, number plate recognition or AI analytics are more intrusive. The ICO says these can process more sensitive data, so you should do a data protection impact assessment first. Facial recognition usually involves biometric (special category) data and needs an extra legal condition. See do I need a DPIA for AI?
Home CCTV
If your home camera only covers your own property, UK GDPR does not apply. If it captures a neighbour's garden, a shared drive or the street, it does. You then need to follow data protection rules, including signage and access requests. Point cameras carefully and use privacy masking where you can.
Related questions
Does a CCTV camera need a privacy notice?
Yes, for a business. You need a visible sign at the point of recording and fuller privacy information, usually in your privacy notice, explaining why you record, how long you keep footage and people's rights.
How long can I keep CCTV footage?
The law sets no fixed period. Keep it only as long as you need it for your stated purpose, write that period down and delete footage on schedule.
Can someone ask for CCTV footage of themselves?
Yes. It is a subject access request. You normally have one calendar month to respond, and the request is free in most cases.
Note on new guidance
The ICO says its video surveillance guidance is under review after the Data (Use and Access) Act 2025, so check it again before major changes.
Sources
- ICO: video surveillance guidance, including CCTV
- ICO: home CCTV systems
- GOV.UK: request CCTV footage of yourself
- GOV.UK: domestic CCTV guidance
Checked 18 October 2026. Rules and prices change, so check the source before you rely on it. This is general information, not legal, tax or financial advice.
More on data, privacy and gdpr
- Are AI detection tools accurate?
- Are AI tools secure for business?
- Are ChatGPT chats private? Can OpenAI read them?
- Are Microsoft Copilot chats private?
- Can AI agents be trusted?
- Can AI read my WhatsApp messages?
All data, privacy and gdpr answers · All answers · Guides · AI tools directory
Get one useful AI tool in your inbox each weekday
Free, plain English, five minutes to read. Unsubscribe any time.
See our privacy notice.