CCTV compliance for UK business sites

Which rules apply to your site's cameras?

Five sets of rules can touch the same cameras. Most businesses deal with data protection and fire safety; waste, industrial and construction sites usually add the rest.

It helps to think of your CCTV as one system with several audiences. The Information Commissioner's Office (ICO) cares about the people the cameras record. The fire safety law cares about whether a fire would be found and people warned. The Environment Agency, if you hold a permit for combustible waste, cares about how quickly a fire is detected and put out, in working hours and when the site is closed.^[7] Your insurer cares about all of that, plus property damage and business interruption, and may set its own standards on top.^[8]

The good news is that these overlap. The same camera register, the same map of what each camera covers and the same alert log can answer questions from all five. The table below shows who sets each rule, what it asks of your cameras, and where to read more.

This hub is general information, not legal or insurance advice. Scotland and Northern Ireland have their own fire safety law and environmental regulators, so check the rules for your nation.

Guides in this hub

Six practical guides, each written for site and operations managers and cited to the ICO, the Environment Agency, legislation.gov.uk, the HSE and industry guidance.

• Data protection

  AI CCTV and GDPR: a UK guide for businesses

  Lawful basis, DPIA, signs, retention, access, footage requests and complaints when AI analyses your CCTV, with a printable checklist.

  Best for: Anyone running business CCTV

  Read the guide
• Environmental permit

  Fire prevention plan checklist for waste sites

  The Environment Agency FPP, section by section: detection in and out of hours, pile sizes, separation, quarantine and security.

  Best for: Permitted waste sites in England

  Read the guide
• Health and safety

  Hot works fire risk: permits, fire watch and after hours

  What counts as hot work, the permit, clearing combustibles and the fire watch after work stops, with a checklist.

  Best for: Industrial, construction and waste sites

  Read the guide
• Insurance

  What insurers expect from fire detection

  What a risk survey looks at, where certified detection is expected, where video detection adds early warning, and the evidence to show.

  Best for: Sites preparing for a survey or renewal

  Read the guide
• Evidence

  Waste site fires in the UK: key facts and sources

  Official figures on waste fires in England, lithium-ion battery fires and what the Environment Agency expects, each with its source.

  Best for: Anyone writing a risk assessment or business case

  Read the guide
• Security

  Out-of-hours site security checklist

  Perimeter, lighting, CCTV coverage and alerts, fire risks, keyholders and lone working, in a checklist you can tick, save and print.

  Best for: Any site that empties at night

  Read the guide

New to the technology? Start with what AI CCTV is, then see how video smoke detection works on existing CCTV. Every guide we publish is listed on the guides page.

What does UK GDPR mean for business CCTV and AI?

Footage of people who can be identified is personal data, so the same principles apply whether a person or an AI is watching. You remain the controller, and you stay responsible for how the system is used.^[1]

In practice, the ICO expects a written purpose for each camera, a lawful basis (usually legitimate interests for site security and safety) and a data protection impact assessment. The ICO says a DPIA is a legal requirement for surveillance likely to be high risk, and that this applies in most cases. It also asks operators to document any use of algorithms, AI or machine learning in the DPIA.^[1]

Signs should be visible and readable, placed before people enter the area a camera covers, and should say who runs the system and how to contact them.^[2] Keep footage for the shortest period your purpose needs; the law sets no fixed period.^[2] People can ask for footage of themselves, and you have one month to respond, extendable in complex cases.^[3] You also need a process for data protection complaints.^[4]

For AI on existing CCTV, the DPIA usually records which detections run on which cameras, what triggers an alert, who receives it and where video is processed. Our AI CCTV and GDPR guide walks through eight steps and includes a checklist you can print.

What do fire law and fire prevention plans expect from detection?

In England and Wales, the responsible person for business premises must carry out a suitable and sufficient fire risk assessment, review it and record it.^[5] Where necessary, the premises must have appropriate fire detectors and alarms.^[6]

Permitted waste sites in England go further. The Environment Agency fire prevention plan has three objectives: minimise the likelihood of a fire, aim to extinguish it within four hours, and minimise its spread. The plan must show how a fire is detected in its early stages, both in working hours and when the site is closed. The EA lists CCTV visual flame detection among automated systems, and says it must be covered by third-party certification or a recognised standard, or you must show you can still meet the three objectives.^[7]

The same guidance says you must have security measures in place, such as security fencing, intruder alarms and CCTV, with arrangements outside working hours, and describe where the CCTV and alarms are.^[7] That makes your camera layout part of your permit paperwork, not just your security set-up.

Waste fires are a real and growing risk: fire and rescue services in England attended 256 industrial waste fires in 2025, up from 183 in 2021.^[12] The waste fire facts page sets out the figures and their sources, and the fire prevention plan checklist takes you through the plan section by section.

Hot works, lone working and the hours after close

Many fires start when nobody is looking: after hot work has finished, after the last shift has left, or when one person is covering a large site alone.

Hot work such as welding, cutting and grinding needs a permit to work, cleared combustibles and a fire watch after the job.^[9] The FPA's RC7 recommendations call for a continuous fire watch for at least one hour after work finishes, then further checks at intervals of no more than 20 minutes.^[10] WISH notes that some insurers ask for longer on waste sites, so check your policy.^[8] The hot works fire risk guide covers the permit and fire watch in detail.

WISH also notes that a significant number of waste site fires occur after working hours, when hot or hazardous items can smoulder in a pile and flare up overnight or at the weekend.^[8] If anyone works alone, for example on security rounds, the HSE expects employers to manage the risks before they do.^[11] Our out-of-hours site security checklist covers lock-up, keyholders and alerts.

What will your insurer ask about your cameras?

Insurers may set their own standards for fire detection, and you can meet what your regulator asks while still falling short of what your insurer wants.^[8]

A risk survey usually looks at your fire risk assessment, your fire prevention plan if you have one, housekeeping and close-down, separation, detection and alarm, out-of-hours cover, security and hot works. WISH advises talking to your insurer before you change your fire detection, because asking first is easier than arguing afterwards.^[8]

Cameras come up in two ways: as security, and as a possible extra layer of early fire warning. Be clear which is which. Certified fire alarm and detection systems carry the weight inside buildings; video detection on existing CCTV can add early visual warning in yards, on stockpiles and out of hours. The insurer expectations guide includes a survey readiness checklist.

Where AI on existing CCTV fits, and where it does not

Woodcock AI adds smoke, fire and intrusion detection to the cameras you already have. It supplements certified fire alarm and detection systems and your statutory procedures; it does not replace them, and it does not do your paperwork for you.

What it can do is make the paperwork easier to write and easier to prove:

• Polygon detection areas. Draw the exact area each camera should watch, such as round a stockpile or along a fence line, so alerts come only from the places you have a reason to monitor. See polygon detection zones.
• Per-camera alert schedules. Smoke and fire all day, intrusion out of hours, set camera by camera, which maps straight onto the "in working hours and when the site is closed" question in a fire prevention plan.
• A self-learning AI. It learns each site's cameras, and every detection has a feedback button that feeds into retraining, so the alert log stays clean. See how the self-learning AI works.
• Plain-English questions and clip download. Ask your footage questions in everyday language and download the clips you need for a request, an incident report or a survey.
• Alerts that reach someone. App alerts with the clip go to the people you choose, with support available 24/7. Alerts to a monitoring centre (ARC) and phone-call alerts are available as optional paid add-ons.

Before you describe video detection in your DPIA, fire prevention plan or insurer survey, agree the wording with whoever reviews it. The comparison of video AI, thermal and on-camera analytics explains what each can and cannot see.

How to keep one evidence folder for every audit

Keep these six items together and up to date, and most questions from the ICO, a fire officer, the Environment Agency or your insurer can be answered from the same place.

1. 1

   Camera register

   Each camera, what it covers, its purpose and who is responsible for it. This feeds your DPIA, your FPP and your insurer's survey.

2. 2

   DPIA and signs

   Your data protection impact assessment, including any AI analysis, and photos of the signs at each entrance.^[1][2]

3. 3

   Fire risk assessment and FPP

   The current, recorded fire risk assessment and, for permitted waste sites, the fire prevention plan with CCTV and alarm locations marked.^[5][7]

4. 4

   Detection map and schedules

   Which cameras watch for smoke, fire and intrusion, the detection areas drawn on each, and the times each one is active.

5. 5

   Alert log and response plan

   A record of alerts, what was checked and what was done, plus who responds in and out of hours.

6. 6

   Permits and fire watch records

   Hot work permits and the fire watch that followed, and records of any fault or outage in your fire or security systems.^[10][8]

Review the folder whenever you add or move a camera, change who receives alerts, or change how the site operates, and after any fire, near miss or break-in.

Sources

Law, regulatory guidance and industry guidance referred to on this page. This is general information, not legal or insurance advice; your own assessments, your regulator and your insurer decide what applies to your site.

1. ICO, Video surveillance guidance: what are our responsibilities in terms of accountability?. Lawful basis, DPIAs (a legal requirement for surveillance likely to be high risk, which the ICO says applies in most cases), documenting any use of AI or algorithms, records and contracts with processors. Last checked 24 October 2026.
2. ICO, Video surveillance guidance: how can we comply with the data protection principles?. Signs and transparency, retention based on purpose, audio, workplace use and security, including cloud storage. Last checked 24 October 2026.
3. ICO, Video surveillance guidance: governance (post-deployment). Requests for footage and the one-month response time, redaction and disclosure to third parties. Last checked 24 October 2026.
4. ICO, How to deal with data protection complaints. You must have a process for handling data protection complaints and acknowledge them within 30 days. Last checked 24 October 2026.
5. The Regulatory Reform (Fire Safety) Order 2005, article 9: Risk assessment. The responsible person must make a suitable and sufficient fire risk assessment, review it regularly and record it. Last checked 24 October 2026.
6. The Regulatory Reform (Fire Safety) Order 2005, article 13: Fire-fighting and fire detection. Where necessary, premises must be equipped, to the extent that it is appropriate, with fire detectors and alarms. Last checked 24 October 2026.
7. Environment Agency, Fire prevention plans: environmental permits. The three FPP objectives, detection in working hours and when the site is closed, CCTV visual flame detection among automated systems, and security measures such as fencing, intruder alarms and CCTV. Last checked 24 October 2026.
8. WISH, WASTE 28: Reducing fire risk at waste management sites (issue 3, March 2020). Good practice guidance written with the EA, HSE, NFCC and others. Notes that insurers may set their own standards and that a significant number of waste site fires occur after working hours. Last checked 24 October 2026.
9. HSE, HSG168 Fire safety in construction. Defines hot work and sets out precautions before, during and after it, including the fire watch. Last checked 24 October 2026.
10. FPA, RC7: Risk control for hot work. A continuous fire watch for at least one hour after hot work, then further checks at intervals of no more than 20 minutes. Last checked 24 October 2026.
11. HSE, Lone working: protect those working alone. Employers must manage health and safety risks before people work alone; security staff are given as an example. Last checked 24 October 2026.
12. MHCLG, Number of industrial waste fires, England 2021 to 2025. Fire and rescue services in England attended 256 industrial waste fires in the year ending December 2025, up from 183 in 2021. Last checked 24 October 2026.