AI CCTV and GDPR: a UK guide for businesses

Does UK GDPR apply to AI CCTV?

Yes, whenever the cameras capture people who can be identified. UK GDPR and the Data Protection Act 2018 apply to CCTV that processes personal data, and the ICO's video surveillance guidance covers newer technology as well as traditional CCTV.^[1]

That holds even when the AI is looking for something else. Woodcock AI's smoke and fire detection looks for smoke and flame, and intrusion detection flags a person or vehicle entering a zone you set. Neither identifies who someone is, but the footage behind an alert can still show a person, so it is still personal data and the normal CCTV rules apply.

The law is also moving. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and the ICO says its video surveillance guidance is under review because of the changes.^[7] This guide reflects the guidance as it stands; check the sources for updates.

You may also see the Surveillance Camera Code of Practice mentioned. In England and Wales it is mandatory only for relevant authorities, such as the police and local councils, which must have regard to it. Private businesses are encouraged to follow its 12 guiding principles voluntarily, and doing so is a good way to show your system is proportionate.^[10]

Who is responsible: controller and processor

The business that decides why and how the cameras are used is the controller, and it stays responsible for compliance.

If another organisation makes joint decisions with you about the purpose and running of the system, you are joint controllers and both stay responsible. If a provider processes footage on your behalf, the ICO expects written contracts that clearly define its responsibilities.^[1] Both controllers and processors need records of processing under Article 30.^[1]

In practice that means you decide which cameras are analysed, where the detection zones sit, how long footage is kept and who receives alerts. Ask any AI provider, including us, for the information you need for your DPIA and your records.

Eight steps to use AI CCTV in line with UK GDPR

Drawn from ICO guidance. This is general information, not legal advice; your DPIA and your own advisers decide what applies to your site.

1. 1

   Define the problem and the purpose

   Write down what the cameras and the AI are for, such as spotting smoke and fire out of hours or alerting you when someone enters a closed yard. The ICO checklist asks you to define the problem before you start and review the decision regularly.^[4]

2. 2

   Pick and document a lawful basis

   For business CCTV this is likely to be legitimate interests, because genuine consent is hard to get from everyone a camera sees. Record your reasoning in a legitimate interests assessment.^[1] If you use biometric data, such as facial recognition to identify people, you also need an Article 9 condition.^[1]

3. 3

   Carry out a DPIA

   The ICO says a data protection impact assessment is a legal requirement for surveillance likely to be high risk, and that this applies in most cases. Document any use of AI or algorithms in it. If high risk remains after your measures, consult the ICO before you start.^[1]

4. 4

   Put up clear signs

   Signs should be visible and readable, placed before people enter the area a camera covers and repeated inside it. They should say who runs the system and how to contact them, unless that is obvious. A notice on your website alone is not enough.^[2][4]

5. 5

   Set the shortest retention that works

   The law sets no minimum or maximum period. Choose the shortest period your purpose needs, and do not keep footage just because the recorder has space or the default allows it.^[2]

6. 6

   Secure the footage and limit access

   Store recordings securely, limit viewing to authorised people, and check that any cloud storage is secure and where it is held.^[2][4]

7. 7

   Be ready for requests and complaints

   People can ask for footage of themselves. Respond within one month, which can be extended by two months for complex requests, and stop footage covered by a request being deleted.^[3] You must also have a process for data protection complaints.^[6]

8. 8

   Keep records, pay the fee and review

   Keep Article 30 records of your processing,^[1] pay the ICO data protection fee unless you are exempt,^[5] name a person responsible for the system and review it regularly.^[4]

What your CCTV signs should say

People must be told about the surveillance. Signs are the usual way, backed by fuller information on your website, but a website notice on its own is not enough.^[2]

The ICO says signs should be clearly visible and readable, sized for whoever needs to read them, whether pedestrians or drivers, and placed before people enter a camera's field of view, with more signs inside the area. They should name the organisation running the system, the purpose and a contact, unless it is obvious who is responsible.^[2][4] Signs should be more prominent where people are less likely to expect cameras.^[2]

What to add to your DPIA when AI watches the cameras

The ICO asks operators to document any use of algorithms, AI or machine learning, and to cover functions such as audio, live streaming and cloud storage in the DPIA.^[1]

For AI on existing CCTV, that usually means recording which detections run on which cameras, what triggers an alert, who receives it and what they see, and where video is processed and stored. Keep audio switched off unless you have an evidenced need, as the ICO recommends.^[2] If any camera covers work areas, consult staff during the DPIA, target cameras at areas of particular risk and avoid continuous monitoring of individuals.^[2][8]

Positioning cameras and detection zones

Where a camera points matters as much as what software runs on it. The ICO checklist asks you to position cameras so they avoid capturing private land or people who are not visiting your premises.^[4]

AI detection zones help you stay focused on the area of risk, such as a stockpile, a skip or a closed gate, rather than the street outside. This is a real night view from an existing camera of an empty storage yard; select each point to see what to check.

Footage requests, sharing and complaints

Anyone captured on your cameras can ask for a copy of footage of themselves. You must respond within one month, extendable by two further months if the request is complex, and there is normally no fee.^[3]

Make sure footage covered by a request is not deleted by your normal retention cycle while you deal with it, and redact other people where needed.^[3] Disclosure to the police is usually appropriate where it matches your purpose, such as investigating a crime, but treat other requests with care. Disclosing footage knowingly or recklessly without the controller's consent can be an offence under section 170 of the DPA 2018.^[3]

Since 19 June 2026, when section 103 of the Data (Use and Access) Act came into force, every organisation must also have a process for data protection complaints, acknowledge them within 30 days and tell people the outcome without undue delay.^[6][9] AI alert clips, downloaded as MP4 files from the app, make it quicker to find the right footage.

Running a site after hours? The out-of-hours site security checklist covers the physical side, from gates to keyholders, and intrusion detection explains how people and vehicle alerts work.

AI CCTV GDPR checklist

Tick off each item for your site. Progress is saved in this browser only. This checklist summarises the ICO guidance above; it is not legal advice.

• Named person responsible for the CCTV and AI alerts
• Purpose written down for each camera group
• Lawful basis chosen and legitimate interests assessment recorded
• DPIA completed, including the AI analysis
• Staff consulted on any cameras covering work areas
• Cameras positioned to avoid neighbouring land and private areas
• Signs up before and inside each covered area
• Audio switched off unless there is a justified need
• Retention period set to the shortest that works
• Access to footage and alerts limited to named people
• Process ready for footage requests and complaints
• Article 30 records kept and ICO fee paid, unless exempt

0 of 12 done

Sources

This guide is general information, not legal advice. ICO guidance is being updated after the Data (Use and Access) Act 2025, so check the current versions.

1. ICO, Video surveillance guidance: what are our responsibilities in terms of accountability?. Lawful basis under Article 6 (likely legitimate interests), Article 9 conditions for biometric data such as facial recognition, DPIAs, Article 30 records, joint controllers and written contracts with processors. Last checked 23 October 2026.
2. ICO, Video surveillance guidance: how can we comply with the data protection principles?. Signs and transparency, retention based on purpose, audio recording, workplace use and security, including cloud storage. Last checked 23 October 2026.
3. ICO, Video surveillance guidance: governance (post-deployment). Requests for footage, the one-month response time, redaction, disclosure to third parties and the section 170 DPA 2018 offence. Last checked 23 October 2026.
4. ICO, Checklist for limited CCTV systems. A one-page checklist for small business CCTV: named responsible person, lawful basis, positioning, signs, storage and requests. Last checked 23 October 2026.
5. ICO, Data protection fee. Organisations, including sole traders, that use personal information need to pay a data protection fee unless they are exempt. Last checked 23 October 2026.
6. ICO, How to deal with data protection complaints. Published 12 February 2026: you must have a process for handling data protection complaints and acknowledge them within 30 days. Last checked 23 October 2026.
7. ICO, Data (Use and Access) Act 2025. The Act received Royal Assent on 19 June 2025. The ICO says its video surveillance guidance is under review because of the changes. Last checked 23 October 2026.
8. ICO, Employment practices and data protection: monitoring workers. ICO guidance for employers on monitoring staff, including by video. Also under review because of the Data (Use and Access) Act. Last checked 23 October 2026.
9. legislation.gov.uk, The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026 (SI 2026/82), regulation 3. Section 103 of the Act (complaints by data subjects) came into force on 19 June 2026, so far as not already in force. Last checked 23 October 2026.
10. GOV.UK, Amended Surveillance Camera Code of Practice. Relevant authorities in England and Wales, such as the police and local councils, must have regard to the code; other operators are encouraged to adopt it voluntarily. Last checked 23 October 2026.