The Sign Nobody Reads: Getting Your CCTV Paperwork Straight Before Anyone Asks

Most CCTV systems go up in an afternoon and then get ignored for years. The bracket is level, the app works, there's a small green light doing its thing in the corner of the ceiling. Job done.

Then someone knocks on the door — a neighbour, a customer, a police officer, or an email that opens with the words 'under the Data Protection Act' — and you realise the bit you skipped is the bit everyone else cares about.

In the UK, a camera that records identifiable people is a data protection matter the moment it looks beyond your own private property. The good news is that doing this properly for a house or a small shop is not a legal project. It's a sign, a one-page policy and a habit of answering emails. Here's what each of those actually looks like.

What the law expects, in one paragraph

CCTV footage of identifiable people counts as personal data, so it lives under the UK GDPR and the Data Protection Act 2018, with the ICO's CCTV code of practice as the practical handbook. The household exemption is much narrower than most people assume: it covers genuinely personal and domestic use, and it starts to fall away as soon as your lens picks up a shared driveway, a pavement, a neighbour's garden or a paying customer. If you run a business, you're a data controller, and most small firms also owe the ICO an annual data protection fee unless an exemption applies — there's a short self-assessment on the ICO's own site, so check rather than guess.

That's the theory. In practice, three things do most of the work: telling people you're filming, not keeping footage longer than you need, and being able to answer someone who asks for their own images.

The sign: three questions it has to answer

A CCTV warning sticker is not decoration. Anyone walking past your camera should be able to work out, from the sign alone, three things:

• Who is responsible. A business name, or 'the owner of 14 Elm Road' if it's a home system.
• Why you're recording. 'For the prevention and detection of crime and the security of the premises' is the standard, and it's standard because it's clear.
• How to get in touch. A phone number or, better, an email address like [email protected] that someone actually monitors.

That's it. You don't need a laminated essay. Something close to this works:

CCTV is in operation on these premises. Recorded by [business or householder name] for the purposes of crime prevention and site security. For information about this system, or to request footage of yourself, contact [email / phone].

If your system records audio, say so. If your cameras are watched live rather than just recorded, that's worth mentioning too. Both change what people would reasonably expect.

Where the sign goes — and where it doesn't work

The point of a notice is that it's seen before the recording happens, or at least at the same moment. In a shop, that means by the door, at eye level, on the customer side of the glass. On a house, it means by the gate or on the front wall next to the doorbell, not tucked under the gutter at head height for a giraffe.

Three placements that quietly fail:

• A sticker inside the shop window facing out, six inches off the floor, behind a display of greetings cards.
• A notice at the back of a car park that people only reach after two cameras have already filmed them.
• A single A4 printout on the inside of a fire door that's permanently wedged open.

If you have a camera that covers a shared access road, a communal bin store or a neighbour's boundary, the sign goes on your side but should be visible to anyone using that space. This is also the point at which a friendly word with the neighbour is worth more than any legal wording.

How long should you keep footage?

Long enough to do the job, and not a day longer. For most homes and small shops, somewhere between 14 and 31 days is defensible: it covers 'I only noticed the damage at the weekend' and it covers a police request that arrives a fortnight late.

What isn't defensible is keeping everything forever because storage is cheap. 'It might come in useful' is not a retention policy — it's a liability with a hard drive attached.

Practically:

1. Set the recorder to overwrite automatically at a defined number of days.
2. Write that number down, with a one-line reason, in a document you could find again.
3. Don't extend retention on a whim for one camera. If you genuinely need 90 days for the till, justify it and note it.
4. Delete exports once they're no longer needed. A folder called 'clips' on the office PC with three years of incident footage is the same problem in a different place.

Subject access requests without the panic

Someone filmed by your camera can ask to see the footage of themselves. That's a subject access request, and it sounds more intimidating than it is.

The headlines: you normally have one month to respond, you can't charge a fee in most cases, you shouldn't ask why they want it, and you're allowed to blur out other people caught in the same frame — the neighbour reversing off their drive, a member of staff on their break, a child walking past. If the footage has already been overwritten because your retention period did its job, that's a perfectly good answer, provided the retention period was real and not invented after the fact.

Keep a short log: date received, date responded, what you provided, what you redacted. Two lines per request. It takes seconds and it's the difference between 'we handle these properly' and a shrug.

The neighbour problem, defused early

Almost every domestic CCTV dispute in the UK follows the same script: camera covers a bit of next door's garden, nobody mentioned it, resentment builds, and eventually a complaint goes somewhere official. A visible sign and a working contact address short-circuit most of that. People rarely object to being filmed; they object to being filmed secretly and having no route to ask about it.

A six-item checklist

• A sign at every entrance, legible from standing height, naming the operator, the purpose and a contact.
• A one-page policy on file: what you record, why, how long you keep it, who can view it.
• Automatic overwrite set and confirmed — not left on the factory default of 'until the disk fills'.
• Clocks synced across every camera, so a timestamp means something.
• A monitored inbox or phone number that matches the sign.
• A log of requests and exports, however scrappy.

None of this makes your cameras catch more crime. What it does is stop a straightforward security setup turning into a data protection headache — and that's a return worth an hour and a printer.