CCTV signage requirements in the UK
In this article, we look at compliance issues surrounding CCTV signage, how regulations apply to commercial and domestic CCTV operators, and how signs should be installed to benefit your business and those being recorded.
CCTV signage is necessary for transparency
Transparency is a core component of laws and regulations in the UK.
The ICO explains transparency in its accountability guidance:
Transparency is a key data protection principle which is fundamental to a ‘data protection by design and by default’ approach. It facilitates the exercise of individuals’ rights and gives people greater control. Being open and honest about what you do with personal data will support contracting and data sharing with third parties.
In short, if you are collecting people’s personal data – which includes recording them – you must inform them that you are doing so.
In the UK it is essential that you have signs in place that are prominent and absolutely clear to indicate that CCTV recording is taking place.
What should CCTV signage communicate?
Beyond communicating the simple fact that CCTV is in operation, there is more information that should be readily available to the public and/or to staff.
CCTV signs should let people know:
Why CCTV is in operation
Who is operating the CCTV system
How CCTV data will be used
How CCTV footage will be stored
How long CCTV footage will be kept
Who to contact (Data Protection Officer) and how to initiate a subject access request
The amount of detail that needs to be communicated to the people whose images are captured on your CCTV cameras is substantial. There is too much information to fit on a sign or even several signs.
Therefore, people should be directed in your CCTV signage to where they can find support information such as your Privacy policy.
Signs should direct people to convenient locations where they can read more about your operational and privacy practices, as well as their access rights.
Signs should include details such as website details, and potentially a mailing address and phone number. Access can be made easier for people by the addition of QR codes.
CCTV signs are part of GDPR compliance
Images captured by CCTV are classified as personal data. If you store images captured on CCTV, you are considered the data ‘controller’ and the data ‘processor.’
CCTV operators (processors) and data controllers must register for a CCTV licence, or register with the ICO as a CCTV operator or controller. Commercial CCTV operators may also have to pay a data protection fee to the ICO.
Sign compliance requirements: commercial and domestic CCTV
Commercial CCTV operators generally record public spaces, busy commercial areas and car parks. Clear signs must always be in place to let people know that CCTV recording is taking place
The rules and guidelines for domestic CCTV use and signage requirements differ from commercial use.
If a privately operated CCTV system does not capture images beyond the private operator’s property boundary, for example, there is no need for GDPR compliance.
It is still advisable to have signs in place to inform people that their image could be captured on camera. If the purpose of the CCTV system is security, signs will also act as a deterrent.
If the domestic CCTV system captures image beyond the property boundary, signage must be in place. However, when CCTV is installed on private property, the signs do not have to state who is operating the system.
Recommended CCTV sign sizes: internal and external use
Firstly, CCTV signs should be placed prominently and readable.
You should plan the size of your signs according to how they will be seen by others. For example, in a shop, the sign does not have to be large. A4 is generally sufficient.
However, if a sign is expected to be read by drivers or people on the move, you should plan to install signs that are much bigger. A3 is a common size for external signs.
CCTV sign manufacturing materials
Do your best to ensure that CCTV signs are visible in all conditions, day and night, and bright and poor weather conditions. Consider whether lighting would help visibility
Also consider how long the signs are intended to last. If they are permanent CCTV signs, your choice of substrate will be significant, especially if it is an external sign exposed to the elements.
Signs can be manufactured in rigid plastic, aluminium, or placed in sign holders or light boxes.
How often should CCTV signs be replaced or updated?
CCTV signs should be replaced or updated under the following circumstances:
Physical wear and tear
Signs that have become faded, damaged or illegible owing to weather exposure or vandalism should be replaced promptly to ensure they remain visible and clear.Changes in CCTV system
If there are updates or changes to the CCTV system, such as new camera placements, upgraded technology or changes in the area being monitored, the signs should be updated to reflect these changes accurately.Legal or regulatory changes
If local laws or regulations regarding CCTV use or signage requirements change, the signs should be updated to comply with the new standards.Business or property changes
If the ownership or name of the business or property changes, signs should be updated to reflect the new ownership details if they are included on the sign.
It is good practice to review and assess the condition of CCTV signs annually to ensure that they are still effective and compliant with relevant regulations.
Can CCTV signs be customised to match a company's branding?
Yes, CCTV signs can be customised to match a company's branding. Customisation typically involves incorporating the elements such as company logo, brand colours, and fonts and typography, while the overall design of the sign can be tailored in line with the company’s brand.
Using elements of the company’s brand ensures consistency with the overall visual identity of the business.
However, it is important to ensure that the customisation does not compromise the clarity and visibility of the sign. The primary purpose of CCTV signs is to inform people that they are being recorded, which is a legal requirement in many areas.
The branding should not obscure the sign’s primary compliance function.
Legal consequences and penalties of CCTV signage non-compliance
Non-compliance with CCTV regulations can have serious consequences, both legally and financially. This can include civil claims from individuals whose privacy has been infringed, investigations by regulatory bodies, and potential criminal charges if the non-compliance involves serious breaches of the law. Legal actions can result in financial liabilities, damage to reputation and, potentially, closure of the organisation.
If you do not have the required CCTV signage in place, or if it is unclear, incomplete or misleading, you are failing to comply with the law. Also, private individuals and members of your staff can take legal action to seek compensation.
Importantly, inadequate CCTV signage could undermine your reasons for operating CCTV in the first place.
If CCTV signage is inadequate any potential evidence your system records can be refused in court of law, because you have contravened GDPR.
The ICO, the UK’s data protection authority, has the power to impose financial penalties for breaches of the Data Protection Act relating to CCTV usage. Penalties depend on the severity of the breach and can be substantial, with fines as high as £17.5 million or 4% of the organisation’s global turnover, whichever is higher.
How long should CCTV footage be retained?
The length of time CCTV footage should be retained depends on factors such as legal requirements, industry standards and the specific needs of the organisation.
Data protection regulations such as GDPR in Europe specify that CCTV footage should only be retained for as long as necessary for the purpose for which it was collected. This typically ranges from a few days to a month unless a specific incident requires longer retention.
Industry CCTV retention standards vary. For example, retail and hospitality CCTV footage is generally retained for 30 days, as 30 days typically covers potential incidents like theft or disputes. However, financial Institutions may retain footage for 90 days or more owing to the potential for fraud or other crimes. Healthcare facilities generally retain footage for 30 to 90 days in order to balance privacy concerns with security needs.
7 to 30 Days are the most common CCTV retention periods. However, up to 90 days retention is common in higher-risk environments or industries with higher compliance requirements. In specific cases, such as ongoing investigations or for compliance purposes, CCTV footage may be retained for several months or even years.
If footage is required for legal proceedings or ongoing investigations, it should be retained until the matter is resolved, even if this exceeds the typical retention period.
Regularly reviewing and setting retention policies in line with these factors ensures that your CCTV system is both compliant and effective.
Facit and CCTV compliance
Facit specialises in CCTV privacy compliance. If you have concerns about privacy issues and CCTV signage requirements, complete our contact form for an informal discussion about your challenges.
