GDPR and CCTV in an office

How to Ensure Your Workplace CCTV is GDPR Compliant

The General Data Protection Regulation (GDPR) was passed by EU government on May 25, 2018. Designed to modernise the way personal data is processed, the act has put into place tighter regulations on how personal data is acquired and processed.

The official description on the GDPR website is “to “harmonise” data privacy laws across Europe as well as give greater protection and rights to individuals.”

Before GDPR, thanks to rapid technological advancements, previous data protection laws were outdated. Passed in the 1990s the stipulations no-longer protected the way data was handled. Under GDPR, rules around data protection are more in line with modern technology and data processing methods.

This has therefore impacted many areas of how businesses store and protect employee data. A key element is CCTV and how employers use filming to monitor staff.

Here’s everything you need to know…

Why do businesses use CCTV for staff surveillance?

Businesses require CCTV staff surveillance for many reasons. Staff safety is often a key driver for this, especially in hazardous jobs or potentially dangerous areas. This also ties into health and safety, another key reason for installing workplace CCTV. Most businesses want to see that their set regulations are being upheld by staff, especially in the case of an accident where the business may otherwise be at fault.

Staff surveillance is also installed to protect business interests. Employee fraud, theft or misconduct can be prevented by the presence of CCTV. It can also help productivity by showing tasks that employees struggle with, helping to refine the training they are provided with.

Under GDPR is it still ok to monitor staff using CCTV?

The short answer is yes, but businesses must comply with the following to prevent the risk of any legal action:


Firstly, businesses must tell people that they are being recorded. This can be done by displaying clear signs which are visible throughout the areas where cameras are recording.

It is important to also inform the Information Commissioner’s Office (ICO) on the reason for the CCTV.

The CCTV system must also be fully controlled and restricted to the set individuals who need access. Footage should not be shared elsewhere, however, if an employee requests to see images of themselves recorded by your CCTV, you must provide them within 40 days.

It is also key that the CCTV you install is only used for the purpose it was set up for. For example, if it was installed for staff safety in hazardous areas, it can’t then be used to monitor staff lunch breaks.

The Human Rights Act 1998

This act stipulates that employees have a right to privacy so filming must not take place in any areas deemed to be intrusive. This could include toilets or changing rooms.


There are very few exceptions to the above, generally where serious misconduct or criminal activity is suspected. Covert filming should be approved by management and only for the purpose of watching the suspected individual. The rights of others not involved in any misconduct should be seriously considered.

How can businesses ensure their CCTV systems are legal?

1. Start with a written policy

Here businesses can fully disclose to staff where cameras are and what exactly they are used for. Employers should stipulate the reasons for monitoring clearly in this policy and be sure to follow them as if they are used for any other purpose, staff can take legal action.

Ensure that the policy is readily available should a member of staff wish to see it. Often, it is advisable to share the policy with employees and ask them to sign as proof they are aware of filming.

2. Have an open conversation with staff about the cameras

Open conversations should be encouraged as businesses don’t want the cameras to become an area of discontent. Businesses need to be open with staff about why they are recording and answer any questions honestly.

3. Ensure data is handled legally

Under GDPR, data must be handled, processed and stored securely. Police recommend that data should be held no longer than 31 days unless it’s necessary.

To sum up

CCTV can solve many problems for businesses. Helping to keep staff safe, protect business interests and ensure evidence of any misconduct or crime is readily available.

However, it is essential now that regulations around workplace filming set out by GDPR are strictly followed. This helps protect both staff rights and employers from any fines.

Find out more about our business CCTV systems. If you’d like to learn more about how CCTV can benefit your business, get in touch with a member of our team and we’ll be happy to help.

Give us a call on: 01 691 7100 for Ireland or 028 676 1183 for the UK

[You may also like this resource on CCTV and GDPR]

Leave a Reply

Your email address will not be published. Required fields are marked *