Best security cameras for small business premises

UK GDPR basics for business CCTV

The ICO says an organisation using CCTV must register with it and pay the data protection fee, which for most small and medium businesses is £52 or £78 a year. Signs must make clear CCTV is in operation, why you use it and who to contact. If the use is likely to result in a high risk to people, you need a Data Protection Impact Assessment first.

You must not keep footage longer than you need it. Set a retention period, record it in your CCTV policy and delete footage when it is no longer needed. Keep footage secure with passwords and limited access. People can ask for copies of footage of themselves, so your system must let you find and redact recordings. The ICO says audio is hard to justify and, if recorded, people must be told.

• Pay the ICO fee and note the renewal date
• Name one person responsible for the system
• Document your lawful basis
• Put up clear signs
• Set and stick to a retention period

Cameras covering shared areas or the street

The ICO's guidance is to make sure cameras only capture what you need, angled so they do not record people passing outside or neighbouring private land. Its checklist for limited CCTV systems asks you to position cameras to avoid unintentional capture of private land.

In a block or HMO, cameras in shared hallways record tenants coming and going, so whoever operates the system, usually the landlord or managing agent, takes on the same duties. Use privacy masking where a camera's view includes a neighbour's garden or a public pavement.

Choosing kit that keeps footage secure

Since 29 April 2024, UK product security law bans universal and easily guessed default passwords on consumer connectable products, and requires manufacturers to publish how to report security issues and the minimum period they will provide security updates. The NCSC lists security cameras and smart doorbells among the products covered.

Check the stated update period before you buy, change any initial password, and keep firmware up to date. Local recording to a recorder or memory card avoids sending footage to a cloud service, but either way you must be able to retrieve, redact and delete clips.