Using CCTV to monitor security workers is lawful in the UK and in many environments it is essential. But it is not a free-for-all. Employers must follow UK GDPR, the Data Protection Act 2018 and related guidance, and they must balance safety and security against your fundamental right to privacy and dignity at work.
For security officers, this can feel like a double standard. You are expected to stand in front of a camera all day, yet the way that footage is used is rarely explained. This article sets out, in clear terms, when monitoring is lawful, what your employer must do to stay compliant, and what your rights are if CCTV is used to manage or discipline you.
The legal framework in a nutshell:
Several pieces of UK law and guidance govern CCTV in the workplace:
UK GDPR and the Data Protection Act 2018 – CCTV footage that identifies you is “personal data”. Employers are “controllers” and must have a lawful basis, be transparent, minimise data, and keep it secure.
The Information Commissioner’s Office (ICO) has specific guidance on CCTV/video systems and on monitoring workers, including expectations around impact assessments, proportionality, and transparency.
Surveillance Camera Code of Practice (Protection of Freedoms Act 2012).
For systems operating in public places in England and Wales, there is a statutory Code that sets out principles on necessity, proportionality and accountability. While aimed at “relevant authorities”, it is recognised as good practice more broadly.
Human Rights and workers’ rights guidance:
Article 8 of the European Convention on Human Rights (right to respect for private life) still informs how tribunals look at workplace monitoring, and government guidance makes clear that employers must not monitor in places like toilets or changing rooms.
On top of this, if a business runs CCTV, it will normally need to pay the ICO data protection fee and register its details (unless an exemption applies).
When CCTV monitoring of staff is allowed:
Using CCTV to monitor security workers is permitted when the employer can show that:
There is a clear, legitimate purpose, for example:
Protecting staff and the public from violence or abuse
Preventing and detecting crime or fraud
Ensuring the safety and integrity of high-risk sites
Investigating specific incidents or allegations
The monitoring is proportionate, the level and intrusiveness of monitoring must match the risk. Continuous high-definition video and audio aimed at a single individual, for example, is unlikely to be justified in most roles. The ICO has warned that continuous audio and video recording will be “highly intrusive” and rarely justifiable.
CCTV must be included in the employer’s data protection documentation (e.g. records of processing, privacy notices, and, where required, Data Protection Impact Assessments).
Workers must know what is happening, except in rare, tightly-controlled covert investigations, staff should be informed that monitoring is taking place, why, and how footage may be used.
If any of these elements are missing, the employer risks breaching UK GDPR and undermining trust with staff.
Key requirements for employers:
Employers must be open with you about CCTV and any other form of monitoring.
Good practice means:
Clear signage in monitored areas, stating that CCTV is in use, who operates it, and the main reasons.
A written CCTV / monitoring policy explaining:
What systems are used (fixed cameras, body-worn video, vehicle cameras, etc.)
The purposes of monitoring
Who can access footage and in what circumstances
How long recordings are kept
Information in employee handbooks, contracts or privacy notices so that staff see it when joining and can refer back to it.
Plain-English explanations, not buried in legal jargon or obscure corners of an intranet.
If you are being monitored and there is no sign, no policy and no explanation, the employer will struggle to show that the monitoring is fair and lawful.
Lawful basis and justification:
Under UK GDPR the employer must identify a lawful basis for processing CCTV footage. In most workplace scenarios this will be legitimate interests (protecting staff, assets and the public), supported by an impact assessment showing that staff privacy has been properly considered.
Key points for employers:
Monitoring must be necessary for the stated aim, not just convenient or “nice to have”.
If there are less intrusive alternatives, for example, better staffing, physical barriers, or targeted patrols, these should be considered.
Monitoring must not expand into “mission creep”: cameras installed for safety should not quietly become tools for micro-managing performance or attendance without consultation and policy changes.
Proportionality and avoiding intrusive monitoring:
Proportionality is at the heart of lawful CCTV use.
Employers should:
Avoid cameras in private areas such as toilets, changing rooms and prayer rooms. Government guidance is clear that workers must not be monitored everywhere.
Carefully consider audio recording, which is usually more intrusive than video alone.
Refrain from placing cameras solely focused on an individual workstation unless clearly justified (for example, a cashier position with a high fraud risk, and even then, impact assessments and safeguards are essential).
For control rooms and high-risk sites, document why intensive monitoring is necessary and how staff privacy is still respected.
For security workers, cameras will often be visible and obvious, that does not remove the obligation to justify how they are positioned and used.
Compliance and data security:
CCTV footage must be treated like any other sensitive personal data. That means:
Secure storage and access controls, passwords, role-based permissions; no open access to everyone on site.
Retention limits: Recordings should only be kept as long as necessary for the purposes they were collected for (e.g. 30 days, unless needed longer for a specific incident).
Controlled sharing: only people with a legitimate need should see the footage, such as HR in a disciplinary case, or police when investigating a crime.
Data sharing agreements where third-party monitoring centres or client sites access or control the footage.
There should be regular audits of who accessed what and why.
If recordings leak, are misused, or are retained indefinitely “just in case”, the employer may be in breach of UK GDPR and vulnerable to regulatory action by the ICO.
Employee rights:
As a worker, you have several rights in relation to CCTV footage that identifies you:
Right to be informed: You should know about the monitoring, the purposes, the retention periods and who it is shared with (normally set out in a privacy notice).
Right of access (Subject Access Request): You can request copies of footage in which you appear, subject to certain exemptions and the need to protect other people’s rights.
Right to object: In some cases, you can object to processing based on legitimate interests (for example, if the monitoring is excessive or misused). The employer must consider your objection and justify continuing.
Right to fairness in disciplinary processes: If footage is used as evidence in a disciplinary investigation, you should be told, and it should be disclosed so you can respond.
The SIF Trade Union, can support members in exercising these rights where necessary.
Covert surveillance:
“Covert” monitoring – hiding cameras from staff – is only lawful in exceptional situations, for example:
There is a strong, evidence-based suspicion of serious misconduct or criminality (such as theft or fraud).
Informing staff would seriously prejudice the investigation.
The monitoring is targeted and time-limited, not open-ended spying on everyone.
Case law from the European Court of Human Rights (such as Lopez Ribalda and Others v Spain) has accepted that covert CCTV can be lawful where there is substantial theft, the surveillance is restricted in scope and duration, and the employer’s actions are proportionate.
However, even covert surveillance must still:
Be justified through a Data Protection Impact Assessment.
Be authorised at a senior level and documented.
Be reviewed and stopped once the investigation ends.
Routine, ongoing secret monitoring of security staff “just to see what they’re up to” would almost certainly be unlawful and could give rise to ICO complaints, employment tribunal claims, and serious industrial relations problems.
Particular issues for security workers:
Security workers are often more heavily monitored than other staff. Common scenarios include:
Extensive fixed CCTV across sites, including control rooms.
Body-worn video (BWV) on officers, especially in transport, retail and licensed premises.
Vehicle cameras and GPS tracking for patrol vehicles or mobile response units.
The ICO’s guidance on video surveillance covers all of these technologies and emphasises that the same UK GDPR rules apply, even when cameras are worn on uniforms or located in vehicles.
Employers should therefore:
Explain clearly when BWV must be activated, who can download and view footage, and how long it is kept.
Avoid using BWV as a tool for informal performance monitoring unless this has been openly consulted on and reflected in clear policies.
Recognise that constant “recording just in case” may be excessive if there is no live incident or risk at that time, particularly where audio is captured.
For SIF members, the key point is that being in a security role does not remove your rights. You are not “fair game” just because cameras are part of the job.
What SIF members can do if they’re concerned:
If you are worried about how CCTV is being used at your workplace:
Ask for the policy. Your employer should be able to provide a CCTV or monitoring policy and privacy notice.
Raise concerns in writing. Explain why you feel the monitoring is excessive, unfair or inconsistent with the stated purpose.
Use your rights. Consider a Subject Access Request if footage has been used about you; ask for clarification if recordings are being used in disciplinaries without prior notice.
Contact SIF, as your trade union, SIF can:
Review policies and practices against UK GDPR and employment law
Raise collective concerns with employers
Support you through grievances, disciplinaries or ICO complaints where appropriate.
CCTV is a vital tool in modern security work, but it comes with serious responsibilities. Lawful monitoring is transparent, justified and proportionate. It protects workers as well as the public. When employers cross the line into intrusive or covert surveillance without proper safeguards, they not only risk breaching UK GDPR – they damage trust with the very security professionals they rely on.
SIF will continue to challenge poor practice, promote lawful and respectful monitoring, and make sure that security workers’ rights are at the centre of any conversation about surveillance at work.
