CCTV is one of the most common things small businesses buy after something has gone wrong. Done well, it pays for itself. Done badly, it gives a false sense of security until the day you discover the footage you needed was never recorded.
What CCTV is good for
- Deterrence. Visible cameras and clear signs put off opportunistic theft and damage.
- Evidence. When something does happen, good footage helps the police, your insurer and you work out what took place.
- Insurance. Some insurers and landlords require CCTV, and it can strengthen a claim.
- Staff and visitor safety. Entrances, car parks and lone-working areas feel safer when they are covered.
- Peace of mind. Remote viewing lets you check the premises from your phone instead of driving over.
The data protection side
If a business’s cameras capture identifiable people, the footage is personal data under UK data protection law. That brings some straightforward obligations:
- Have a clear reason for recording, and point cameras only where that reason applies.
- Put up signs so people know recording is taking place, who is responsible, and how to contact you.
- Keep footage only as long as you need it, then let it be overwritten. Decide a retention period rather than leaving it at whatever the recorder defaults to.
- Restrict access to the system and keep it secure.
- Be ready for requests. People can ask for copies of footage of themselves, and you need to be able to find and provide it.
Avoid pointing cameras at places where people expect privacy, such as toilets, and be careful about recording neighbouring property or the public street more than you need to. The Information Commissioner’s Office publishes guidance and a checklist on CCTV.
The mistakes that make footage useless
- Cameras that see, but cannot identify. A wide view of a car park rarely shows a recognisable face. Entrances need cameras placed and set up for identification.
- Bad positioning against the light. A camera facing a bright doorway or window often records silhouettes.
- Storage that fills up or fails. Recorders can stop recording when a drive fails, and nobody notices until they need the footage.
- The wrong date and time. Footage with an incorrect clock is much harder to rely on as evidence.
- Default passwords. Recorders left on their factory password, and exposed to the internet, are a well-known security risk.
- No one knows how to export it. Practise getting a clip off the system before you are under pressure to do it.
Getting it right
Start with a survey: where do people come in, what needs protecting, and what do you need to be able to identify? Specify the system to that, set retention and access deliberately, and check it regularly.
Because we are an IT and cyber security company, we also secure the recorder and its remote access properly — something often missed when CCTV is installed on its own.