UK GDPR, the Data Protection Act and the ICO
Video surveillance by companies in the UK falls under UK GDPR and the Data Protection Act 2018. The ICO's guidance on video surveillance covers CCTV and newer technologies, including analytics: be clear about the purpose, carry out a DPIA where the processing is likely to be high-risk (which it often is for systematic monitoring), keep retention short, be transparent with clear signage, and keep footage secure. Public authorities in England and Wales also follow the Surveillance Camera Code of Practice; for companies it is good practice.
This page is general information, not legal advice. The assessment for your site stays with your data protection officer and, where needed, your lawyer.
Monitoring workers
The ICO has published guidance on monitoring workers. Monitoring must be necessary, proportionate and transparent, workers must be told what is monitored and why, and continuous monitoring of individuals needs strong justification. There is no works council co-determination as in Germany, but consulting staff and their representatives is expected and makes the system easier to justify.
An event-based setup fits this well: alerts about events such as intrusion, fire or entry into danger zones, not monitoring of individuals.
Facial recognition needs particular care
Facial recognition processes biometric data, a special category under UK GDPR, and the ICO has set out high expectations for live facial recognition in public places. ProDataAI Lens does not recognise faces or identify people, which avoids this question entirely.
Does the EU AI Act apply?
Not to purely UK sites. It applies when the output of an AI system is used in the EU, for example when a UK company runs sites in the EU. The UK regulates AI through existing regulators such as the ICO rather than one AI law.
ProDataAI Lens at UK sites
ProDataAI Lens runs in an EU cloud environment, in your own cloud or on your premises. The UK treats the EU as adequate for data protection, so data from UK sites can be processed in the EU without extra transfer safeguards. Our data protection pack is written for German law and is adapted to UK GDPR by your adviser.
What a UK rollout looks like, from support to councils: ProDataAI Lens for UK businesses.
Frequently asked questions
Do we need a DPIA for AI CCTV in the UK?
Often. The ICO expects a DPIA where processing is likely to be high-risk, and systematic monitoring with analytics usually is.
How long can CCTV footage be kept in the UK?
No fixed period is set in law. Keep it only as long as the purpose requires, usually a short period, and document why.
Is facial recognition allowed on UK CCTV?
It is possible only in narrow circumstances with strong justification. ProDataAI Lens does not use facial recognition.
Does UK GDPR apply to business CCTV?
Yes, whenever cameras capture identifiable people. A business needs a lawful basis (usually legitimate interests), a clear purpose, signage, a retention period and, for analytics, usually a DPIA.
Can councils and public bodies add AI analytics to existing CCTV?
Technically yes, where the cameras provide standard IP streams. Local authorities in England and Wales must also have regard to the Surveillance Camera Code of Practice, and a DPIA is expected before analytics go live.