What does the law say about displaying security CCTV signs?
Many workplaces price up the cost of cameras and installation, then decide on it being affordable and compliant. But most UK organisations that fall foul of data protection law over CCTV aren't caught by the hardware, they're caught by getting CCTV warning signs for workplace surveillance all wrong.
What a compliant sign actually has to say
Security CCTV sits very much inside UK GDPR and the Data Protection Act 2018 once a camera captures an identifiable person. So in other words, pretty much every workplace camera, as they’re usually pointed at a door, till, entrance, and so on.
The transparency principle is what makes signage a legal requirement. It’s a common fallacy that CCTV warnings are a deterrent. Well, they might be that too, but that’s not why the sign is there. People have to know they're being recorded before they walk into range of a camera, not after, and they need to be able to find out more if they want to. That obligation sits with whoever operates the camera, not the installer who fitted it of course, which is why the paperwork side gets missed so often (nobody signs off on it the way they sign off on the equipment).
So it actually goes further than people think. In practice it’s not just a sign that just says "CCTV in operation" - that doesn't quite clear the bar on its own, even if it is prominently displayed. To be compliant it needs to communicate four things:
- Recording is taking place
- Who is operating the system
- Why it’s being operated (stated purpose), like crime prevention or staff safety or asset protection
- How to make contact if someone wants to ask a question or exercise a data right
Drop any one of the four and the sign is only doing half the job. In a subject access request or a complaint to the ICO, a sign missing one element is treated a bit like having no sign at all.
Local businesses already treat this as standard practice
This may not be news for businesses operating in the South West. When independent traders on Magdalen Road in Exeter were hit by a run of break-ins, like smashed windows, stolen stock, repeated burglaries, the CCTV system a local security firm installed wasn't just hardware bolted to a wall. It came with a signed, justified system that could double as a deterrent and as evidence handed to the police once an incident happened.
It’s the same reason to what’s pushing smaller organisations to formalise setups that started out more informal. Local providers report steady demand from schools and small businesses that want CCTV covering entrances, deliveries and car parks done properly, not added as an after in retrospect once something has already gone wrong.
A system installed properly versus one that simply has cameras on it is pretty much where signage sits. It's the cheapest element of any CCTV install and yet, perhaps for that very reason, the one most likely to be undervalued and treated as aesthetic.
Where the real exposure sits: Audio, and a regulator now hitting harder
Two gaps show up repeatedly when signage gets audited properly. The first is audio. Systems that pick up sound as well as image are held to a materially higher bar than image-only cameras. The ICO treats audio capture actually as more intrusive than video alone and expects it to be used only where there's a specific justification, like disclosed explicitly on the sign itself rather than left implied. A generic "CCTV in operation" notice doesn't quite cover a camera that's also recording conversation, and yet most installers won't bring that up unless someone asks directly. The microphone can be nearly invisible, embedded in the camera itself.
The second gap is assuming the financial exposure is theoretical. It isn't. The maximum penalty for a serious breach under UK GDPR (covers unlawful or non-transparent surveillance processing) is £17.5 million or 4% of an organisation's worldwide turnover.
It sounds over the top and more like a theoretically deterrent, but actually, 2025 was when ICO actually followed through. Full-year enforcement totalled roughly £19.6 million in just seven cases. £2.7 million spread across 18 fines the year before. A big jump in money collected from around a third of the enforcement actions. The single biggest case was a £14 million settlement with outsourcing firm Capita. It was the regulator's largest ever, down from a proposed £45 million after the company settled early. It fits a pattern the ICO has been explicit about: Fewer penalties, aimed squarely at organisations that got the basics wrong and were slow to fix them once flagged.
That’s not to say a missing word on a sign is going to lead to a seven-figure fine on its own. The scale of those cases is a different order of failure. But it shows the seriousness of the offence, as the regulator that receives CCTV signage complaints is the same one setting this record.
