CCTV Guidance

Taken from an email shared to the business on 10/9/25.

_____________________________________________________________

Dear Team,

As part of our commitment to data protection and workplace privacy, we’ve updated our CCTV Guidelines to ensure full compliance with the UK General Data Protection Regulation (UK GDPR).

Please take the time to review the key points below and share with anyone in your team who uses or is involved with CCTV or who you think should be aware of the information below.

CCTV Usage – Key Guidelines

• CCTV must record images only; audio recording is not permitted.
• Cameras must only capture areas within Story Homes property. They must not record neighbouring properties, public spaces, or any location where individuals have a reasonable expectation of privacy.
• Where necessary, masking or blackout features should be used to limit the field of view and prevent inadvertent recording of areas outside the intended scope.
• All cameras must be clearly visible, with signage displayed to inform individuals of surveillance.
• Systems must be regularly maintained, and footage should be overwritten on a scheduled cycle.
• Access to footage is restricted to authorised personnel only, and systems must be password protected.
• Viewing of footage should only take place where there is a reasonable case to do so and must be carried out in a secure location where it cannot be overlooked by others or recorded itself.
• CCTV footage must be treated as personal data and only shared with appropriate individuals, in a secure manner, and in accordance with GDPR and our internal policies.

Video Doorbells – Not a Replacement for CCTV

Video doorbells must not be used as a substitute for CCTV in any workplace setting. These devices do not meet GDPR compliance standards due to:

• Audio recording capabilities, which are more intrusive and harder to justify.
• Cloud-based storage often hosted by third parties, outside our control.
• Lack of appropriate signage, access controls, and data retention policies.

If a video doorbell is in use purely as a communication device (for example, to speak with visitors), it must be used for live streaming only. It must not be connected to a subscription or service that records or stores audio or video.

Approved CCTV Solutions

All CCTV installations must be provided by a specialist partner who understands their responsibilities under UK GDPR. These partners are already in place through existing contracts managed by the Commercial teams. This ensures proper system configuration, secure data handling, and full legal compliance.

If you have any questions or need support with CCTV-related matters, please contact me and I'll be happy to support with this topic.

Thank you for your attention and cooperation.