Can UK Businesses Share CCTV Footage? 2026 Guide

Key takeaway

A UK business can share relevant CCTV with the police, selected staff and a properly governed business crime partnership. Share only what is needed, use a secure transfer method and keep a record. Publicly posting images of suspected offenders is unlikely to be justified. If staff alerts contain suspected criminal activity, the business may also need a DPIA and an appropriate policy document.

Yes. A UK business can share CCTV footage to prevent or investigate crime, including with the police, selected staff and properly governed business crime partnerships. The business must limit the sharing to what is necessary, send it securely and keep a record of what was shared and why.

There is an important limit: the ICO's July 2026 guidance says publicly posting images of suspected offenders on social media is unlikely to be justified. A private staff alert or police evidence upload is very different from publishing a face to an unlimited audience.

What changed in July 2026?

The ICO published new advice on 3 July 2026 for small businesses using personal information to tackle theft, abuse and violence. It was written with retailers in mind, but the principles apply more widely to businesses that use CCTV to protect staff, customers and premises.

The starting point is permission, not prohibition. Data protection law does not prevent a proportionate response to crime. It sets conditions for collecting, using and sharing footage without creating a second problem through inaccurate or uncontrolled disclosure.

Can a business give CCTV footage to the police?

Yes. The ICO says a business can share footage with the police to help investigate an incident. For a police handover, keep it simple:

1. Export only what is relevant. A short clip covering the incident is usually more appropriate than a full day of footage.
2. Use the police force's secure upload route. Avoid personal email, consumer file-sharing links or messaging apps.
3. Record the disclosure. Note the date, recipient, incident reference, footage period and reason for sharing.
4. Preserve the original. Keep it under the normal retention policy unless the police ask for it to be held longer for the investigation.

A request from the police does not mean every camera or every hour of footage should be supplied. Ask what period and view they need, then provide a clean export with the correct time and date.

Can CCTV images be shared with staff?

Yes, where the alert is necessary and fair. A business can warn relevant colleagues about a person who presents a known risk, such as someone who has been violent or aggressive at the premises.

The alert should stay within the group that needs it. Use a clear still image, describe the known facts and explain what staff should do if the person returns. Crop or blur unrelated people. Add a review date so the alert is removed when it is no longer needed.

Suspected criminal activity is criminal offence data. If a business is creating and circulating staff alerts of this kind, the ICO says it is likely to need a data protection impact assessment. An appropriate policy document is also required when using criminal offence data under the relevant conditions. The documents should explain the purpose, lawful basis, access controls, retention and review process.

Can neighbouring businesses share suspect images?

They can, but an informal group chat is a poor way to do it. The ICO recommends using a regional or local business crime reduction partnership where possible. A properly run partnership should have a data sharing agreement, secure access, defined purposes and rules on retention and rights requests.

Each member still needs to understand its role. Keep a record of images supplied, why they were relevant and when the alert should be reviewed. Do not assume that joining a scheme transfers every data protection responsibility to the partnership.

Can a business post suspected offenders on social media?

The ICO's answer is no. Public posting is unlikely to be a justifiable response because the business loses control of the image and how other people reuse it. There is also a real risk of identifying the wrong person or presenting an allegation as a proven fact.

Safer routes are a police report, a controlled staff alert or a governed business crime partnership. A poster visible only to security staff is different from a notice in a shop window where every customer can see it.

What should happen after a CCTV incident?

1. Write down the incident time, location and camera views before normal retention deletes the footage.
2. Protect the original recording and create a working copy for export.
3. Check that the timestamp is accurate and that the clip shows the full relevant sequence.
4. Remove footage that is not needed and redact unrelated people where appropriate.
5. Use a secure transfer method and confirm the intended recipient.
6. Log what was shared, who authorised it and any new retention date.
7. Review whether the camera angle, lighting or recording quality needs improvement.

ProtectUK's 2026 security toolkit tells businesses to review commercial CCTV coverage, blind spots and lighting. If an incident exposed a weak view or poor lighting, fix it while the details are still fresh.

What must a commercial CCTV system be able to do?

A camera count is not enough. If footage may need to support a police investigation or rights request, the recorder and software should make the following jobs practical:

• Search by an accurate time and date. Clocks should stay synchronised across cameras and recorders.
• Export a short clip in a usable format. The export should retain quality and include a suitable player where a proprietary format is unavoidable.
• Preserve the original. Staff should be able to protect relevant footage from routine overwrite without changing it.
• Control user access. Named accounts and role-based permissions are better than a shared administrator login.
• Keep an audit trail. The system should show who viewed, exported or changed footage where the platform supports this.
• Support redaction. The ICO expects businesses to be able to remove third-party information where necessary when responding to a subject access request.
• Use secure remote access. Avoid default passwords and unnecessary internet exposure. Apply supported firmware and software updates.

Put these requirements in the design brief and handover. Finding out that nobody can export a usable clip after a serious incident is far too late. FIDEC's commercial CCTV installation service in Manchester covers camera purpose, recording, remote access and user handover as part of the site survey and system design.

How long should CCTV footage be kept?

UK law does not set one retention period for every business CCTV system. Keep footage only as long as the documented purpose requires. The period should reflect the time it usually takes to discover and report an incident.

When a specific incident is under investigation, preserve that footage separately for as long as it is needed. Do not increase the retention period for every camera simply because one clip must be held. Review storage settings after cameras are added or recording quality changes, because those changes can shorten the actual number of days available.

What if someone asks for footage of themselves?

A person can make a subject access request for CCTV that contains their personal information. In most cases the business must respond within one calendar month. The system should allow staff to locate and extract the relevant material, then redact other people where needed.

This is separate from a police evidence request. A business should have a named person who can recognise the difference, find the footage before it is overwritten and decide what can be disclosed.

Do CCTV signs and policies still matter?

Yes. Businesses should tell people that CCTV is in use, explain why and provide a contact route for questions. The privacy notice and CCTV policy should match what the system actually does, including audio, analytics, remote viewing and sharing.

Recording audio is much harder to justify than recording images. A camera having a microphone does not mean it should be left on. The ICO advises businesses to consider whether audio is necessary and whether a less intrusive option can solve the problem.

A practical CCTV sharing checklist

• Is the footage necessary for a specific crime, safety or investigation purpose?
• Are the date, time and camera view accurate?
• Have unrelated footage and people been removed or redacted where needed?
• Is the recipient authorised and is the transfer method secure?
• Has the business recorded what was shared and why?
• Does the original need to be preserved beyond normal retention?
• If this is a staff or partnership alert, are the DPIA, lawful basis, criminal offence condition and appropriate policy document in place?
• Is there a review date for removing the alert?

Review the system before the next incident

Test a real export from each recorder. Check the timestamps, playback, image quality and user permissions. Confirm who can respond to a police request or subject access request, and make sure that person knows how to protect footage from overwrite.

FIDEC can survey, install, upgrade and maintain commercial CCTV systems across Greater Manchester and the North West. For sites with older or poorly documented equipment, a fire and security system takeover review can check recording, access, faults and maintenance alongside the wider security setup.

Questions people ask