Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
Footage of identifiable people is personal data, so any business that runs CCTV, a video doorbell, body-worn cameras or dashcams is a data controller under the UK GDPR and the Data Protection Act 2018. That means you need a lawful basis (usually legitimate interests, supported by a documented assessment), clear signage and privacy information under Article 13, a sensible retention period, secure storage, and a process for handling subject access requests for footage. Businesses using CCTV must also pay the ICO data protection fee, and the ICO can issue fines of up to £17.5 million or 4% of global turnover for serious breaches.
Cameras are one of the most common sources of data protection complaints against small businesses, particularly where they cover staff areas, toilets, car parks shared with neighbours or public pavements, or record audio. Public bodies and others covered by section 33 of the Protection of Freedoms Act 2012 must follow the Surveillance Camera Code of Practice, and the ICO’s video surveillance guidance expects every business to be able to show why cameras are necessary, proportionate and regularly reviewed. Adding facial recognition or analytics raises the bar further and usually requires a Data Protection Impact Assessment.
