CCTV and workplace monitoring policy

How to use this

Fill in your actual purposes, camera locations and retention periods. If any camera uses facial recognition or other biometric analysis, the Biometric Processing Privacy Code applies as well; see our biometrics guide. Share the staff notice with everyone and keep a record that you did.

CCTV and workplace monitoring policy

[Organisation name] Owner: [role] Approved: [date] Review: [annually]

1. Purpose

We use cameras and monitor work systems only for these purposes:

• [security of premises and property]
• [safety of staff and visitors]
• [protecting confidential information and systems]
• [investigating specific incidents or suspected misconduct]

We won’t use them to track individual productivity or for any purpose not listed here without updating this policy and telling staff.

2. Cameras

• No cameras in toilets, changing rooms, staff break rooms, or anywhere people expect privacy.
• Cameras are positioned to avoid neighbouring properties and public spaces beyond what’s necessary.
• Signs at entrances tell people cameras are operating, who operates them and how to contact us.

3. Monitoring work systems

We may monitor [work email, internet use on our network, access to systems holding personal information, use of work devices] to protect security and investigate specific concerns. We don’t monitor personal accounts or personal devices.

Covert monitoring is used only in exceptional cases, to investigate suspected serious wrongdoing where notice would defeat the purpose, with approval from [CEO] and advice first.

4. Access

Only [roles] may view live or recorded footage or monitoring data. Access is logged. Footage is shared outside the organisation only where the law allows, for example with Police for a specific incident, and each disclosure is recorded.

5. Retention

Routine footage is kept for [30] days and then overwritten. Clips relating to an incident are kept until the matter is resolved. Monitoring logs are kept for [period].

6. Requests

People can ask for footage or information about themselves. Requests go to [privacy officer] and are handled under our access request procedure, taking care with other people who appear.

---

Staff notice

Cameras and monitoring at [organisation] We use cameras at [locations] and monitor [systems] for [purposes]. We don’t use cameras in private spaces, and we don’t monitor personal accounts or devices. Only [roles] can view footage or monitoring data. Footage is kept for [30] days unless needed for an incident. You can ask to see information about you by contacting [privacy officer]. The full policy is at [location].