CCTV at work: what employers need before cameras go in

Same camera, three different hurdles

A client wants cameras over the shop floor, the warehouse or the workshop. If staff can appear in shot, data protection law is only half the job. Employment rules apply too, and they differ sharply between the three countries we cover.

Country	Before installing	Where cameras are ruled out	What a mistake can cost
UK	Be able to justify the monitoring. Tell staff it is happening and why	Not everywhere: GOV.UK gives the toilet as an example	Employment tribunal, complaint to the regulator, fine
Italy	Collective agreement with workplace union representatives. Failing that, labour inspectorate authorisation	Article 4 lists no banned locations	Criminal fine or 15 days to one year’s detention. Data protection fine
Spain	Tell workers and, where they exist, their representatives beforehand	Changing rooms, toilets, canteens and similar	Infringement of the data protection act: failing to inform is listed among the very serious

UK: justify it, tell people, stick to the purpose

There is no application to make and no union sign-off in the government guidance we read. What GOV.UK asks of employers is shorter, and it is mostly about being open.

Justify. The page on monitoring staff opens with the test: you must be able to justify monitoring staff at work. CCTV is the first example on its list, next to phone records, email logging and searches.

Tell staff. Employers must make staff aware that they are being monitored, and why. GOV.UK suggests an email as one way to do it. The companion page written for workers goes further: the amount of monitoring must be explained clearly in the staff handbook or contract.

Register. A business that uses CCTV must register with the Information Commissioner’s Office (ICO) and pay the data protection fee, unless it is exempt.

Signs and access. People must be told they may be recorded, usually by signs that are clearly visible and readable. The business must control who can see the recordings.

Purpose. The system is only to be used for what it was set up to do. GOV.UK’s example: a system put in to detect crime must not be used to monitor how much work staff do.

Not everywhere. Employers are not allowed to monitor workers everywhere. The example given is the toilet, with a warning that ignoring this could breach the Data Protection Act.

Behind those pages sit the UK GDPR principles. Personal data must be processed lawfully, fairly and transparently, and be limited to what is necessary for the purpose.

Covert cameras

GOV.UK says an employer can monitor staff without their knowledge if it suspects they are breaking the law and telling them would make the crime hard to detect. It should only be done as part of a specific investigation, and stop when the investigation is over.

For an installer, that means a hidden camera is a short job with an end date, tied to an investigation the client can describe. It is not a permanent feature of the system.

What goes wrong

GOV.UK names two routes for staff who feel unfairly treated: an employment tribunal, and a complaint to the Information Commissioner. A worker unhappy about monitoring that the handbook or contract does not allow might, as a last resort, resign and claim constructive dismissal.

On the data protection side, GOV.UK warns of a heavy fine or compensation for misuse of personal data. The statutory ceiling for breaching the processing principles is £17,500,000 or, for an undertaking, 4% of total worldwide annual turnover, whichever is higher. That is the legal maximum. We have not read any penalty decisions on workplace cameras.

One caveat. GOV.UK points to the ICO for detail, and the ICO website could not be read for this piece. Nothing here is taken from ICO guidance. Check it directly before writing a client policy.

Retention periods are covered in our piece on how long to keep CCTV footage.

Italy: no agreement or authorisation, no cameras

Anyone installing for a client with Italian premises meets a step that has no UK equivalent. Article 4 of the Workers’ Statute covers audiovisual systems that also create the possibility of monitoring workers remotely. They may be used for three purposes only: organisational and production needs, safety at work, and protecting company assets.

Before installation the employer needs one of two things.

1. A collective agreement with the workplace union representatives. Companies with sites in more than one province or region can sign with the most representative national unions instead.
2. An authorisation from the Ispettorato nazionale del lavoro, the national labour inspectorate, where there is no agreement. The inspectorate says an application is possible only if the company has no union representatives or the talks failed. In the second case proof of the failed agreement must be attached.

The application is made by the company’s legal representative, before the system is installed, on a dedicated form for cameras (INL 1). If it is delivered by hand or by post, two revenue stamps of €16 each are required. The decision comes back by certified email. The inspectorate’s page gives no processing time.

Skipping the step is a criminal matter: a fine or detention from 15 days to one year. The statute still states the fine in lire, and we have not verified the amount applied today.

The data protection authority, the Garante, treats the Article 4 procedure as a condition for lawful processing. Having the authorisation is not enough if the system runs differently. In February 2026 it fined a restaurant €2,000. The authorisation ruled out remote viewing and capped retention at 24 hours. The owner watched the cameras on a phone app and kept ten days of footage. The fine also covered signs that named neither the controller nor the purpose, and outdoor cameras filming a public area without proven need.

Spain: prior notice, banned areas, tight limits on audio

As in the UK, the Spanish law we read sets out no authorisation step. Article 89 of the data protection act (LOPDGDD) lets employers use camera images for the control functions in Article 20.3 of the Spanish Workers’ Statute (Estatuto de los Trabajadores), provided they inform workers beforehand, expressly, clearly and concisely. Where workers have representatives, they are informed too. The Spanish regulator, the AEPD, says consent is not required: the legal basis is the employment contract.

The act then sets limits that are written into the law itself.

• Banned areas. No video surveillance and no sound recording in places meant for rest or leisure. The act names changing rooms, toilets and canteens.
• Audio. Recording sound in the workplace is allowed only where the activity creates relevant risks to the security of premises, property and people, and subject to proportionality.
• Caught in the act. If a camera records a worker plainly committing an unlawful act, the duty to inform counts as met when at least the standard surveillance sign was in place.

The AEPD’s guide on employment, updated in December 2025, adds that cameras should be used only where no less intrusive means exists, that their number should be kept to what is needed, and that pairing them with facial recognition makes the monitoring disproportionate.

Before the first camera goes up

• Ask the client whether anyone works in the areas to be covered.
• In the UK, get the purpose of the system in writing and design to it. Do not add views that only make sense for watching performance.
• Check that the client has told staff and that the handbook or contract covers monitoring.
• Keep toilets out of shot. In Spain, changing rooms and canteens as well.
• Check signage is visible and readable, and restrict who can view recordings.
• Leave audio off on Spanish sites unless the client can point to a relevant security risk.
• In Italy, ask for a copy of the union agreement or the inspectorate’s authorisation before installing, and configure remote access and retention exactly as it says.
• Record what was configured and why in the handover file.