{{org_field_logo}}

{{org_field_name}}

Registration Number: {{org_field_registration_no}}

---

Use of CCTV and Surveillance in Care Homes Policy

1. Purpose

This policy sets out how {{org_field_name}} will lawfully, fairly, transparently and proportionately use Closed-Circuit Television (CCTV), video surveillance, audio-enabled surveillance and other monitoring technologies within the care home.

Surveillance will only be used for a specified, legitimate and documented purpose and where the intended outcome cannot reasonably be achieved by a less intrusive means. Its use must respect the privacy, dignity, autonomy, safety and human rights of people who use the service, staff, visitors and other individuals who may be recorded.

Where surveillance is used to support a person’s care, treatment, safety or wellbeing, its use forms part of the regulated care service and must comply with the requirements applicable to that person’s care.

{{org_field_name}} will comply with all applicable legal and regulatory requirements, including:

• the Health and Social Care Act 2008;
• the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, including, where applicable:
  • Regulation 9 – Person-centred care;
  • Regulation 10 – Dignity and respect;
  • Regulation 11 – Need for consent;
  • Regulation 12 – Safe care and treatment;
  • Regulation 13 – Safeguarding service users from abuse and improper treatment; and
  • Regulation 17 – Good governance;
• the Data Protection Act 2018;
• the UK General Data Protection Regulation, as amended;
• the Data (Use and Access) Act 2025 insofar as it amends data protection law;
• the Mental Capacity Act 2005 and its Code of Practice where a person may lack capacity to make a relevant decision;
• the Human Rights Act 1998 where applicable;
• the Equality Act 2010 where applicable; and
• current Care Quality Commission and Information Commissioner’s Office requirements and guidance relevant to surveillance.

The Amended Surveillance Camera Code of Practice that came into effect in January 2022 will be taken into account where it is relevant. Where {{org_field_name}} falls within the definition of a relevant authority for the purposes of the Protection of Freedoms Act 2012, the statutory duty to have regard to that Code will apply. Otherwise, the Code will be treated as relevant guidance rather than as a statutory duty applying automatically to the care home.

CCTV or other surveillance must never be used as a substitute for sufficient staffing, appropriate care, supervision, safeguarding arrangements or proper risk management.

2. Scope

This policy applies to:

• All CCTV and other forms of surveillance used within the care home, including audio recording devices, motion sensors, and covert surveillance (only where legally justified).
• The people we support, staff, visitors, and contractors who may be recorded.
• The collection, processing, storage, and sharing of video footage.
• The lawful basis for using CCTV, including consent, security, and safeguarding concerns.

3. Related Policies

• CH04 – Good Governance Policy (Ensuring lawful and ethical use of surveillance).
• CH08 – Dignity and Respect Policy (Protecting the privacy and dignity of individuals).
• CH13 – Safeguarding Adults from Abuse and Improper Treatment Policy (Preventing abuse while ensuring fair surveillance practices).
• CH34 – Confidentiality and Data Protection (GDPR) Policy (Managing access to surveillance footage securely).
• CH35 – Duty of Candour Policy (Ensuring transparency when disclosing surveillance recordings related to incidents).
• CH42 – Communication and Engagement with Service Users and Families Policy (Ensuring informed consent and clear communication about CCTV use).

4. Legal and Regulatory Requirements

4.1 Necessity, Purpose and Proportionality

Before surveillance is introduced, {{org_field_name}} must identify and document the specific purpose for which it is proposed.

Surveillance must only be used where:

• the purpose is lawful and legitimate;
• there is an identified need for surveillance;
• surveillance is necessary and proportionate to that need;
• less intrusive alternatives have been considered;
• the surveillance is capable of achieving the identified purpose;
• no more personal information will be collected than is necessary; and
• the effect on the privacy, dignity and other rights of individuals has been assessed.

CCTV or other surveillance must not subsequently be used for an incompatible purpose unless that further processing is permitted by data protection law.

4.2 Lawful Basis for Processing Personal Data

Before any surveillance system that processes personal data is operated, {{org_field_name}} must identify and document an appropriate lawful basis under Article 6 of the UK GDPR.

Consent must not automatically be treated as the lawful basis for general CCTV or surveillance. The appropriate lawful basis must be determined according to the purpose and circumstances of the processing. Where legitimate interests is relied upon, {{org_field_name}} must be able to demonstrate that the processing is necessary for the identified legitimate interest and that the interests, rights and freedoms of the individuals being recorded do not override that interest.

Where a surveillance system actively processes special category personal data, {{org_field_name}} must also identify and document an applicable condition under Article 9 of the UK GDPR and any additional condition or safeguard required by the Data Protection Act 2018.

Where criminal offence data is processed, {{org_field_name}} must comply with Article 10 of the UK GDPR and the relevant provisions of the Data Protection Act 2018.

Any Appropriate Policy Document required by the Data Protection Act 2018 must be in place before the relevant processing takes place.

4.3 Data Protection Impact Assessment

A Data Protection Impact Assessment must be completed before surveillance begins where the proposed processing is likely to result in a high risk to the rights and freedoms of individuals.

The assessment must consider, as applicable:

• the purpose and necessity of the surveillance;
• the proportionality of the surveillance;
• the people who are likely to be recorded;
• the areas to be monitored;
• whether audio will be recorded;
• whether special category or criminal offence data may be processed;
• the reasonable expectations of people using or entering the care home;
• the impact on privacy, dignity and autonomy;
• alternatives that would involve less intrusion;
• access arrangements;
• security arrangements;
• retention and deletion arrangements;
• sharing and disclosure arrangements; and
• measures necessary to reduce identified risks.

The Data Protection Impact Assessment must be reviewed where there is a material change to the surveillance system, its purpose, its technology, the areas monitored or the nature of the information being processed.

Where a high residual risk remains that cannot be adequately mitigated, {{org_field_name}} must not commence the proposed processing until any legally required prior consultation with the Information Commissioner’s Office has taken place.

4.4 Transparency

Surveillance must normally be overt and transparent.

People who use the service, staff, visitors and others who may be recorded must be given appropriate privacy information explaining, as applicable:

• that surveillance is taking place;
• who is responsible for the surveillance;
• why surveillance is being used;
• the organisation’s contact details;
• how further privacy information can be obtained; and
• how individuals may exercise their information rights.

Clearly visible and readable signs must be positioned so that individuals can understand that surveillance is operating before, or as soon as reasonably practicable after, entering the monitored area.

4.5 Privacy and Dignity

The location, field of vision, times of operation and functionality of surveillance equipment must be restricted to what is necessary for the documented purpose.

Surveillance must be operated so as to minimise the recording of:

• intimate personal care;
• private conversations;
• clinical or personal information that is not relevant to the identified purpose;
• private religious observance;
• neighbouring properties or areas outside the care home’s control; and
• other activities in respect of which individuals have a particularly high expectation of privacy.

The more intrusive the proposed surveillance, the stronger and more clearly documented the justification must be.

4.6 Audio Recording

Audio recording is more intrusive than video-only surveillance and must not be routinely or continuously enabled merely because the surveillance equipment provides that functionality.

Audio recording must be switched off unless {{org_field_name}} has identified and documented a specific need that cannot reasonably be met through a less intrusive means.

Where audio recording is justified, individuals must be clearly informed that sound, as well as images, may be recorded.

4.7 Accountability and Records

{{org_field_name}} must maintain records sufficient to demonstrate compliance with its data protection and regulatory obligations, including where applicable:

• the purposes for surveillance;
• the lawful basis for processing;
• Data Protection Impact Assessments;
• legitimate interests assessments;
• consultation and decision-making records;
• surveillance locations and functions;
• retention arrangements;
• authorised access;
• disclosures and sharing;
• security incidents; and
• reviews of whether surveillance remains necessary and proportionate.

5. Justification for CCTV Use

CCTV is implemented for the following reasons:

• Enhancing security – Protecting people we support, staff, and visitors from crime or unauthorised entry.
• Safeguarding vulnerable individuals – Monitoring communal areas to help prevent abuse or neglect.
• Incident investigation – Supporting investigations into falls, accidents, or allegations of misconduct.
• Property protection – Preventing theft, vandalism, or damage to the premises.

CCTV must never be used as a substitute for quality care or supervision.

6. CCTV Placement and Usage

CCTV may only be installed or operated in a location where surveillance is necessary and proportionate to a documented legitimate purpose.

Subject to the required assessments, CCTV may be used in areas such as:

• entrances and exits for legitimate safety or security purposes;
• communal lounges, dining areas and corridors where justified;
• external areas and car parks where necessary for security or safety; and
• staff-only or restricted areas where there is a documented legitimate need and the impact on staff privacy has been properly assessed.

The location and viewing angle of every camera must be assessed so that it captures no more information than is necessary for its purpose.

Surveillance within a person’s bedroom or another area in which that person has a particularly high expectation of privacy must not be introduced merely for convenience, general reassurance or routine staff monitoring.

Where surveillance within a person’s private accommodation is being considered, {{org_field_name}} must, before it is introduced:

• identify a specific and compelling care, safety or safeguarding purpose;
• consider whether the purpose can be achieved through a less intrusive measure;
• complete any required Data Protection Impact Assessment;
• assess the impact upon the individual’s privacy, dignity and autonomy;
• establish the appropriate data protection lawful basis;
• establish whether the person has capacity to make the relevant decision;
• obtain the person’s valid consent where consent to the surveillance as part of their care is required and the person has capacity to give it; or
• where the person lacks relevant capacity, make and record the decision in accordance with the Mental Capacity Act 2005, including the applicable best interests decision-making process and consideration of the least restrictive option.

The rights and privacy of any roommate, staff member, visitor or other person who may also be recorded must be separately considered. One person’s consent or best interests decision does not remove the rights of another person who may be captured by the surveillance.

Cameras must not routinely record toilets, bathrooms, changing areas or the provision of intimate personal care.

Equipment must be positioned, configured or capable of being switched off, where necessary, to prevent or minimise recording during intimate care or other circumstances in which recording would create unjustified interference with privacy or dignity.

Any proposed surveillance of an exceptionally private area must be subject to specific legal and regulatory assessment before implementation and must not proceed unless {{org_field_name}} is satisfied that the processing is lawful, necessary and proportionate.

7. Consultation, Consent and Information

7.1 Consultation

Because surveillance may significantly affect people’s privacy, {{org_field_name}} must, wherever practicable, consult people whose privacy or rights are likely to be affected before introducing or materially changing surveillance.

Depending on the circumstances, consultation may include:

• people who use the service;
• relatives, representatives or advocates where appropriate;
• staff;
• recognised trade unions or employee representatives where applicable; and
• other people whose rights or privacy are likely to be materially affected.

Consultation must not be treated as a one-off exercise where continued surveillance has a significant impact on people. Concerns raised about privacy must be considered and the organisation’s response recorded.

7.2 Information Provided to People

People who use the service and, where appropriate, their representatives must be informed about surveillance that affects them.

Information must include, so far as applicable:

• where surveillance operates;
• the purpose of surveillance;
• whether images only or images and audio are recorded;
• who is responsible for the system;
• the organisation’s lawful basis for processing;
• how long recordings are normally retained;
• who may have access to recordings;
• circumstances in which recordings may be disclosed;
• how individuals can exercise their data protection rights; and
• how to raise a concern or complaint.

Appropriate information must also be provided to staff and visitors who may be recorded.

Clearly visible signage must be used for overt CCTV, but signage must not be relied upon as the only privacy information where further information is required by data protection law.

7.3 Consent to Care and Data Protection Lawful Basis

Consent to the use of surveillance as part of a person’s care or treatment and the lawful basis used by {{org_field_name}} to process personal data under the UK GDPR are separate legal matters and must not be treated as interchangeable.

Where surveillance constitutes care or treatment, the requirements of Regulation 11 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 must be followed.

Where the person has capacity to make the relevant decision, their decision must be respected.

Where there is reason to doubt the person’s capacity to make the particular decision about surveillance, capacity must be assessed in accordance with the Mental Capacity Act 2005.

A person must not be regarded as lacking capacity merely because they make a decision that others consider unwise.

Where the person lacks capacity to make the relevant decision, any decision to use surveillance as part of their care must be made in accordance with the Mental Capacity Act 2005, including:

• acting in the person’s best interests;
• consulting relevant people as required;
• taking account of the person’s past and present wishes, feelings, beliefs and values;
• considering whether the purpose can be achieved in a less restrictive way; and
• recording the decision and reasons for it.

A relative may not consent on behalf of an adult who lacks capacity merely because they are the person’s next of kin. Any authority exercised by an attorney or deputy must fall within the scope of that person’s lawful powers.

8. Access to CCTV Footage, Retention and Data Security

Access to live or recorded surveillance information must be restricted to personnel who are specifically authorised and who require access for a legitimate purpose connected with their role.

Authorisation arrangements must identify who may:

• view live footage;
• retrieve recorded footage;
• export or copy footage;
• disclose footage externally;
• alter system settings; and
• authorise deletion or preservation of footage.

Access credentials must not be shared.

Where appropriate to the risks presented by the system, {{org_field_name}} must maintain an access or disclosure record showing who accessed or disclosed footage, when this occurred and the reason for the access or disclosure.

Surveillance data must be protected by appropriate technical and organisational security measures designed to maintain its confidentiality, integrity and availability.

Measures must include, as appropriate:

• secure user authentication;
• access controls based upon job role;
• secure storage;
• encryption where appropriate to the risk;
• protection against unauthorised copying, alteration or deletion;
• secure backup arrangements where required;
• secure transmission arrangements;
• controls over removable media;
• secure disposal and permanent deletion; and
• appropriate security arrangements for any cloud-based or externally hosted surveillance system.

Retention

There is no automatic statutory CCTV retention period of 30 days.

{{org_field_name}} must determine and document the shortest retention period necessary to achieve each identified surveillance purpose.

Recordings must not be retained merely because storage capacity permits it or because they may conceivably be useful at some future date.

Recordings must be securely deleted when the documented retention period expires unless there is a lawful and documented reason for preserving particular footage for longer, for example:

• an ongoing safeguarding investigation;
• an accident or incident investigation;
• a complaint;
• a subject access request;
• actual or anticipated legal proceedings;
• a police or other lawful regulatory request; or
• another established legal requirement.

Where footage is preserved beyond its normal retention period, the reason must be recorded and the footage deleted when the additional purpose has ended unless there is a further lawful reason for retention.

Disclosure

CCTV footage must not be disclosed to another organisation or individual merely because they request it.

Before disclosure, {{org_field_name}} must establish and document an appropriate lawful basis or other legal authority for the disclosure and must consider the rights and information of other identifiable people shown in the footage.

Requests from the police, local authority safeguarding teams, CQC or other statutory bodies must be considered according to the legal power or lawful basis relied upon for the request. A request from a statutory body does not automatically remove {{org_field_name}}’s data protection responsibilities.

Where required by the Data Protection (Charges and Information) Regulations 2018, {{org_field_name}} must be registered with the Information Commissioner’s Office and pay the applicable data protection fee.

9. Surveillance and Safeguarding Investigations

CCTV or other lawfully obtained surveillance information may be used to support the investigation of an allegation or concern relating to abuse, neglect, improper treatment, unsafe care, theft, misconduct or another serious incident where its use is consistent with the purpose for which the information was collected or another lawful basis permits the further use.

Any safeguarding concern identified through surveillance must be responded to immediately in accordance with the organisation’s safeguarding procedures.

Where the incident meets the criteria for referral or notification to the local authority safeguarding team, police, Care Quality Commission or another statutory body, the Registered Manager must ensure that the required referral or notification is made without delay.

Covert Surveillance by the Provider

Covert surveillance means surveillance carried out without the knowledge of the individuals being monitored.

{{org_field_name}} must not use covert surveillance routinely.

Covert surveillance may only be considered in exceptional circumstances where there is a specific and pressing concern, the proposed surveillance is necessary and proportionate, and less intrusive means would not reasonably achieve the purpose.

Before the provider undertakes any covert surveillance, the Registered Manager and provider must:

• clearly document the specific concern and purpose;
• establish the applicable legal basis;
• obtain appropriate specialist legal advice where necessary;
• consider the privacy and human rights of every person likely to be recorded;
• complete a Data Protection Impact Assessment where required;
• consider any applicable employment law obligations where staff may be monitored;
• consider the Mental Capacity Act 2005 where the surveillance forms part of a person’s care and that person may lack capacity;
• limit the surveillance to the minimum area, duration and number of people necessary;
• establish strict access and security arrangements; and
• specify a date on which the surveillance will end or be formally reviewed.

The Regulation of Investigatory Powers Act 2000 provides a statutory framework for specified surveillance activities and authorisations by public authorities. It must not be presented as providing a private care provider with a general power or authorisation to conduct covert surveillance.

The Care Quality Commission does not authorise a provider to undertake covert intrusive surveillance.

Where a public authority is involved in or proposes surveillance under its statutory investigatory powers, that public authority is responsible for determining and obtaining any authorisation required under the legislation applicable to it.

Covert surveillance must cease as soon as its documented purpose has been achieved, the justification no longer exists, or continued surveillance is no longer necessary and proportionate.

10. Requests for CCTV Footage and Subject Access Requests

An individual has the right to request access to personal data about them contained in CCTV or other surveillance recordings, subject to the applicable provisions, exemptions and restrictions in data protection law.

A subject access request does not have to be made in writing.

A request may be made:

• verbally;
• in writing;
• electronically;
• through social media or another communication channel used by {{org_field_name}}; or
• by an authorised representative acting on the person’s behalf.

Staff must therefore recognise that a request may constitute a subject access request even where the individual does not use the words “subject access request”, “SAR”, “UK GDPR” or “data protection”.

Any member of staff receiving a request for access to CCTV personal data must promptly forward it to the person responsible for managing data protection requests.

{{org_field_name}} must respond to a valid subject access request without undue delay and, ordinarily, within one month in accordance with the applicable statutory time limit.

Where permitted by law, the response period may be extended by up to a further two months where necessary because the request is complex or the organisation has received a number of requests from the same person. Where the period is extended, the requester must be informed within the initial one-month period and told why the extension is necessary.

Where reasonably required to respond effectively, {{org_field_name}} may seek clarification about the personal information requested in accordance with the applicable data protection rules.

Where identity or the authority of a representative reasonably needs to be established, only information proportionate to that purpose must be requested.

{{org_field_name}} must make a reasonable and proportionate search for personal information falling within the scope of the request.

Where CCTV footage includes identifiable information about other individuals, {{org_field_name}} must consider the rights of those third parties before disclosure. This may require:

• redaction, masking or blurring of third parties;
• obtaining consent where appropriate; or
• determining whether it is reasonable to disclose the information without the third party’s consent in accordance with data protection law.

Footage must be supplied securely and in an intelligible and usable form where the requester is entitled to receive it.

Subject access requests will normally be handled without charge. A fee may only be charged where permitted by data protection law.

Requests for footage from the police, local authorities, solicitors, insurers, CQC or other third parties are not automatically subject access requests. They must be assessed separately and footage must only be disclosed where {{org_field_name}} has identified an appropriate lawful basis, legal obligation, statutory power, court order or other lawful authority for disclosure.

A record must be kept of:

• the request;
• the date received;
• any identity or clarification information sought;
• the search undertaken;
• the decision made;
• any redaction applied;
• any disclosure made;
• the date of the response; and
• any reason for refusing or restricting disclosure.

11. Complaints and Disputes Regarding CCTV

• Complaints about CCTV usage should be raised with the Registered Manager under the CH14 – Receiving and Acting on Complaints Policy.
• If unresolved, concerns can be escalated to the Information Commissioner’s Office (ICO) or CQC.

12. Staff Training and Compliance

• All staff must complete mandatory training on:
  • The legal and ethical use of CCTV.
  • Data protection and GDPR compliance.
  • The rights of people we support regarding surveillance.
• Regular compliance audits will be conducted to ensure adherence to this policy.

13. Policy Review

This policy will be reviewed annually or sooner if there are changes in legislation, best practices, or operational requirements. Updates will be made to reflect CQC guidance, ICO recommendations, and advancements in data security measures.

---

Responsible Person: {{org_field_registered_manager_first_name}} {{org_field_registered_manager_last_name}}
Reviewed on: {{last_update_date}}
Next Review Date: {{next_review_date}}
Copyright © {{current_year}} – {{org_field_name}}. All rights reserved.