Is home CCTV covered by GDPR and data protection law?

GDPR sounds like something that only applies to businesses, but home CCTV can bring it into play. The key is whether your cameras stay within your own land or reach beyond it.

The household exemption explained

Data protection law has a long-standing carve-out for purely personal or household activity, often called the household exemption. It means that if you use CCTV entirely for your own domestic purposes and your cameras only capture your own property, you are not treated as processing other people's personal data, and the requirements of UK GDPR and the Data Protection Act 2018 do not apply to you. This is the position the ICO sets out for most home users whose cameras face inward across their own garden, drive or doorstep.

The exemption is genuinely useful, but it is narrower than people assume, because modern cameras are wide-angle and high-resolution. A doorbell camera covering your porch may also see the public footpath and the house opposite; a driveway camera may catch the road and passing pedestrians. The instant your footage includes identifiable people outside your own boundary, the ICO's view is that the household exemption no longer covers that part of the recording, and you step into the scope of data protection law.

What changes when UK GDPR applies

Being covered by UK GDPR does not make your cameras unlawful, and it is not a reason to panic. It means you are now responsible for the personal data you capture, and the ICO expects you to handle it sensibly. The core duties are practical. You should be able to justify why you are capturing beyond your boundary — for example, genuine security concerns rather than idle surveillance. You should minimise what you record, by angling cameras down, using privacy masking to block neighbours' windows, or narrowing the field of view so you film as little of others' space as possible.

You should be transparent, which in practice usually means a visible sign telling people CCTV is in operation, and being open if a neighbour asks. You must keep footage securely so it is not casually accessible, retain it only as long as you genuinely need it rather than indefinitely, and be ready to handle a subject access request if someone asks for footage of themselves. None of these duties is onerous for a careful homeowner, but ignoring them is what turns a reasonable security camera into a source of disputes and complaints.

Do you have to register or pay a fee?

A common worry is whether home CCTV means registering with the ICO or paying the annual data protection fee. For ordinary domestic use, the answer is generally no. The data protection fee applies to organisations and certain controllers, and the ICO does not require typical householders using CCTV for their own home security to register or pay. The duties that matter are the practical ones above — handling footage responsibly — rather than any paperwork.

There is a sensible line to draw. If you were using cameras for something beyond ordinary home security — for example as part of running a business from the property, or monitoring staff — the position could differ and you would need to check the ICO's wider guidance. For the everyday case of a homeowner protecting their own house, the focus should be on where the cameras point and how you treat the footage, not on registration.

Indicative guidance based on ICO domestic CCTV principles — check the ICO pages for your situation.

How to stay on the right side of the rules

The practical takeaway is that the easiest way to limit your obligations is to limit what your cameras capture. Cameras that genuinely only cover your own property keep you within the household exemption and free of data protection duties. Where some spillover beyond the boundary is unavoidable — which is common with front-door and driveway cameras — accept that UK GDPR applies and follow the ICO's straightforward expectations.

In practice that means siting cameras thoughtfully, using privacy masking features that most modern systems include to black out areas you should not see, putting up a clear CCTV sign, keeping recordings secure and not hoarding them, and being willing to delete or hand over footage of an individual if they make a legitimate request. Approaching it this way keeps you compliant and, just as importantly, keeps relations with neighbours civil. If a genuine dispute arises, the ICO can offer guidance and, where data protection rules are clearly being broken, can become involved.

It is worth being clear about what UK GDPR does not demand of a homeowner. It does not require you to take cameras down, to stop protecting your home, or to capture absolutely nothing beyond your fence — a degree of incidental overlap is accepted as unavoidable on a normal street. Nor does it usually mean registering or paying a fee. The framework is about handling responsibly the personal data you do capture, not about preventing you from having cameras. Understanding that distinction stops the rules feeling more onerous than they are.

The standard the ICO applies is essentially one of reasonableness and proportionality. Could you achieve your security aim while capturing less of other people? Have you been open that recording takes place? Are you keeping footage securely and only as long as you need it? A homeowner who can answer yes to those questions is doing what the law asks. Far from being a trap, the household exemption and the proportionate duties around it are designed so that genuine home security and people's privacy can sit comfortably side by side.

Frequently asked questions

Sources & further reading

• ICO — Domestic CCTV systems guidance for householders
• ICO — Guide to the UK GDPR

Figures on this page are typical UK ranges drawn from published sources and depend on your specific property and system. They are guidance, not a quotation.