CCTV in care homes

The rule: two regulators, and CQC's seven principles

No law in England requires a care home to have CCTV, and no law bans it; what applies to cameras in a care home is two sets of rules at once. The Care Quality Commission (CQC) says in its guidance Using surveillance in your care service: “If you use surveillance to help keep people safe or monitor their wellbeing, we treat it as part of their care. This means it must meet the regulations under the Health and Social Care Act.” The same page adds that “any recordings you make of people also count as information about them”, so the UK GDPR and the Data Protection Act 2018 apply to every recording. The data protection regulator is the Information Commission, still known as the ICO, which took over from the Information Commissioner on 30 September 2026 under SI 2026/1015; CQC's pages still use the old name.

CQC's page How we check the use of surveillance sets out what an inspector looks for: “If a provider is using CCTV or other forms of surveillance, we will check them against these 7 principles:”

• Safeguarded: “Recording equipment has appropriate safeguards (Reg 12 and 13 of HSCA 2014 Regs)”
• Secured: “Recording equipment is housed securely and be appropriate to the purpose for which it is used (Reg 15 of HSCA 2014 Regs)”
• Privacy: “Privacy and dignity of people is at the heart of any considerations when deploying recording equipment (Reg 10 of HSCA 2014 Regs)”
• Involved: “People must be involved in decisions when using recording equipment in private rooms (Reg 9 & 11 of HSCA 2014 Regs: i.e. have appropriate consent and follow the MCA 2005 principles)”
• Lawful: “Recording equipment has a specific legal basis for its use and complies with all relevant legislation and codes of practice (Reg 17 of HSCA 2014 Regs: i.e. GDPR, HRA 1998, ICO, SCC)”
• Trained: “Staff are trained on the use of the recording equipment (Reg 18 of HSCA 2014 Regs)”
• Transparent: “Recording equipment is used in a transparent manner (GDPR article 5 principles)”

The regulations behind them are those of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 9 (person-centred care), 10 (dignity and respect), 11 (need for consent), 12 (safe care and treatment), 13 (safeguarding from abuse), 15 (premises and equipment), 17 (good governance) and 18 (staffing). Under each principle the page lists the evidence a provider can show, and the rest of this guide follows that list. The page carries a May 2026 date, but the seven principles and the evidence beneath them read word for word as they did in the version CQC dated 12 May 2022: they are long-standing expectations, not new guidance.

CQC's rules apply in England only: regulation 3(3) says “an activity is only a regulated activity if it is carried on in England”, and Wales, Scotland and Northern Ireland have their own care regulators. Data protection law applies across the UK, and the Mental Capacity Act 2005 to England and Wales.

Two points often confused. First, the Surveillance Camera Code of Practice binds only a “relevant authority” under section 33 of the Protection of Freedoms Act 2012, a list that begins with “a local authority within the meaning of the Local Government Act 1972”; even for a council, the duty reaches cameras that observe public places, not the inside of a care home. An independent provider is not bound by it, though CQC names it under the Lawful principle and the code says other operators “are encouraged to adopt the code voluntarily”. Second, calls to make cameras compulsory are heard for nurseries as well as care homes. For nurseries, the Department for Education said on 7 April 2026, in its answer to written question 123429, that “Decisions about using monitoring and recording equipment are for individual providers” and that guidance due in summer 2026 “will consider whether CCTV should be mandated”. That guidance had not been published by 28 October 2026; on 15 October 2026 the Leader of the House told the Commons that the Department's expert advisory group on safeguarding, “which is looking at the use of CCTV and digital devices in early years settings”, “will report before Christmas” (Hansard, 15 October 2026). Nothing has been decided. For care homes there is no requirement either way.

Before installing: purpose, alternatives and the DPIA

A care home deciding on cameras starts with its purpose. CQC's page Set out your reasons for using surveillance says “You must be able to identify your purpose for using surveillance – the thing you want to achieve”, that the purpose “must be legitimate under data protection law”, and that “If you use surveillance for one purpose, you can’t later use the information you collect for a completely different one.” Cameras at the front door to know who is in the building are one purpose; cameras in a lounge to review falls are another; footage gathered for the first cannot quietly be used for staff performance reviews.

Next comes an initial assessment of whether a camera is the best way to achieve that purpose, thinking about “if there's something else you could do that would intrude less on people's privacy”, and a needs assessment: “You must think about how surveillance will help meet the needs and interests of people who use your service.” CQC then asks for a written trail:

• your purpose, “including how it supports people’s needs”
• your initial assessment
• “your DPIA, if you’ve completed one”
• “what alternatives to surveillance you’ve considered”

The data protection impact assessment (DPIA). Article 35(1) of the UK GDPR requires a DPIA before processing that is “likely to result in a high risk to the rights and freedoms of natural persons”. For care homes the practical answer is to do one. CQC says “We would expect to see a completed DPIA for services using CCTV as many services are people’s homes, and/or provide diagnosis and treatment”, and the ICO's video guidance on accountability says a DPIA “is a legal requirement and applies in most cases relating to video surveillance given the inherent privacy risks involved in the use of these systems”. A home that decides not to do one must “document your reasons and be prepared to justify why the processing is not of a type likely to result in high risk”. CQC's evidence list describes the DPIA as “Documenting purpose, necessity and assessment of risks”, asks for privacy by design, “considering less intrusive methods”, and, under Transparent, for “Publication of the DPIA”. The method is the same in any sector; our DPIA guide walks through the template.

CQC's list also mentions “Consultation with ICO on DPIA where a high risk (recording in private rooms)”. The legal duty in Article 36 of the UK GDPR is narrower: prior consultation with the regulator is required where the DPIA shows a high risk the home has not been able to reduce with its own measures. A bedroom camera with consent, sensible positioning and tight access may not reach that point; one the home cannot make safe does.

Lawful basis, health data and sound. CQC asks for a “Documented lawful basis within DPIA” and tells providers to consider whether they are “likely to collect sensitive (or 'special category') data”. The ICO's page on complying with the data protection principles says “You need to identify an Article 9 UK GDPR condition, if you are actively processing special category data”. Footage of residents being helped to move, eat or take medicines will often reveal health information, so the DPIA should record whether the home is actively processing special category data and, if it is, which Article 9 condition applies; it is a judgement to make and record, not an automatic rule. Sound is treated more strictly: the ICO says audio recording “will therefore require a much greater justification and you should switch off by default any capability to record audio.”

Finally, a home using cameras must pay the data protection fee. CQC's page says the provider “must be registered/licensed with the Information Commissioner's Office (ICO)”; the legal duty is the fee, explained in our data protection fee guide.

Consultation, consent and best interests for cameras in bedrooms

CQC's page Consult people before using surveillance says “Talking to people is the best way to understand their concerns about privacy. You must do this wherever it's practical.” It names the people to talk to: the people who use the service, their families and friends, staff, trade unions and visitors. It expects the conversation more than once – when cameras are first considered, when there are detailed proposals, and from time to time while they are in use – and it lists what to tell people: why, what type of equipment, where, what information will be collected, where and how it will be stored, “who will have access to the information and how long you'll keep it”. “It's best to keep a record of the process you follow when you consult people, along with their responses”, and the concerns raised belong in the DPIA. Where a home decides not to consult, “it's important you can justify your decision.”

Consultation is not consent. CQC says so in terms – “Your initial consultation with people is not the same as getting consent” – and the difference matters most in a resident's own room, which is their home. The Involved principle requires that “People must be involved in decisions when using recording equipment in private rooms”, and the evidence CQC lists for it includes the first two items below; the third comes from its Safeguarded list:

• “Documented consent making it clear no one will be disadvantaged if they refuse consent. Consent is regularly reviewed.”
• “Documented best interests’ decisions where individuals lack the mental capacity to consent.”
• “Appropriate authorisation where applicable of deprivation of liberty e.g. DoLs, if used in private areas and notifications made to CQC.”

Where a resident may lack capacity to decide about a camera in their room, the Mental Capacity Act 2005 applies to that specific decision. Section 1 says a decision made for a person who lacks capacity “must be done, or made, in his best interests”, and that “regard must be had to whether the purpose for which it is needed can be as effectively achieved in a way that is less restrictive of the person's rights and freedom of action”. That second test is the alternatives question again, asked on the resident's behalf: would a sensor, a change of room or more checks at night do the job? A relative's agreement is not consent on the resident's behalf unless they hold the legal authority to give it; our guides to mental capacity assessment records and Regulation 11 consent cover the assessment and who can decide. CQC's own advice to families puts the everyday version plainly: “Just because somebody does not object to it does not mean they agree to it.”

Privacy is a fundamental standard, not a preference. CQC's guidance on Regulation 10 says “Each person's privacy must be maintained at all times including when they are asleep, unconscious or lack capacity.” Its page Protect people's privacy when you use surveillance adds that “The more surveillance threatens people’s privacy, the stronger the justification for using it must be”, and suggests practical limits:

• positioning cameras, or using them only at certain times, to avoid capturing intimate care: “Avoid recording sensitive things like intimate care or people privately observing religious beliefs”
• gathering information that does not identify people, “like statistical information from sensors rather than video”
• letting staff or residents turn equipment off at certain times
• switching body cameras off during intimate care

“You must keep a record of how you have looked at privacy concerns and any that you have not been able to address.” In a shared room, or a room that staff and visitors enter all day, the consent of one resident does not settle the position of the other residents, staff members and visitors the camera also records; their concerns belong in the same record.

Running the system: access, retention and footage requests

Once cameras are in, most of CQC's evidence is about control. Its pages on equipment and training and on how it checks camera use expect a care home CCTV policy and records that show:

• Who can see recordings. “You must make sure the only people with access to recorded information are people with a legitimate and lawful need”: monitors “in a lockable office”, strong passwords, “Access to system by login and password with full audit trail, with need to know access”, “Encryption of recordings” and “Appropriate security if remote access to system”.
• Who looked, and why. “you keep a record of who has had access to the information, when and why”, and who is responsible for operating the system.
• Contracts. Where a security company or hosting provider handles the footage, “your contract with them must set out clear rules on how they process it”.
• Training and discipline. Staff “should receive specific training on the use of the equipment”, and “HR policies should explain the disciplinary actions for misuse of the system”.
• Signs and a privacy notice. The ICO says “you must let people know when they are in an area where a surveillance system is in operation”; CQC looks for “Appropriate signage warning of the use of recording equipment” and a privacy notice for “all persons liable to be recorded (staff, people, visitors) including on website”. What the notice should say is in our care home privacy notice guide.
• Review. “Regular evaluation of whether it is necessary and proportionate to continue using it.”

How long to keep footage. There is no legal period. The ICO says “The UK GDPR and the DPA 2018 do not prescribe any specific minimum or maximum retention periods which apply to surveillance systems”; “it is the purpose of your processing that should determine your necessary retention period.” CQC expects “a clear policy about keeping information and recordings secure, how long you keep them for, and when and how you destroy them”. A rolling overwrite is common; what matters is that the period is chosen for a reason, written down and applied – and suspended for any clip that has become part of a request, a complaint or an investigation.

Requests for footage. A resident, or someone with legal authority to act for them, can ask for a copy of footage under Article 15 of the UK GDPR; the ICO confirms a request can be made verbally or in writing. Since 5 February 2026 the deadline is set by Article 12A, inserted by section 76 of the Data (Use and Access) Act 2025:

• The care home must answer without undue delay and within one month of “the relevant time”: the latest of receiving the request, receiving any information it asked for to confirm the requester's identity, and payment of any permitted fee.
• It can extend by two further months for the complexity or number of the person's requests, by notice given within the first month that states the reasons.
• Where the home “reasonably requires further information in order to identify the information” requested – for footage, usually the date, time and place – the days between asking and receiving the answer do not count towards the month.

Separately, Article 15(1A), inserted by section 78 of the same Act, limits the resident's entitlement to what the home is able to provide “based on a reasonable and proportionate search”.

The ICO's video guidance on governance after deployment still describes the older one-month wording and carries a banner saying it is under review after the Data (Use and Access) Act, but its practical advice stands. “Providing an individual with a transcript of either the audio or visual information contained in the footage is not enough to comply in most circumstances.” Other people in the frame may need to be protected, with techniques “including blurring, masking, or using a solid fill to completely obscure parts of the footage”. And because footage overwrites itself, “it is good practice to prevent the premature deletion of any information that falls within the scope of a request.” Our subject access request policy guide covers exemptions and the response itself.

Destroying footage to avoid producing it is a crime. In September 2025 a care home director was fined £1,100 with £5,440 costs at Beverley Magistrates' Court, according to the ICO's announcement of 4 September 2025, after being found guilty of blocking, erasing or concealing records to prevent their disclosure under a subject access request that included “copies of CCTV footage”. The offence is in section 173 of the Data Protection Act 2018; a late or incomplete answer is a breach of the UK GDPR, but concealment is what makes it a criminal case.

Complaints. CQC asks for “clear policies and procedures for when people ask for access to recordings, about sharing information and for complaints about surveillance”. Since 19 June 2026 section 164A of the Data Protection Act 2018 also gives anyone who thinks the home has broken data protection law in handling their data the right to complain to the home itself: the home must make complaining easy (the Act's example is “a complaint form which can be completed electronically”), acknowledge a complaint within 30 days and respond without undue delay. One procedure can serve both; the care home complaints procedure guide covers the log.

Disclosure. CQC expects a “Policy on disclosure of recordings to appropriate bodies, safeguarding, CQC, Police, Coroner.” The ICO asks providers to record “the date of the disclosure along with details of who we have provided the information to” and why, and warns that a disclosure made “knowingly or recklessly without the consent of the controller” can be an offence under section 170. CQC itself needs no request: “Under sections 62 and 63 of the Health and Social Care Act, inspectors have powers to view, copy or seize CCTV recordings.”

Hidden cameras, family devices and monitoring technology

A provider's own hidden camera. CQC's guidance says hidden recording “is only likely to be appropriate in rare circumstances, if you have a pressing reason and only plan to use it for a short time”; CQC's consultation page gives the example of recording for a short time to look into concerns about abuse, where telling people could alert those involved. It also says CQC “can't authorise you to carry out 'covert intrusive surveillance'. This means using hidden cameras or other recording equipment in residential areas of your service”, because of the Regulation of Investigatory Powers Act 2000. A home considering it needs the same purpose, DPIA and recorded justification as for any camera, plus a clear end date; where abuse is suspected, the safeguarding referral comes first.

A camera a family has hidden. Families who are worried sometimes put a camera or recorder in a relative's room. CQC's page on recording equipment placed by people or their relatives tells providers to treat it as a concern about care:

• “You must make sure the person still receives the same standard of care. You should do this even if the use of surveillance breaches a contract of service.” The person and their family “should not be put at a disadvantage”.
• “It's important to look into the reasons behind the decision to use surveillance. There might be a problem you were not aware of.” Investigate it as you would any other concern.
• Think about whether the device intrudes on anyone else's privacy, and whether anyone else should give consent.
• It is “likely to be a criminal offence” to deliberately damage the device, remove it intending not to return it, or delete recordings; it “would not be a criminal offence” to switch it off, or to remove it and keep it safe for its owner.

CQC's advice to families runs the other way: “If you are worried about somebody’s care, you should first raise these concerns with the provider of the service”, check the home's policy, and “only use recording equipment with the permission of the person whose care you are concerned about”, or be sure it is in their best interests if they cannot give it. It also tells families that a removed device must be returned undamaged. A care home CCTV policy that explains how a family can raise a worry, and how a request for a camera in a room will be considered, gives families a route that does not start with a hidden device.

Sensors and monitoring technology. CQC points to less intrusive tools – “statistical information from sensors rather than video” – as one way to reduce the impact on privacy. Vision based monitoring systems, infrared cameras that read vital signs, which CQC's related brief guide discusses for mental health in-patient services, have their own CQC guidance: “VBMS should not be used for surveillance. This means that you must not use these technologies to continually monitor people to keep them safe from abuse, neglect, or other criminal activity.”

The decisions around a camera that are made by message

Almost nothing that CQC asks to see about a camera system happens inside the camera system. A resident's daughter messages the deputy manager on a Sunday asking to see what happened in the lounge on Friday night. The night senior texts the manager that the camera in the corridor has been knocked and is pointing at the ceiling. The manager and the owner agree by message to view a clip after an allegation, and who will be in the room when they do. A family member says on the phone, and confirms by text, that they would rather their father's room had no camera after all.

Each of those is evidence CQC expects to see: a request for access, a record of “who has had access to the information, when and why”, a fault in equipment that must be “well maintained”, a change to a consent that is “regularly reviewed”. The ICO goes further and treats a verbal request as a valid request, suggesting a log of them. When those exchanges sit in a WhatsApp group or on a deputy's personal phone, the home has a footage log that says one thing and a conversation it cannot produce that says another. An end-to-end-encrypted consumer app is built so that the provider cannot see or keep those messages, and when the deputy leaves, the trail leaves with them.

ComplyChat provides channels for those work conversations, with everyone added told that the channel is on the record, and a mobile number verified by SMS as the identity, so night staff, bank workers and a resident's family can be in a conversation with the manager without a work account. Messages are recorded on the server as they are sent, and on paid plans, once the provider's Microsoft 365 tenant is connected, conversations are kept there under the retention schedules the provider already runs. ComplyChat is not a camera, CCTV or video-management system: it does not connect to a home's cameras or redact footage, and it does not do care planning or rostering.

A question for the next management meeting: for the last request to see footage, could you show who asked, when the month started, who viewed the clip and what was decided – without asking anyone to scroll through their phone?

Questions people ask

Is it legal to have CCTV in a care home?

Yes. No law in England bans cameras in a care home, but a provider using them must meet the Health and Social Care Act regulations, because CQC treats recording that keeps people safe “as part of their care”, and data protection law, which applies to every recording. CQC checks camera use against seven principles: safeguarded, secured, privacy, involved, lawful, trained and transparent. A camera in a resident's own room needs that person's documented consent or a documented best-interests decision.

Do you legally have to tell people you have CCTV?

Yes, for ordinary use. The ICO says “you must let people know when they are in an area where a surveillance system is in operation”, usually with clear signs and a privacy notice, and CQC looks for signage and a privacy notice for staff, residents and visitors. CQC says hidden recording by a provider “is only likely to be appropriate in rare circumstances, if you have a pressing reason and only plan to use it for a short time”.

Can I put a camera in my mom's nursing home room?

Only after raising it with the home, and only with permission. CQC's advice to families is to raise concerns with the provider first, check the home's policy, and use recording equipment only with the resident's permission or, if they cannot give it, when sure it is in their best interests; it warns that recording staff and visitors carries legal risk. A home that finds a family's device must keep caring for the person to the same standard and must not damage it or delete its recordings.

Is CCTV considered a breach of privacy?

Not in itself, but the more it intrudes the stronger the justification must be: CQC says “The more surveillance threatens people’s privacy, the stronger the justification for using it must be” and to avoid recording intimate care, and Regulation 10 requires a provider to ensure residents' privacy. Of camera systems in places with a heightened expectation of privacy, such as private property, toilets and changing rooms, the ICO says “you should only use them in the most exceptional circumstances, where it is necessary to deal with very serious concerns”.

How long should a care home keep CCTV footage?

There is no legal period. The ICO says the UK GDPR and the Data Protection Act 2018 “do not prescribe any specific minimum or maximum retention periods” for camera systems, so the purpose sets the period. CQC expects a clear policy on “how long you keep them for, and when and how you destroy them”, and footage covered by a request or an investigation should not be overwritten.

Can a family get a copy of care home CCTV footage?

A resident, or someone with authority to act for them such as an attorney, can make a subject access request. Since 5 February 2026 the home must answer within one month of receiving it (or of receiving information it reasonably needs to confirm identity), extendable by two further months for the complexity or number of requests, and the clock pauses while it asks for details it needs to find the footage (UK GDPR Articles 12 and 12A). The ICO says a transcript is not enough in most cases and other people may need to be blurred or masked, and in September 2025 a care home director was convicted under section 173 of the Data Protection Act 2018 of blocking, erasing or concealing records to prevent their disclosure under a request that included CCTV footage.

Official guidance and your next step

The primary sources are CQC's Using surveillance in your care service and its linked pages, especially How we check the use of surveillance, which holds the seven principles and the evidence list; the ICO's video guidance, which is under review after the Data (Use and Access) Act 2025; and the UK GDPR and Data Protection Act 2018 on legislation.gov.uk for the current text. Quotations are from those pages as published on 28 October 2026.

This guide is a summary for care providers in England, not legal advice about a particular camera, request or investigation. For the wider data protection picture – the Data Security and Protection Toolkit, Caldicott principles and breaches – see the care home data protection guide.

Then do one thing: take the CQC evidence list for the seven principles and, for each camera the home runs, write down where the purpose, the DPIA, the consent or best-interests decision and the access log are kept. Any line that reads “nowhere” or “on someone's phone” is the gap to close first.