Can you record video without consent under GDPR in the UK?

The short answer is yes, in some cases. But video recording without consent in the UK depends on why you are recording, where it happens, what you capture and how the footage is managed afterwards. The focus is not always on asking every person for consent. It is about having a lawful basis, being transparent where possible, and making sure the recording is necessary and proportionate.

Understanding video recording and GDPR

Under UK GDPR, video footage can count as personal data if someone can be identified from it. That might be from their face, voice, uniform, ID badge, vehicle registration, location or other details in the footage.

This means GDPR video recording rules can apply to:

• Fixed CCTV systems
• Body-worn cameras
• Dashcams used for work
• Door entry video systems
• Footage recorded during workplace incidents
• Video used for security, safety or investigations

The organisation using the system is usually the data controller. It must decide why footage is recorded, how long it is kept, who can access it and how people can use their data rights.

Is consent always required for video recording?

Consent is one lawful basis under UK GDPR, but it is not always the most suitable one for operational video recording.

For consent to be valid, it must be freely given, specific, informed and easy to withdraw. That can be difficult in spaces like public areas, retail spaces, hospitals, transport hubs, schools or security environments. A person entering a building may not have a realistic option to refuse recording, especially where cameras are used for staff safety, crime prevention or incident management.

This is where GDPR video recording consent is often misunderstood. Recording without consent is not automatically unlawful. The organisation still needs a lawful basis, but that basis may be legitimate interests, public task, legal obligation or another appropriate ground, depending on the setting.

For example, a private business may rely on legitimate interests when recording aggressive behaviour to protect staff and support an investigation. A public authority may rely on public task if recording is needed for a function carried out in the public interest.

Legitimate interests and security recording

Many private organisations rely on legitimate interests for security-related recording. This can apply where video is used to deter crime, record abusive behaviour, protect lone workers or investigate complaints.

However, legitimate interests still need careful thought. Organisations should be able to show that:

• There is a clear reason for recording
• Video is necessary for that purpose
• A less intrusive option would not achieve the same result
• The rights of individuals have been considered
• Staff know when recording is appropriate

In many cases, this should be supported by a legitimate interest assessment. If the recording creates a higher privacy risk, a Data Protection Impact Assessment may also be needed. This is especially relevant for body-worn video, audio recording, staff monitoring, vulnerable people or areas where people may expect more privacy.

Body-worn cameras and GDPR

GDPR guidance on body-worn cameras requires particular care because body-worn video is more mobile, intrusive and personal than fixed CCTV. A body-worn camera can record close-up interactions, voices, bystanders, private homes, medical settings or people in distress.

That does not mean body-worn cameras should be avoided. Used correctly, they can support staff safety, reduce disputes and provide evidence when accounts differ. But they need clear rules.

A body-worn camera policy should explain:

• Who can use the cameras
• When recording should start
• When recording should stop
• Whether audio is recorded
• How people will be told recording is taking place
• How footage is uploaded and stored
• Who can view recordings
• How access requests and police requests are handled

Continuous recording can be hard to justify in many settings because it may capture large amounts of irrelevant personal data. A more controlled approach is usually safer. Staff can activate the camera at the start of an incident, give a verbal warning where practical, and stop recording once the incident has passed.  Many modern body-worn cameras also include a pre-record function, which captures video for up to two minutes before recording is manually activated, as well as continuing to record for a set period afterwards. This helps preserve the moments leading up to an incident without requiring continuous recording.

Transparency requirements under GDPR

Transparency is one of the most practical parts of GDPR and video recording compliance. If people are likely to be recorded, they should usually be told.

For fixed CCTV, this normally means clear signage explaining that recording is taking place, who operates the system and where people can find more information. For body-worn cameras, transparency may include visible devices, staff badges, signage at entrances and verbal notices such as: “I am switching my camera on for everyone’s safety.”

Privacy information should also explain the purpose of recording, the lawful basis, retention periods, data rights and contact details for the organisation.

There may be rare cases where overt notification is not practical, such as a serious investigation where telling someone would affect the purpose of the recording. These situations need stricter controls, senior approval and clear documentation.

When recording without consent becomes a problem

Recording without consent is more likely to create GDPR risk when it is excessive, unclear or poorly managed.

Common problem areas include:

• Recording without a defined purpose
• Keeping footage for longer than needed
• Using footage for a new purpose without review
• Recording audio when video alone would be enough
• Giving too many people access to footage
• Using body-worn cameras without staff training
• Failing to respond to access requests correctly

A useful test is this: would a reasonable person understand why the recording is taking place, and could the organisation justify it if challenged?

Secure storage and footage management

Good compliance depends on what happens after the recording. Footage should be stored securely, protected from unauthorised access and deleted when it is no longer needed.

• Retention periods should reflect the purpose: Routine footage may only need to be kept for a short period, unless it is required for an investigation, complaint, insurance matter or legal process.
• Access should be limited to authorised users: A secure video management system can help by applying permissions, recording audit trails, managing retention periods and helping teams find footage quickly when needed.

This is especially useful for body-worn camera deployments where footage may be uploaded from docking stations, Wi-Fi or cellular connections and reviewed by managers, investigators or authorised third parties.

Subject access requests and video footage

People have the right to ask for a copy of their personal data, and that can include video footage. These requests are known as Subject Access Requests, or SARs.

Video SARs can be complicated because footage often includes other people. The organisation may need to find the footage, check whether the requester is identifiable, review the clip and redact faces, voices or other details before disclosure.

There are also cases where footage may be withheld, for example, if releasing it would affect a criminal investigation. These decisions should be handled carefully and documented.

How professional camera and communication systems can help

Compliance is easier when technology, policy and training work together.

Radiocoms supplies body-worn cameras and badges for organisations that need reliable incident recording, secure footage handling and practical deployment support. Options can include encrypted transfer, docking stations, video management software, audit trails and access controls. These systems can also integrate with wider communication tools, such as two-way radios or Push-to-Talk over Cellular devices.

The right system should match the working environment. A retail security team may need simple activation and quick review after incidents. A public sector or emergency service team may need stronger evidence handling, longer battery life, low-light performance and tighter access controls.

Recording without consent under GDPR is not automatically unlawful but video recording needs a clear purpose and a documented lawful basis. Organisations also need transparent communication, secure storage and trained users. With those measures in place, video recording can support safety while still respecting people’s privacy rights.

If your organisation is considering body-worn cameras, CCTV or integrated communication systems, Radiocoms can help you choose a solution that supports both operational requirements and data protection obligations. Our specialist team can advise on suitable hardware, secure video management platforms and deployment best practices to help you record incidents confidently while maintaining compliance. Contact Radiocoms to discuss your requirements and find the right solution for your environment.