CCTV and remote monitoring for businesses: the complete guide to securing your premises

A burglary does not only cost the value of the equipment that has been stolen. There is also the shopfront to replace, lost stock, production downtime and customers to reassure.

Security is no longer simply a cost. It is part of business continuity. Insurers pay close attention to it, and your customers rely on it.

However, the project can seem complex. Which cameras should you choose? Where should footage be stored? What does the law say about monitoring employees? Between technical choices and legal requirements (UK GDPR, the ICO, employment law), a mistake can quickly prove costly.

A well-designed system addresses four key challenges.

A reliable installation follows a clear process. Here are the six steps, in order:

Cameras: each type of business security camera is suited to a particular use:

• Dome: discreet and ideal for indoor areas (reception areas, offices, warehouses).
• Bullet: more visible and therefore more deterrent, suitable for outdoor areas (facades, entrances).
• PTZ (motorised): rotates and zooms remotely to cover large areas such as car parks.

Video storage:

Many businesses combine the two to avoid losing any footage.

Connectivity: a wired connection (IP/PoE) carries both data and power through a single cable. Wireless (Wi-Fi) is easier to install but more vulnerable to interference and disruption. For businesses, we recommend a wired connection: it provides a stable image without interruptions.

CCTV or remote monitoring? This is one of the most important decisions in your project.

• With CCTV, you monitor the footage yourself, either live or afterwards.
• With remote monitoring, a monitoring centre is automatically alerted and can respond 24/7.

At Scutum, every alarm is assessed by an operator, with the support of video analytics, before any intervention is triggered. The system does not simply record: it responds consistently to every alarm. To find out more, read our article Video surveillance vs. remote monitoring: what is the difference for your business?

The regulations governing CCTV and remote monitoring in businesses are strict. Here are the key rules.

The principle of proportionality: you can only record what is necessary for a specific security purpose. Excessive surveillance is not permitted.

Informing people: you must clearly inform people that CCTV is in operation and explain its purpose. This is normally done through clearly visible signs at the entrance to the monitored area. Businesses using CCTV must also comply with applicable data protection requirements and, in many cases, pay the ICO data protection fee.

Example of an information sign

“CCTV in operation.
Data controller: [Company name].
Purpose: security of people and property.
CCTV footage retention period: [30] days.
To exercise your rights, contact: [department / email address].
More information: ico.org.uk”

Employees: the rules governing workplace CCTV protect their privacy:

• You must inform employees about the monitoring and explain its purpose.
• You must have a lawful basis for monitoring employees and ensure that the monitoring is necessary and proportionate.
• You should use the least intrusive means necessary to achieve the security objective.
• You should not use CCTV installed for security purposes to continuously monitor employee performance.
• Cameras should not normally be installed in areas where employees have a high expectation of privacy, such as toilets and changing rooms.

The ICO states that employers must be clear about the purpose of employee monitoring, document their justification and avoid collecting more information than necessary.

Customers and visitors: clear signage at the entrance informs them that CCTV is in operation.

UK GDPR and the ICO: you must also:

• identify an appropriate lawful basis for processing personal data;
• include the system in your records of processing activities, where applicable;
• limit the retention period for footage to what is necessary for the purpose of the system;
• secure access to footage, restricting it to authorised people;
• consider whether a Data Protection Impact Assessment (DPIA) is required, particularly where surveillance is likely to result in a high risk to individuals, such as workplace monitoring.

The UK GDPR does not set a universal retention period for CCTV footage. The retention period should be based on the specific purpose and business need, and should be reviewed regularly.

These requirements can sometimes be seen as a constraint. When they are properly incorporated from the design stage, however, they instead provide protection for the business, both in the event of an inspection and in the event of a dispute.

Good equipment that is poorly configured does not provide adequate protection. Configuration includes:

• configuring the recorder and cameras (resolution, recording duration, timestamping);
• motion detection, configured zone by zone to limit false alarms;
• creating secure, individual user accounts for authorised people only;
• connecting to the monitoring centre, if you have chosen this option.

The final stage is often overlooked. People authorised to view footage must know how to:

• use the system, both live and when reviewing recordings;
• apply confidentiality rules;
• respect the rights of people captured on camera (access, retention and deletion).

A system that is compliant on the day of installation must remain compliant in everyday use.

A successful installation rests on three pillars:

• a precise audit of your actual needs;
• equipment suited to your site and activity;
• strict compliance with the law, from UK GDPR to employment law.

Entrusting your project to Scutum means having a single point of contact for all three areas, from the audit through to 24/7 monitoring. Our expertise is built on more than 35 years of experience and more than 425,000 protected sites. One ambition: to give you operational certainty, so that your success can continue over the long term.

Contact our experts today for a security audit and a tailored proposal.

Yes, dummy cameras can be used in certain circumstances. They may have a deterrent effect against attempted intrusion or vandalism. However, they cannot detect an incident or record evidence. They cannot be integrated into a remote monitoring or video alarm verification system either. For effective protection, they are therefore not recommended as the sole security measure.

The retention period must be justified by the purpose of the system. Under UK data protection law, there is no universal fixed retention period for CCTV footage. Images should be kept for no longer than necessary for the specific purpose for which they were collected. Businesses should define and regularly review their retention period and be able to justify it. Footage may be retained for longer when it is relevant to an investigation or legal proceedings.

As a general rule, CCTV should be directed towards the private areas of the business. The public highway should not be monitored unnecessarily. Where capturing a limited part of the public area is unavoidable and necessary for the security purpose, this should be kept to a minimum. The system should not be used to continuously monitor passers-by or vehicles without a legitimate and proportionate purpose. Privacy masking can be configured to obscure areas that should not be recorded.

No, it is not always compulsory. However, it is strongly recommended to ensure that the system continues to operate correctly over time. A maintenance contract generally includes periodic checks, software updates and repairs in the event of a fault. It reduces the risk of a malfunction occurring precisely when the system is needed. Some remote monitoring contracts already include maintenance.

The installation cost of a remote monitoring system depends on the size of the premises, the number of cameras, the access points that need to be secured and the features required. The installation cost of the equipment should be distinguished from the cost of the remote monitoring subscription. A small business may be able to install a system for a few thousand pounds, followed by a monthly subscription depending on the level of service. Options such as video alarm verification, access control or fire detection can affect the price. A security audit provides a quotation tailored to your actual requirements.

Scutum, Shielding your future.