CCTV in Care Homes: Is It Legal, What CQC Expects and How to Use It Lawfully (2026)

CCTV in Care Homes: Is It Legal, What CQC Expects and How to Use It Lawfully (2026)

What the law and CQC say about cameras in care homes, a step-by-step checklist before you install or review a system, and answers on staff monitoring, relatives’ cameras and what has changed.

Yes, CCTV is legal in care homes in England, but only with a legitimate purpose, after consulting the people affected, with privacy protections and in line with data protection law. CQC treats surveillance used to keep people safe as part of their care, so it must meet the Health and Social Care Act regulations, while the Information Commissioner’s Office (ICO) regulates the recordings as personal data. Cameras in bedrooms or bathrooms need the strongest justification, and CQC cannot authorise hidden cameras in residential areas.

This guide is for registered managers and providers of care homes, and it applies in similar ways to home care and supported living. It follows CQC’s guidance on using surveillance (updated 12 August 2025) and points to the ICO’s guidance on the data protection side. CQC recommends legal advice before you decide, and this article is not legal advice. Where we suggest something that is not a CQC or ICO requirement, we say so.

Who regulates CCTV in a care home?

Two regulators matter. If you use surveillance to keep people safe or monitor their wellbeing, CQC treats it as part of their care, so it must meet the regulations under the Health and Social Care Act. Any recordings you make are also information about people, and collecting it is regulated by the ICO (CQC: using surveillance in your care service).

CQC also tells providers to consider laws it does not enforce itself: UK GDPR, Article 8 of the Human Rights Act 1998 (the right to privacy) and, for covert surveillance, the Regulation of Investigatory Powers Act 2000 (RIPA). Because CQC cannot authorise “covert intrusive surveillance”, it recommends legal advice. Regulation 15 guidance adds that any surveillance must be in the best interests of people using the service, while being mindful of staff safety.

Six steps to using surveillance lawfully

1. Set out your reasons

Identify each purpose, such as protecting people from unsafe care, keeping the premises secure, or helping people stay safe without restricting their activities. Your purpose must be reasonable, lawful and appropriate, and you cannot later use the recordings for a completely different purpose. Ask whether something less intrusive would work, and whether surveillance is the best use of resources.

2. Complete a DPIA where needed

CQC says a data protection impact assessment is useful for spotting privacy issues, and you must complete one where there is high risk, for example when you handle biometric or other special category data on a large scale, use innovative technologies or collect data about many people. Review it regularly.

3. Consult people

Talk to people whose privacy is likely to be affected: residents, families and friends, staff, trade unions and visitors. Do this at the start, when you have detailed proposals, and from time to time while the system runs. Tell them your purpose, the type and location of surveillance, what you will collect, where and how it will be stored, who can access it and for how long. Keep a record of the consultation and responses. CQC says consultation is not the same as consent. You can skip consultation only in special circumstances, such as a short, targeted look into an abuse concern, and you must be able to justify the decision.

4. Protect privacy

Take steps to keep the impact as small as possible: reposition cameras, limit hours, use sensors rather than video where you can, and let staff or residents switch equipment off at certain times. Avoid recording intimate care or private religious observance, and switch off body cameras during intimate care. CQC says the more a measure threatens privacy, the stronger the justification must be, and that you must keep a record of privacy concerns you considered, including any you could not address.

5. Choose and manage equipment properly

Equipment must be fit for purpose, maintained and safe. Keep records of who operates the system and how information is protected. Only people with a legitimate and lawful need should have access, for example monitors in a lockable office and strong passwords. You remain responsible for security even if a hosting company holds the data, and any contractor processing data for you needs a contract setting out how.

6. Train staff and set policies

Staff need training on handling recordings. You need clear policies for access requests, sharing, complaints, retention, secure storage and destruction, and a record of who accessed recordings, when and why.

CCTV decision checklist for registered managers

Use this before installing or reviewing a system. It is our summary of the steps above, not an official form.

Choosing and installing a CCTV system for a care home

Before you ask installers for quotes, finish the purpose, DPIA and consultation steps, because they decide what you need. Questions to put to an installer (our suggestion):

• Can cameras be positioned to cover entrances, corridors, car parks or communal areas without looking into bedrooms and bathrooms?
• Where are recordings stored, how are they protected, and who has access? Is it encrypted and password-protected?
• Can retention be set to your policy and recordings deleted automatically?
• Can areas be masked and can cameras or audio be switched off at set times?
• Does the system support exporting footage for an access request while protecting other people’s images?
• Will you sign a contract setting out how you process data for us, and who maintains the system?
• Is any microphone or audio recording needed? Audio is more intrusive than video, so justify it separately.

Prices vary widely by size and specification, so we have not listed them. Ask for itemised quotes and keep them with your decision record.

Overt and covert surveillance

Overt surveillance is the norm. Tell everyone it affects, by talking to them or with clear notices, and in some circumstances get their consent. See consent to use technology in care.

Covert surveillance uses hidden cameras or microphones people do not know about. CQC says it is only likely to be appropriate in rare circumstances, with a pressing reason and for a short time, for example to identify a specific incident or allegation. CQC cannot authorise hidden recording equipment in residential areas, so take legal advice first and involve your local authority safeguarding team if abuse is alleged. See safeguarding referrals.

Can you monitor staff on CCTV?

Cameras that record staff are workplace monitoring, which is a data protection issue as well as a CQC one. The ICO’s guidance on monitoring workers applies to employers, and uses “must” for legal requirements, “should” for what it expects and “could” for options. The ICO says the guidance is under review because of the Data (Use and Access) Act, so check the current version. In practice (our summary, not legal advice):

• Have a clear, lawful purpose for monitoring staff and do not monitor more than you need. Constant, unexplained watching of staff is hard to justify.
• Tell staff what is recorded, why, who can see it and how long it is kept, before it starts, and include it in your policy and staff privacy information.
• Consult staff and representatives, as CQC’s guidance also says to consult staff and trade unions.
• Do not use cameras in changing rooms, toilets or rest areas.
• Use footage fairly: for the stated purposes, with a process if it is used in disciplinary or safeguarding investigations.

Take employment and data protection advice before introducing monitoring that goes beyond general security.

Cameras in a resident’s room: what if a relative wants one?

A resident or family member may want a camera in a room to check on care. CQC publishes separate information for people using services and families on using cameras to check someone’s care. For the provider, the same principles apply: the resident’s privacy and dignity, the privacy of staff and other residents, capacity and consent, and a conversation to understand the family’s worry. If someone has installed a hidden camera, see our guide on what to do when a relative puts a hidden camera in a care home room. Involve the registered manager and consider legal advice.

A note on vision-based monitoring systems

CQC’s guidance separately covers vision-based monitoring systems, which use infrared cameras to monitor vital signs. It says these must not be used for surveillance, meaning continual monitoring to keep people safe from abuse, neglect or other criminal activity. If you use digital contactless monitoring, check CQC’s guidance on what it looks at during assessments.

Are there new CCTV laws?

We found no new CCTV-specific law for care homes. What we can say from the sources:

• CQC’s guidance on using surveillance was last updated on 12 August 2025 and still sets out the six steps above.
• The ICO’s CCTV and video surveillance guidance is aimed at larger organisations, with a separate small business hub, and the ICO publishes a CCTV self-assessment checklist covering installation, management, operation, public awareness and signage.
• The ICO says its video surveillance and monitoring workers guidance is under review because of the Data (Use and Access) Act, so check the ICO’s pages for updates.

Re-check CQC and ICO pages before you install, and review your system and DPIA when guidance changes.

What inspectors may ask

• Why you use surveillance and what alternatives you considered.
• How you consulted residents, relatives and staff and what they said.
• Your DPIA, policies and access records.
• How you protect dignity, for example in bedrooms and bathrooms.
• Who is trained and how long recordings are kept.

Surveillance links to GDPR and data protection for care home records, Regulation 12 and restrictive practice, because monitoring that limits movement or freedom needs separate justification.

Keeping the records together

CQCLogic’s policy library is a register with version, review date, owner and file upload, so you can hold your surveillance policy and DPIA review dates in one place. Task tracking lets you assign annual DPIA reviews, staff training and consultation follow-ups, and the staff training tracker records who has completed data protection training. The incident and complaints logs record concerns raised about cameras. Our free policy register includes a surveillance policy row.

Sources and how this was checked

• CQC: Using surveillance in your care service (page last updated 12 August 2025).
• ICO: CCTV and video surveillance and ICO: Monitoring workers (both read 25 October 2026, both noted as under review).
• Weightmans, The use of CCTV in care homes: the legal issues (August 2024).

The checklist, installer questions and staff monitoring summary are our suggestions, not CQC or ICO requirements. This is not legal advice.