Is It Illegal To Video Someone Without Permission In the UK?

If you run a small business, filming can be part of day-to-day life.

You might have CCTV for security, a phone recording a staff training session, or a social media clip showing your shop or event.

But one question comes up again and again: is it illegal to video someone without their permission in the UK?

The frustrating (but honest) answer is: sometimes yes, sometimes no - and for businesses the risk usually isn’t limited to “is it a crime?”, but whether you’ve respected privacy rights, complied with data protection rules (UK GDPR), and avoided reputational damage or complaints.

Below, we’ll break this down in plain English from a small business perspective, including when you can film without consent, when you should get consent anyway, and how to set up a compliant approach that protects your business from day one.

Is It Illegal To Video Someone Without Their Permission In The UK?

In the UK, filming someone without their permission is not automatically illegal. There isn’t one simple rule that says you must always get consent before filming.

However, filming can become unlawful depending on:

• Where you’re filming (public place vs private space)
• What you’re filming (ordinary activity vs private/intimate situations)
• Why you’re filming (security, marketing, monitoring staff, etc.)
• How you use the footage (internal security vs posting online)
• Whether the footage identifies someone (which brings in UK GDPR rules)

So, if you’re asking whether it’s illegal to video someone without their permission, the better business questions are usually:

• Do we have a lawful basis to record?
• Are we being transparent about it?
• Are we using and storing the footage safely and fairly?

As a practical example: filming customers walking into your shop on CCTV for theft prevention is often lawful if done properly. Filming a customer at close range for a “funny” TikTok, then uploading it without consent, is where you can quickly run into privacy complaints, data protection issues, and potentially harassment or misuse allegations.

Criminal Law Vs Civil Liability (And Why It Matters For Businesses)

Many business owners focus on whether filming is a criminal offence. But for businesses, the bigger risk is often civil claims, regulatory action, or complaints (for example, to the ICO) for poor data handling.

Even if filming isn’t “illegal” in the criminal sense, you can still face problems if:

• your filming is intrusive or unfair
• you don’t tell people they’re being recorded (where you reasonably should)
• you use footage in ways people wouldn’t reasonably expect
• you mishandle footage (security, retention, sharing)

Depending on the facts, filming and/or using footage can also trigger civil liability - for example, a claim for misuse of private information or (in some contexts) harassment - particularly where someone has a strong expectation of privacy or the footage is used in a harmful way.

When Can A Business Film Without Consent? (Public, Private And “Reasonable Expectation Of Privacy”)

A helpful way to think about filming lawfully is the concept of reasonable expectation of privacy.

If someone is in a truly public setting, they generally have a lower expectation of privacy. If they’re in a private or sensitive setting, expectations are much higher - and your responsibilities increase.

Filming In Public Places

Businesses often film in public (or public-facing) spaces, such as:

• the entrance to a shop
• a stall at a market
• a gym floor
• a ticketed public event
• a street interview for content

Filming in these contexts can be lawful, but you still need to think about how you use the footage. For example, recording for security is a different risk profile from recording for marketing.

If you want a deeper dive into public filming scenarios, this guide on filming people in public is a useful reference point when you’re setting boundaries for staff and content creators.

Filming In Private Spaces

If your business controls the space, you still can’t assume you can film anywhere you like.

High-risk areas include places where people expect privacy, such as:

• toilets and changing rooms (generally a clear “no”)
• treatment rooms (beauty, medical, physio)
• staff break rooms (depending on use)
• any area where confidential conversations are likely

Filming in these areas without very strong justification (and strong safeguards) is where you’re far more likely to face complaints or legal consequences.

Filming Children

If your business involves filming in environments where children may be present (events, family venues, schools, sports), be extra cautious. Even when filming is allowed, the risk and sensitivity are higher - and you should tighten your consent and notice processes.

If you’re unsure where the line falls, this article on recording a child without permission is a good starting point for understanding why you’ll often want explicit permissions and careful policies.

How UK GDPR Applies To Filming (And Why “Just A Video” Can Still Be Personal Data)

For most small businesses, the biggest compliance issue isn’t criminal law - it’s data protection.

Under the UK GDPR and the Data Protection Act 2018, a video can be personal data if it identifies (or could identify) a person. That includes:

• their face
• their voice
• a name badge
• unique features (tattoos, uniforms, etc.)
• context that makes them identifiable (eg “the only staff member on shift”)

So, if you’re filming customers or staff and can identify them, you should assume UK GDPR applies.

Do You Always Need Consent Under GDPR?

No - and this is where many businesses get tripped up.

Under UK GDPR, “consent” is only one lawful basis for processing personal data. Depending on why you’re filming, your lawful basis might be:

• Legitimate interests (eg CCTV for security, preventing theft)
• Performance of a contract (less common for filming, but possible in certain service delivery contexts)
• Legal obligation (rare for filming, but could apply in regulated settings)
• Consent (often appropriate for marketing and promotional content)

In practice, businesses often use:

• legitimate interests for security filming (with clear notices and a documented balancing exercise)
• consent for promotional filming, testimonials, and content featuring recognisable individuals

This is why the question “is it illegal to video someone without their permission?” is so context-specific: you may not need consent to record, but you still need to meet GDPR requirements (including a lawful basis, transparency, and appropriate safeguards).

Transparency: Signs, Notices And Policies

Even where consent isn’t required, GDPR expects you to be transparent. That usually means:

• clear signage or notices where recording happens (especially CCTV)
• an accessible privacy notice explaining what you record, why, and how long you keep it
• internal controls to stop footage being used casually or shared inappropriately

A properly drafted Privacy Policy is one of the easiest ways to explain your approach clearly (and show you’ve thought about compliance), particularly if your business also collects other customer data through bookings, websites, or mailing lists.

Storage, Retention And Access Requests

Once you record video, you also take on responsibilities such as:

• security: restricting access, using strong passwords, protecting cloud storage
• retention: keeping footage only as long as needed (not “forever, just in case”)
• disclosure: not sharing footage unless there’s a proper reason
• handling requests: people may ask for access to footage that shows them (subject access requests)

This is where small businesses can accidentally slip up - for example, if a staff member downloads a clip onto a personal phone, or footage gets shared in a group chat.

Workplace Filming: CCTV, Staff Monitoring And Audio Recording Risks

Workplace filming is common - but it’s also where complaints and trust issues can escalate quickly if you don’t get the basics right.

If you’re thinking about cameras at work (whether for security, safety, or productivity), start with the fundamentals around cameras in the workplace.

Do You Need To Tell Employees They’re Being Recorded?

In most cases, yes - you should be open about workplace monitoring.

Covert monitoring is high-risk and should generally be avoided unless you have a strong justification (for example, a specific suspicion of serious misconduct), it’s strictly proportionate, and you’ve taken appropriate advice.

A practical step that helps enormously is having clear internal rules for equipment, systems, and monitoring. Many businesses cover this through an Acceptable Use Policy (often alongside workplace privacy wording), so your team understands what’s monitored, why, and what’s off-limits.

What About CCTV With Audio?

This is where businesses often cross into dangerous territory.

Audio recording is generally more intrusive than video because it can capture private conversations - including special category data (like health information) or confidential business discussions.

If you’re considering audio-enabled CCTV (or devices that capture sound), it’s worth reading about CCTV with audio before you set anything up. You’ll typically need a stronger justification, clearer notices, and tighter controls.

Can You Film Disciplinary Meetings Or Calls?

Sometimes businesses want to record meetings for accuracy (especially where there’s a dispute). Before you do, be careful: recording employees can raise legal and HR risks, and you should think about transparency and fairness.

If you’re also thinking about recording sound (not just video), this article on recording conversations covers important considerations around privacy and lawful handling.

In many cases, it’s safer to take written minutes and confirm outcomes in writing, rather than pressing record and hoping for the best.

Marketing, Social Media And Content Creation: When Consent Is The Smart Move

Even if you can legally film in a public-facing place, posting footage online is a separate step - and it’s often the step that creates the biggest issues.

If your marketing footage features identifiable individuals (customers, passers-by, staff), you should think carefully about whether you need:

• explicit consent
• a written release
• clear signage that filming is taking place
• an opt-out process (eg staff can direct someone to a “no filming” area)

When Is Consent Most Important?

Consent is especially important where your filming is:

• close-up or focused on one person
• used in advertising (not just general “atmosphere” shots)
• potentially embarrassing or sensitive
• involving children
• in a private or semi-private setting (classes, workshops, member-only spaces)

A good rule of thumb: if a reasonable customer would be surprised to see themselves on your business Instagram, get consent first.

Use A Written Consent Form Where Possible

Verbal permission can be hard to prove later. If content is important to your brand (or you plan to reuse it in ads), written consent is often worth it.

Many businesses handle this with a photo and video consent form, especially when filming at events, running brand shoots, or creating promotional content where individuals are clearly identifiable.

This isn’t just about legal risk - it’s also about professionalism. Clear consent processes can make your content creation smoother and reduce awkward disputes later.

Practical Compliance Checklist For Small Businesses (So You’re Protected From Day One)

If you’re filming in or around your business, you don’t need to overcomplicate it - but you do need a plan.

Here’s a practical checklist you can implement.

1) Be Clear On Your Purpose

Write down why you’re filming. Common examples include:

• preventing theft and improving security (CCTV)
• health and safety monitoring
• training and quality assurance
• marketing and social media content

Different purposes have different risk levels - and may require different lawful bases and safeguards.

2) Decide Whether You’re Relying On Consent Or Legitimate Interests

As a general guide:

• Security CCTV: often legitimate interests (with notices + limited access + short retention)
• Marketing footage: often consent (especially for close-ups or identifiable individuals)
• Employee monitoring: high sensitivity; often legitimate interests but must be fair, proportionate, and transparent

If you’re relying on legitimate interests for CCTV or workplace monitoring, it’s also sensible to document your decision-making (for example, a legitimate interests assessment). For higher-risk monitoring, you may need to consider whether a data protection impact assessment (DPIA) is appropriate.

If you’re not sure which basis fits, it’s worth getting advice. Picking the wrong basis (or using consent badly) can create avoidable compliance headaches.

3) Put Visible Notices In Place

For CCTV, clear signage is usually expected as part of being transparent. For promotional filming (eg “today we’re filming content”), signage is often a smart move, even if you’re also collecting individual consents for close-ups.

Notices should be easy to spot, easy to understand, and tell people what to do if they have questions.

4) Limit Access And Set Retention Periods

Ask yourself:

• Who in the business can access footage?
• Can they download it to personal devices? (Ideally, no.)
• How long do you keep it?
• How do you delete it securely?

Keeping footage longer than necessary increases your risk if there’s a breach or complaint.

5) Train Your Team (Especially If They’re Making Content)

If staff are filming on phones for social media, they need clear boundaries. Otherwise, well-meaning content can quickly turn into a customer complaint.

Cover basics like:

• when to ask for permission
• what areas are off-limits (eg toilets, private areas)
• how to respond if a customer says “don’t film me”
• where footage can be stored and who can post it

6) Prepare For Complaints Or Requests

Have a simple internal process for:

• requests to remove online content
• subject access requests involving CCTV
• law enforcement requests
• customer concerns about filming

Even if your process is basic, having something in place helps you act quickly and consistently.

Key Takeaways

• Filming without permission isn’t automatically unlawful, so whether it’s illegal depends on where you filmed, what you captured, and what you do with the footage.
• UK GDPR often applies because identifiable video footage is usually personal data, which means you need a lawful basis, transparency, and safe handling.
• Public filming is generally lower risk, but uploading identifiable footage for marketing without consent can still create privacy and data protection issues.
• Workplace filming needs extra care - you should be transparent with staff, avoid overly intrusive monitoring, and be cautious with audio recording.
• Written consent is often the safest option for promotional content, especially close-ups, testimonials, children, or sensitive contexts.
• Simple safeguards protect your business: clear notices, privacy wording, limited access, retention limits, and staff training can prevent costly complaints later.

If you’d like help setting up a compliant filming approach (including privacy wording, consent forms, and workplace policies), you can reach us at 08081347754 or team@sprintlaw.co.uk.