Choosing CCTV for a business: resolution, retention, and staying on the right side of the ICO

Most CCTV is bought on the number of megapixels and the number of cameras, and most of it disappoints: the night picture is mush, the recorder ran out of space after a week, nobody can get into it from their phone, and when something happens the one angle that mattered is not covered. A good system starts with four questions that have nothing to do with equipment. Here they are, and then the equipment.

1. What do you need to see?

Not "everything". For each camera position, decide what the picture is for:

• Monitor: see that there are people in the car park, or a queue at the door.
• Detect: see that somebody has come over the fence, with confidence.
• Recognise: see that the person at the back door is your night manager, whom you know.
• Identify: see a stranger's face, or a number plate, well enough to be evidence.

Each needs more pixels on the subject than the one before, and BS EN 62676-4 puts figures on it. A camera that identifies a face at the till will not identify one at the far end of the yard, however many megapixels it has, because the face is a dozen pixels wide at that distance. The answer is the right lens and the right position for each purpose, which is why a camera plan with fields of view drawn on it is worth more than a spec sheet.

2. How long do you need to keep it?

Thirty-one days is common and defensible for a business: long enough for a theft discovered at the month-end stocktake to still be on the recorder. Some insurers ask for more; some uses justify less. The point is to decide, write it down, and set the recorder to it. Under the UK GDPR footage is personal data, and keeping it for longer than you need it is a breach in itself. The retention period, the number of cameras and their resolution and frame rate together set the recorder's storage, which we size with headroom rather than on the edge.

3. Who may view it, and from where?

Decide who can look at live pictures, who can look at recordings, and who can export them, and give each person their own login with only those rights. Shared passwords and a generic admin account are how footage ends up where it should not. Remote viewing from a phone is useful and expected; it should be set up through the manufacturer's secure service or a VPN, never by opening a port on your router to the internet, which is how recorders end up on public lists of open cameras.

4. What does the law expect of you?

The Information Commissioner's Office publishes guidance on video surveillance and expects an operator to:

• have a lawful basis and a stated purpose, and a written assessment of why CCTV is needed where it is;
• put up signs saying that recording is taking place, who by and why, with contact details;
• keep footage only as long as needed, and no longer;
• control access to it and keep a record of exports;
• be able to answer a subject access request within a month, which means being able to find and export footage of a person and blur other people in it;
• not point cameras where people expect privacy, and avoid recording audio unless there is a strong reason.

Covering a neighbour's property or a public pavement beyond what is needed is the commonest complaint. A camera that overlooks the street can usually be masked so that the public area is blanked in the recording.

Then the equipment

• Cameras: IP cameras over structured cabling with power over Ethernet, so each camera has one cable and the system can grow. Fixed cameras for known views, varifocal where the view may need adjusting, PTZ only where somebody will actually drive it. Good low-light performance matters more than headline resolution for anything outdoors.
• Recorder: a network video recorder sized for your retention with headroom, in a locked cupboard or cabinet, on an uninterruptible supply if the footage matters.
• Network: cameras on their own VLAN, separate from the office computers, on PoE switches with enough power budget for every camera and the heaters in the outdoor ones.
• Analytics: line crossing, intrusion zones and number plate recognition are useful when they are tuned for the scene and a nuisance when they are not. Buy them for a purpose.
• Maintenance: lenses get dirty, views drift, firmware needs updating, disks fail. An annual visit with a report keeps the system doing what it was bought for.

What we do

We design, install and maintain CCTV for businesses across the West Midlands, draw the camera plan before we quote, size the recorder for the retention you set, configure the users and the remote access securely, and hand over with the signage and the ICO notes. Details on our CCTV page.