Last updated: June 2026
In May 2025, the Data (Use and Access) Act received Royal Assent, introducing the most significant changes to UK data protection law since the Data Protection Act 2018. Most homeowners with CCTV are unaware that this new legislation clarifies and tightens the rules around domestic surveillance. If you own a smart doorbell, a garden camera, or any CCTV that captures beyond your boundary, this law affects your legal obligations starting now.
What the 2025 Act Changes for Domestic CCTV
The Data (Use and Access) Act 2025 introduces several provisions directly relevant to domestic CCTV owners. The most significant is the codification of the 'boundary rule' — the principle established in Fairhurst v Woodard is now written into statute. The Act clarifies that the domestic exemption applies only when a camera's field of view is entirely within the owner's property boundary.
The Act also introduces a new 'transparency obligation' requiring domestic CCTV operators to provide clear information to individuals whose data they capture. This is more explicit than the previous ICO guidance and removes ambiguity about whether signage is 'advisory' or 'mandatory'.
Mandatory Data Retention Limits
For the first time, the 2025 Act sets specific retention limits for domestic CCTV footage. Footage captured beyond the property boundary must be deleted within 30 days, unless it is part of an active police investigation. This codifies what was previously ICO guidance into enforceable law.
Business CCTV operators face additional requirements: mandatory 90-day retention for certain sectors (retail, hospitality) and stricter access control logging. If your home CCTV captures business-related areas (a home office, a workshop), the business provisions may apply.
The New Enforcement Powers
The 2025 Act grants the ICO greater enforcement powers against domestic CCTV operators. Previously, the ICO acknowledged it would be 'disproportionate' to pursue individual homeowners. The new Act lowers the threshold for enforcement action, particularly in cases where a homeowner has received a complaint and failed to address it.
The ICO can now issue compliance notices requiring specific actions: reposition cameras, enable privacy masking, implement retention schedules, or cease capturing certain areas. Non-compliance with a compliance notice carries the same criminal liability as non-compliance with an enforcement notice.
What You Must Do to Comply
If your domestic CCTV captures beyond your property boundary, the 2025 Act requires you to: (1) display clear signage at all entry points where recording occurs; (2) implement automatic deletion of footage within 30 days; (3) maintain a record of who has access to the footage; (4) respond to SARs within 30 calendar days; and (5) conduct a balancing test (legitimate interests assessment) documenting why your need for surveillance outweighs neighbour privacy.
These steps take approximately 2 hours to implement and cost nothing beyond a printed sign. The risk of non-compliance is now significantly higher than before the 2025 Act.
Video: How to install Uniview 4MP Dual Dome Camera (IPC3224SS-ADF28K-I1) — a practical walkthrough of the technology discussed in this guide.
Frequently Asked Questions
1. Does the Data (Use and Access) Act 2025 apply to cameras installed before the Act came into force?
Answer: Yes. The Act applies to all existing CCTV installations. There is no grandfather clause. If your camera was GDPR-compliant before the Act, it is likely still compliant. But if you relied on the domestic exemption to avoid any compliance, that exemption is now narrower. For more detail, see How to maintain Warehouses and Logistics CCTV systems - UK guide 2026. Also read our related guide: Listed Building Consent vs CCTV: The Conflicting Regulations That Trap UK Homeowners in a Legal Catch-22. Browse our in-depth home security resource at Home Security Guide. Official UK guidance on this topic: NSI.
2. Do I need to put up new signage to comply with the 2025 Act?
Answer: If your existing signage clearly states that CCTV is in operation and provides contact information for the data controller (you), it likely continues to comply. If your signage is ambiguous, faded, or missing, you must update it. The Act does not specify a standard format, but ICO guidance recommends including a contact method. For more detail, see How much does Home WiFi CCTV cost in 2026? UK prices explained. Also read our related guide: Council House CCTV: The Often-Overlooked Rules That Apply to Social Housing Tenants and Landlords.
3. Does the 2025 Act affect how long I can keep footage from my Ring doorbell?
Answer: Yes. If your doorbell captures beyond your property boundary (the pavement, neighbour's garden), you must delete footage within 30 days. Automatic deletion features built into Ring and other doorbells satisfy this requirement if set to 30 days or fewer. For more detail, see Best CCTV cameras for Home WiFi in 2026 - UK buyer guide. Also read our related guide: Why Your PoE Camera Reboots When Night Vision Activates — The Voltage Drop Problem Nobody Warns You About.
4. Can my neighbour sue me under the 2025 Act if my camera points at their garden?
Answer: The Act does not create a private right of action for damages on its own. However, it clarifies the legal framework, making it easier for neighbours to succeed under existing data protection claims. The practical risk of civil action is higher under the 2025 Act than before. For more detail, see Pubs, Bars and Restaurants CCTV - UK legal requirements and GDPR compliance 2026. Also read our related guide: The Spider Web Problem: Why Your Night Vision CCTV Captures Nothing But Glowing Blur and What Actually Works.
5. Does the 2025 Act make any distinction between recording video only versus video and audio?
Answer: Audio recording is treated as more intrusive under the Act. If your system records audio beyond your property boundary, you have additional obligations to justify the audio capture and inform individuals. Audio recording without justification is more likely to trigger ICO enforcement. Also read our related guide: Why CCTV Behind Glass Fails at Night: The Physics of IR Reflection Through UK Windows.
Conclusion
The difference between a security system that works and one that frustrates is understanding the real-world behaviour of cameras, cables, and the environment they operate in. Manufacturers sell specifications. Installers solve problems. The questions above represent the issues that UK homeowners and businesses actually face — the ones the spec sheets do not mention.
Article by Gary Pearce, qualified security systems engineer. For a free security assessment, visit gary-pearce-home-services.pages.dev. This guide was last updated June 2026. Verify current UK regulations with the ICO.