As of 13 August 2026, AI can only partly create a CCTV policy for your UK workplace.

What to actually do

1. Hand it to a person

   The route this page recommends

   Someone with a licence or accountable authority has to sign this before it counts.

2. Use a tool built for this

   Second choice

3. Do it yourself

   The distant third

   A chat interface, chat-fluent skill, and roughly 1 hour until you can act on the result.

   How to actually do it

   1. Open the ICO guidance on video surveillance and your organisation's current privacy, information security and disciplinary policies.
   2. Gather the camera plan, purposes, areas monitored, people affected, camera features, access roles, retention arrangements, disclosure routes and complaint contact.
   3. Ask your data protection lead or HR lead whether a data protection impact assessment, staff consultation or changes to the privacy notice are already planned.
   4. Paste the gathered information into the prompt and ask the chatbot to ask questions before drafting whenever an essential fact is missing.
   5. Compare the draft's purpose, lawful-basis wording, transparency, access controls, retention, disclosure and rights sections with the current ICO guidance and your actual system.
   6. Send the draft, camera plan, DPIA and consultation records to your data protection solicitor or suitably qualified data protection professional for review before approval.
   7. Obtain approval from the employer's accountable manager, publish the final policy with the relevant privacy notice and brief the staff who operate or access the CCTV system.

   Prompt

   Create a draft CCTV and workplace video-surveillance policy for a UK employer using the information below. Write in plain British English for employees and managers. Cover the purpose and lawful basis, the areas monitored and excluded, cameras with audio or facial recognition if relevant, covert monitoring, signage and transparency, who can view footage, disclosure to the police or other third parties, retention and deletion, access requests and other data protection rights, complaints, security, misuse, review, staff consultation and links to related policies. Distinguish clearly between decisions I must make and wording you can draft. Do not invent facts, retention periods, legal conclusions, camera locations or contact details. Flag every missing input and every point that should be checked against current ICO guidance, the UK GDPR, the Data Protection Act 2018, employment law and our surveillance design. State where a data protection impact assessment or advice from a data protection solicitor or suitably qualified data protection professional may be needed. Do not present this as legal advice. Before drafting, ask me for any essential missing information rather than guessing.
   
   Employer: [name and sector]
   Workplace locations: [sites and areas covered]
   Purpose of CCTV: [security, safety, crime prevention or other purposes]
   Who is monitored: [employees, visitors, customers, contractors]
   Camera features: [video, audio, facial recognition, number plate recognition or other features]
   Whether covert monitoring is contemplated: [yes or no]
   Who operates and can access the system: [roles]
   Current retention and deletion arrangements: [details]
   Possible disclosures: [police, insurers, investigators or other recipients]
   Employee contact for questions and complaints: [role or contact details]
   Existing privacy notice, consultation record or DPIA: [paste relevant text or say none]
   Other workplace policies to align with: [list]
   
   Return the result in this order: essential questions, assumptions not permitted, compliance issues to resolve, draft policy, employee-facing summary, implementation checklist and items requiring professional review.

   Open it prefilled in ChatGPT or Claude, or copy it into Gemini, which takes no prefill link.