CCTV in Communal Areas and Your RTM Company’s GDPR Duties
A car gets keyed in the residents’ car park on a Tuesday night. By Wednesday morning, three separate leaseholders are asking the same question in the group chat: who actually runs the cameras in this block, and can anyone even get the footage? Nobody on the board is quite sure. That uncertainty is the real risk here, not the scratched paintwork. If your building is run by a right to manage company, putting CCTV in communal areas is entirely possible, but it comes with legal responsibilities that sit with you, the directors, from the day the cameras go live. Right to Manage (RTM) only exists in England and Wales, but the data protection rules that kick in once the cameras go on apply across the whole UK.
Can an RTM company put CCTV in communal areas?
The starting point isn’t your preference as a board, it’s the lease. Installing cameras in a hallway, lobby or car park is usually treated as an improvement to the building rather than a repair, and most leases only give the landlord (and, once it’s exercised, the right to manage company) a clear power to carry out repairs without wider agreement. If the lease is silent on improvements, or says something closer to “repair and maintain,” that’s a gap you need to look at before you order equipment, not after.
Your company’s own articles of association matter too. As an RTM company, your objects clause and any internal rules set out how the board can take decisions and what, if anything, needs wider leaseholder sign-off. Don’t assume the board can simply decide alone and proceed – check what your articles actually say about capital expenditure or non-repair works first.
Even where the lease and articles support going ahead, a single objecting leaseholder doesn’t automatically kill the project – but they aren’t powerless either. Leaseholders can challenge the reasonableness of the costs at the First-tier Tribunal, which is a different question from whether CCTV is allowed at all. Get the lease position and the cost case straight before you commission anything, not after a dispute lands on your desk.
CCTV and GDPR: why your RTM company is the data controller
Once cameras are recording people’s comings and goings, your right to manage company is handling personal data, and CCTV GDPR obligations follow automatically. Under UK GDPR Article 4(7), a controller is “the natural or legal person… which, alone or jointly with others, determines the purposes and means of the processing.” Your board decides why the cameras are there and how the system is run, so your RTM company is the controller – not us, not your managing agent, and not any individual director personally.
It’s worth being precise about why the household exemption doesn’t rescue you here. Article 2(2) and Recital 18 exclude processing “by an individual in the course of a purely personal or household activity” – but an RTM company is, by definition under section 73 of the Commonhold and Leasehold Reform Act 2002, a private company limited by guarantee. It’s a legal person, not an individual, so the exemption was never available to it regardless of how small or informal the board feels day to day.
That leaves you needing a lawful basis for the processing. Article 6(1)(f) – legitimate interests – usually fits communal CCTV run for crime prevention and resident safety, but it isn’t a free pass: it requires a documented balancing exercise weighing your interest in security against residents’ privacy, not an assumption that the cameras are obviously justified.
Your managing agent, and any installer who keeps remote access for maintenance, are typically processors acting on your instructions, not controllers in their own right. Article 28 requires that relationship to be set out in a written contract covering what they can do with the footage, confidentiality and security. We’ll only ever hold that access under terms your board has agreed – ask for that contract in writing if you don’t already have one.
If an agent or installer starts making its own decisions about how footage is used – reselling it, keeping its own copies for its own purposes – it can become a controller in its own right, with its own compliance duties. That’s a fact-specific question for your board to check, not something to assume either way.
Right to manage company directors’ responsibilities for CCTV
This is where right to manage company directors’ responsibilities for CCTV get practical. Treat the following as a working checklist rather than a one-off exercise:
- Screen for a DPIA. Article 35(3)(c) requires a Data Protection Impact Assessment for systematic monitoring of a public area “on a large scale” – but there’s no fixed number of cameras or flats that triggers it. Write down your reasoning either way, even if it’s a short note concluding a full DPIA isn’t needed. That note is your evidence if anyone ever asks.
- Pay the ICO data protection fee. Most RTM companies running CCTV for security purposes fall into Tier 1 (£52) or Tier 2 (£78) depending on turnover and staff numbers; larger organisations sit in Tier 3 (£3,763). Run the ICO’s own self-assessment tool to confirm your tier rather than guessing.
- Give residents privacy information. A short notice – who’s responsible, what the cameras are for, how long footage is kept, how to ask questions – covers the transparency obligation and heads off a lot of “who runs this?” conversations before they start.
- Set and document a retention period. There’s no fixed statutory CCTV retention period, so don’t quote one as if there is. The storage limitation principle requires you to decide a period that matches your stated purpose, write it down, and actually configure the system to overwrite on that schedule.
- Write an access policy that authorises the role, not the person. Access rights should attach to a board position – “the director responsible for security,” say – rather than to a named individual. When that person resigns or is replaced, the policy still works without leaving a gap where nobody remembers who has the login.
- Know your subject access request timing. Under Article 12A UK GDPR, in force since February 2026, you generally have one month to respond to a request – but the clock starts from the “relevant time,” which can be later than the date you received it if you’re still verifying identity or waiting on a fee, and it pauses while you’re waiting on the requester for information you’ve asked for. Don’t treat it as a flat one-month-from-receipt rule.
- Handle police requests properly. Ask the officer to specify what footage they need and why, check the request is specific rather than a general trawl, and keep a disclosure log recording the date, the officer’s details, what was handed over and the basis relied on. Disclosure is usually permissible for genuine crime prevention or detection purposes, but it isn’t usually compulsory without a court order.
- Set up an internal complaints process. From 19 June 2026, under section 164A of the Data Protection Act 2018, controllers are expected to have a clear, accessible way for someone to complain about data handling before they escalate to the ICO, with acknowledgement inside 30 days. For a small board, this can be a short written procedure sitting alongside your CCTV policy – worth having in place now if you haven’t already.
CCTV signs: what they must say
Signage isn’t decorative. Each sign needs to tell residents and visitors that CCTV is in operation, what it’s for (crime prevention, resident safety), and how to contact the controller – your company – with questions. Position signs so people see them before they enter the monitored area, not only once they’re standing under the camera.
How good system design keeps you on the right side of data protection
This is where our side of the job does real work for your CCTV data protection position, not just your security. Camera positioning is the first decision that matters: aiming lenses away from flat front doors and windows keeps the system focused on shared spaces rather than drifting into anyone’s private home, and privacy masking can blank out a window or balcony that a wider-angle lens would otherwise catch. We disable audio recording at setup by default, because audio raises a separate, harder-to-justify set of questions than video alone – we cover that properly in “Should Your Communal CCTV Record Audio? What the ICO Actually Expects”, so we won’t repeat it here.
Beyond positioning, the system itself should match the policy your board has written, not sit apart from it. Automatic overwrite timed to your documented retention period means footage doesn’t quietly outlive its purpose because nobody remembered to delete it. Separate user accounts for each role, with a log of who viewed or exported what and when, back up the “authorise the role, not the person” approach from your access policy. Remote access – for us, for a managing agent, for anyone – should run over a secured connection with its own audit trail, not a shared password passed around by email. And when a subject access request or a police request lands, a clean export process that pulls exactly the relevant clip, nothing more, saves your board from over-disclosing or missing the deadline while someone hunts for the right recording.
None of this is one clever feature. It’s cumulative – positioning, masking, audio off, retention matched to policy, and logged access all reduce the number of ways a reasonable system turns unreasonable. Good CCTV for flats design is largely this kind of ordinary discipline, applied consistently.
Paying for it: service charges, section 20 and long-term contracts
Before you commit to a quote, check the lease actually lets you recover CCTV costs through the service charge at all. Taking on the right to manage transfers the landlord’s existing management functions, and the existing lease’s service charge machinery, to your company – it doesn’t create a new power to charge for something the lease never provided for. If the lease is silent on this kind of expenditure, consultation rules alone won’t fix that; you’d be looking at a lease variation or a voluntary contribution instead.
Where the lease does cover it, section 20 of the Landlord and Tenant Act 1985 sets a consultation threshold of £250 per leaseholder for “qualifying works” in any 12-month period. Skip the consultation without tribunal dispensation and, even if the real cost is higher, recovery is capped at £250 per leaseholder. A separate, lighter-touch consultation under the Service Charges (Consultation Requirements) (England) Regulations 2003 applies to qualifying long-term agreements – contracts running over 12 months, such as ongoing monitoring or maintenance – where any leaseholder’s contribution would exceed £100 a year. A three-year monitoring contract can trip this threshold even when the installation itself stayed under £250, so check both figures separately.
If your lease genuinely doesn’t provide for recovering CCTV costs, there is a real route to fix that: Schedule 7, paragraph 10 of the Commonhold and Leasehold Reform Act 2002 lets an RTM company apply to the First-tier Tribunal, under Part 4 of the Landlord and Tenant Act 1987, to vary leases that don’t adequately provide for recovering management costs. Tribunals have allowed this in practice, but it isn’t a quick fix – take proper legal advice before starting down that path.
Leaseholders’ own cameras and video doorbells
A leaseholder fitting a video doorbell on their own front door is usually covered by the household exemption – right up until its field of view extends beyond their own threshold. The moment a doorbell camera or a personal CCTV unit also captures a shared corridor, a communal car park or a neighbour’s door, the ICO’s position (illustrated by the county court case Fairhurst v Woodard) is that it stops being purely domestic. At that point, the resident who installed it takes on their own UK GDPR obligations for that footage, separately from anything your company runs.
There’s a practical side too: fixing anything to the common parts, including a doorbell camera on a shared landing, generally needs the consent your lease requires for alterations to communal areas, regardless of the data protection question. If a resident asks us about a doorbell that might catch a shared hallway, we’re happy to talk through where the line sits before anything goes on the wall.
The Big Picture
- CCTV in communal areas is usually an improvement, not a repair – check your lease and your articles of association before you commit to a system, not after.
- Your RTM company is the data controller under UK GDPR Article 4(7); the household exemption never applied to it because it’s a company, not an individual.
- Directors carry specific, checkable responsibilities – DPIA screening, the ICO fee, documented retention, an access policy built around roles, correct subject access request timing, and a lawful disclosure process for police requests.
- Service charge recovery depends on the lease actually covering CCTV costs; section 20 and QLTA consultation thresholds (£250 and £100) are separate questions from whether the lease allows the charge at all.
- Good system design – camera positioning, masking, audio off by default, retention-matched overwrite and logged access – does a lot of the compliance work before a policy document is even needed.
Before You Go
None of this means CCTV in a residential block is a legal minefield to avoid. It means treating it as what it is: a system your company controls, with decisions that need documenting and a policy that needs reviewing as directors change. If you’re weighing up communal CCTV for your block, or you’ve got a system already running and aren’t sure the paperwork behind it holds up, contact us and we’ll talk through where you stand and what, if anything, needs tightening up before it becomes a problem.
FAQ
Can I put CCTV in a communal area?
Yes, provided your lease supports non-repair works (or your company has the right consent route) and your articles of association allow the board to proceed. Check both before ordering equipment – retrofitting consent after installation is far harder than getting it first.
Can I put CCTV outside my flat?
A camera pointed only at your own front door usually stays within the household exemption. The moment its view takes in a shared corridor, stairwell or car park, you’re processing other people’s data under UK GDPR in your own right, separately from the block’s communal system.
Who is responsible for CCTV in a block of flats?
Whoever decides why and how the system runs is the data controller – for a right to manage company, that’s the board, not the managing agent or the installer. Agents and installers with system access are usually processors acting under a written contract, not controllers themselves.
Can leaseholders be charged for CCTV through the service charge?
Only if the lease actually provides for that kind of cost. If it does, section 20 consultation applies above £250 per leaseholder for the works, and a separate £100 threshold applies to long-term monitoring contracts. If the lease doesn’t cover it, consultation alone won’t create that power.
How long should communal CCTV footage be kept?
There’s no fixed legal retention period. You need to set a period that matches your stated purpose – crime prevention, resident safety – document the reasoning, and configure the system to overwrite automatically on that schedule rather than keeping footage indefinitely.
Can the police ask for our CCTV footage?
Yes, and handing it over for a genuine, specific investigation is usually lawful. Ask what they need and why, check the request is proportionate, and keep a disclosure log recording what was given, to whom and on what basis – it isn’t usually compulsory without a court order.