A car gets keyed in the residents' car park on a Tuesday night. By Wednesday morning, three leaseholders are asking the same question in the group chat. Who runs the cameras in this block, and can anyone get the footage?
Nobody on the board is quite sure. That uncertainty is the real risk here, not the scratched paintwork.
If a right to manage company runs your building, CCTV in communal areas is entirely possible. But the legal responsibilities sit with you, the directors, from the day the cameras go live. Right to Manage (RTM) only exists in England and Wales. The data protection rules that apply once the cameras go on cover the whole UK.
The starting point is the lease, not your preference as a board. Cameras in a hallway, lobby or car park are usually treated as an improvement to the building, not a repair. Most leases only give the landlord a clear power to carry out repairs without wider agreement. Once the right to manage is exercised, the same limit applies to your RTM company as to the landlord.
If the lease is silent on improvements, or says something closer to "repair and maintain", you have a gap. Look at it before you order equipment, not after.
Your company's articles of association matter too. Your objects clause and any internal rules set out how the board takes decisions. They also say what, if anything, needs wider leaseholder sign-off. Don't assume the board can decide alone. Check what your articles say about capital expenditure or non-repair works first.
Even where the lease and articles support going ahead, one objecting leaseholder doesn't automatically kill the project. But they aren't powerless either. Leaseholders can challenge the reasonableness of the costs at the First-tier Tribunal. That is a different question from whether CCTV is allowed at all. Get the lease position and the cost case straight before you commission anything.
Once cameras record people's comings and goings, your right to manage company is handling personal data. UK GDPR obligations follow automatically.
Crucially, your RTM company is the data controller. UK GDPR Article 4(7) defines the controller as "the natural or legal person... which, alone or jointly with others, determines the purposes and means of the processing". Your board decides why the cameras are there and how the system runs. So the controller is your company. It is not us as installer, not your managing agent and not any individual director.
You may wonder whether the household exemption rescues you. It doesn't. Article 2(2) and Recital 18 exclude processing "by an individual in the course of a purely personal or household activity". But an RTM company is, by definition under section 73 of the Commonhold and Leasehold Reform Act 2002, a private company limited by guarantee. It is a legal person, not an individual. The exemption was never available to it, however small or informal the board feels day to day.
That leaves you needing a lawful basis for the processing. Article 6(1)(f) (legitimate interests) usually fits communal CCTV run for crime prevention and resident safety. But it isn't a free pass. It usually needs a documented balancing exercise, weighing your interest in security against residents' privacy. You can't just assume the cameras are obviously justified.
Your managing agent is typically a processor acting on your instructions, not a controller in its own right. So is any installer who keeps remote access for maintenance. Article 28 requires that relationship to be set out in a written contract. It must cover what they can do with the footage, confidentiality and security. Anyone who holds that access, us included, should do so under terms your board has agreed. Ask for that contract in writing if you don't already have one.
One caveat. If an agent or installer starts making its own decisions about how footage is used, it can become a controller in its own right. Reselling footage or keeping its own copies for its own purposes are examples. It then carries its own compliance duties. Your board should check that, not assume either way.
Work through these checks, and revisit them as your directors change.
Signage isn't decorative. Each sign needs to tell residents and visitors that CCTV is in operation. It needs to say what it's for, such as crime prevention and resident safety. It also needs to say how to contact the controller, which is your company, with questions. Position signs so people see them before they enter the monitored area, not only once they're standing under the camera.
The system has to match the policy your board writes. We'd talk each of these design points through with your board at survey stage. All our engineers are Enhanced DBS checked, which matters when the building is people's homes. We install and maintain commercial CCTV Security Systems, and we've been NSI Gold certified for security since 2005 (check the NSI register) and we're SSAIB certified for CCTV.
Camera positioning is the first decision that matters. Aim lenses away from flat front doors and windows. That keeps the system on shared spaces and stops it drifting into anyone's private home. Privacy masking can then blank out a window or balcony that a wider-angle lens would otherwise catch.
Audio is a separate decision. Whether to record sound at all deserves its own careful thought from your board. It raises a harder-to-justify set of questions than video alone. So it shouldn't simply be left switched on.
Next, the system should follow your retention period. Automatic overwrite timed to that period means footage doesn't quietly outlive its purpose because nobody remembered to delete it. Separate user accounts for each role back up the "authorise the role, not the person" approach. A log of who viewed or exported what, and when, completes the picture.
Remote access needs the same care, whether it is for an installer, a managing agent or a director. Remote viewing through mobile and tablet apps is a feature of the systems we install. It should run over a secured connection with its own audit trail. A shared password passed around by email is not acceptable.
Last, plan for the day a subject access request or police request lands. A clean export process pulls exactly the relevant clip and nothing more. That stops your board over-disclosing, or missing the deadline while someone hunts for the right recording.
None of this is one clever feature. It is cumulative. Good CCTV for flats is largely this kind of ordinary discipline, applied consistently: positioning, masking, audio, retention and logged access.
Before you commit to a quote, check the lease actually lets you recover CCTV costs through the service charge. Taking on the right to manage transfers the landlord's existing management functions to your company. It also transfers the existing lease's service charge machinery. It doesn't create a new power to charge for something the lease never provided for. If the lease is silent on this kind of expenditure, consultation rules alone won't fix that. You'd be looking at a lease variation or a voluntary contribution instead.
Where the lease does cover it, section 20 of the Landlord and Tenant Act 1985 sets a consultation threshold. It is £250 per leaseholder for each set of "qualifying works". Skip the consultation without tribunal dispensation and recovery is capped at £250 per leaseholder, even if the real cost is higher.
A separate consultation applies to qualifying long-term agreements. These are contracts running over 12 months, such as ongoing monitoring or maintenance. The Service Charges (Consultation Requirements) (England) Regulations 2003 apply where any leaseholder's contribution would exceed £100 a year. A three-year monitoring contract can trip this threshold even when the installation itself stayed under £250. So check both figures separately.
Our own maintenance contracts roll over every 12 months, with no long-term lock-in. Whoever you choose, check the term of any agreement against that £100 threshold before you sign.
What if your lease genuinely doesn't provide for recovering CCTV costs? There is a real route to fix that. Schedule 7, paragraph 10 of the Commonhold and Leasehold Reform Act 2002 lets an RTM company apply to the First-tier Tribunal. The application is made under Part 4 of the Landlord and Tenant Act 1987, to vary leases that don't adequately provide for recovering management costs. It isn't a quick fix, so take proper legal advice before starting down that path.
A leaseholder fitting a video doorbell on their own front door is usually covered by the household exemption. That holds right up until its field of view extends beyond their own threshold.
The moment a doorbell camera or personal CCTV unit also captures a shared corridor, a communal car park or a neighbour's door, the position changes. As the county court case Fairhurst v Woodard illustrates, it stops being purely domestic. At that point, the resident who installed it takes on their own UK GDPR obligations for that footage. These are separate from anything your company runs.
There is a practical side too. Fixing anything to the common parts, including a doorbell camera on a shared landing, generally needs the consent your lease requires for alterations. That applies regardless of the data protection question. If a resident asks about a doorbell that might catch a shared hallway, we're happy to talk through where the line sits first.
None of this makes CCTV in a residential block a legal minefield to avoid. It means treating it as what it is: a system your company controls. The decisions need documenting, and the policy needs reviewing as directors change.
Family-run since 1979 means we're not going anywhere once your system is in. Our free security survey is the easiest place to start. The surveyor who looks at your block introduces you to the engineer who does the work.
If you already have a system running and aren't sure the paperwork behind it holds up, tell us. We'll talk through the system and what your board may want to tighten up.
Call us on 01702 447800 (Monday to Friday, 08:30 to 17:00) or email info@blakefire-security.co.uk. You can also use our contact page or book a free security survey.
Yes, provided your lease supports non-repair works, or your company has the right consent route. Your articles of association must also allow the board to proceed. Check both before ordering equipment.
A camera pointed only at your own front door usually stays within the household exemption. The moment its view takes in a shared corridor, stairwell or car park, things change. You are then processing other people's data under UK GDPR in your own right. That is separate from the block's communal system.
Whoever decides why and how the system runs is the data controller (UK GDPR Article 4(7)). For a right to manage company, that is the company, acting through its board. It is not the managing agent or the installer. Agents and installers with system access are usually processors acting under a written contract, not controllers themselves.
Only if the lease actually provides for that kind of cost. If it does, section 20 consultation applies above £250 per leaseholder for the works. A separate £100 threshold applies to long-term monitoring contracts. If the lease doesn't cover it, consultation alone won't create that power.
There is no fixed legal retention period. The storage limitation principle means you need to set a period that matches your stated purpose, such as crime prevention or resident safety. Document the reasoning. Then configure the system to overwrite automatically on that schedule, rather than keeping footage indefinitely.
Yes, and handing it over for a genuine, specific investigation is usually lawful. Ask what they need and why, and check the request is proportionate. Keep a disclosure log recording what was given, to whom and on what basis. It isn't usually compulsory without a court order.
