CCTV in dental practices: CQC, UK GDPR and your DPIA, shown as a security camera icon with a padlock shield

CCTV in Dental Practices: What CQC and the ICO Expect

Liam

3 days ago

4 min read

Updated: 8 hours ago

CCTV in dental practices can improve safety and security, but only if it is used lawfully, proportionately and with proper governance behind it. Here is what CQC, the ICO and the law expect.

What CQC says about CCTV

CQC has published Dental mythbuster 22: CCTV in dental practices. It states that CCTV "can enhance safety and security, but you must use it appropriately and ensure it meets data security requirements." CQC considers data protection and CCTV when it reviews the well-led key question, which links to Regulation 17: Good governance.

The mythbuster distinguishes between two types of recording:

Overt recording uses cameras that are clearly visible. Public areas such as the waiting room, reception or car park could be under surveillance. Cameras must not record personal areas such as toilets or changing rooms.
Covert recording happens without people's knowledge. CQC says dental practices would not normally undertake this.

Crucially, CQC describes the dental treatment room as a private area and says you should not use equipment there to record private conversations.

CQC's wider guidance, Using surveillance in your care service, explains that if surveillance is used to keep people safe, CQC treats it as part of their care, so it must meet the regulations under the Health and Social Care Act. The recordings are also personal information, which is regulated by the ICO.

The 7 principles CQC checks

CQC's page How we check the use of surveillance lists 7 principles and links each to the regulations:

Safeguarded (Regulations 12 and 13)
Secured (Regulation 15)
Privacy, with dignity at the heart of decisions (Regulation 10: Dignity and respect)
Involved (Regulations 9 and 11)
Lawful, including UK GDPR, the Human Rights Act 1998 and ICO guidance (Regulation 17)
Trained (Regulation 18)
Transparent (UK GDPR Article 5 principles)

CQC also states that if you use CCTV you must be registered with the ICO, and that it expects a completed DPIA, as many services provide diagnosis and treatment.

UK GDPR and the Data Protection Act 2018

Images of identifiable people are personal data. The mythbuster says practices using CCTV must have governance arrangements that satisfy the Data Protection Act 2018 and should follow ICO good practice. The ICO's video surveillance guidance stresses that surveillance should be lawful, necessary and proportionate.

Article 8 of the Human Rights Act 1998, the right to respect for private and family life, also applies, which is why camera placement matters so much.

Your DPIA: the document that holds it together

The ICO says that if your use of CCTV is likely to result in a high risk to people, you need a Data Protection Impact Assessment, giving cameras in private areas and staff monitoring as examples. If you identify a high risk that you cannot reduce, you must contact the ICO before you start. CQC says your reasons for using CCTV should be covered in your DPIA. In practice, I advise every dental practice with CCTV to have one.

Your DPIA should cover:

the specific purpose, such as security or protecting staff
why CCTV is necessary and whether less intrusive options were considered
your documented lawful basis
camera locations and fields of view, excluding treatment rooms and toilets
whether audio is recorded and why
retention, security, access controls and encryption
how you handle disclosures and subject access requests
any processor contracts, such as with your installer or cloud provider
regular review of whether CCTV remains necessary and proportionate

Audio, signage and staff monitoring

The ICO describes recording conversations between members of the public as highly intrusive and unlikely to be justifiable in most circumstances. Where audio is genuinely needed, for example because staff face frequent verbal abuse, you must make clear that it is being recorded. For a dental practice, I would treat audio as off by default.

Signage must be clear and prominent, explain the purpose of recording and give the name and contact details of the operator. Your privacy notice, including on your website, should cover everyone who may be recorded: patients, visitors and staff.

Using cameras to monitor staff is one of the ICO's examples of high-risk use, so be open about it, record it in your DPIA and set out disciplinary consequences for misusing the system, as CQC expects.

Retention and subject access requests

The law sets no fixed retention period. The ICO says the purpose should determine it, and that the period should be the shortest needed for that purpose. Turn on automatic overwrite.

People can ask for copies of footage of themselves. Your system must allow you to retrieve footage and redact or remove other people where necessary. CQC inspectors can also view, copy or seize recordings under sections 62 and 63 of the Health and Social Care Act 2008.

The Surveillance Camera Code of Practice

The Surveillance Camera Code of Practice mainly applies to relevant authorities such as the police and local authorities. Private dental practices are not bound by it, but its principles are useful good practice.

Quick CCTV checklist

ICO registration in place
Completed DPIA, reviewed regularly
No cameras in treatment rooms, toilets or changing areas
Audio off unless justified and documented
Clear signage and an updated privacy notice
CCTV policy covering retention, access, disclosure and SARs
Secure, password-protected system with an audit trail
Staff trained on the system

How I can help

Registering a new dental practice or preparing for inspection? I can review your CCTV policy, DPIA and wider governance. Find out more about my CQC registration application support.

If you want an independent check of your practice, a dental CQC mock inspection can help you spot gaps before CQC does.

For wider help with your policies, governance and inspection readiness, see my CQC compliance support.