Yes, installing CCTV is allowed under GDPR and the Data Protection Act 2018 if you have a valid purpose, like security, and tell staff through a policy or signage.
Data should be stored securely—typically for 30 days—and only used for the stated reason. Overreach could breach privacy laws and risk ICO penalties. Legal guidance ensures your setup respects rights while meeting practical needs. Position cameras thoughtfully—avoid break areas—to keep staff comfortable and compliant. Test your system periodically to ensure it’s working and not recording more than intended.
Helpful government guidance is available at: Data protection and CCTV on GOV.UK.