The CCTV
warning sign

Yes, and it doesn't depend on the size of the business or on whether the owner is a company or a private individual: if a camera captures people in any area where anyone other than you passes through, you need a sign. It makes no difference whether it's a thirty-square-metre shop, a detached house with a garden visible from the street or a shared garage. The only exemption is a camera that captures nobody but the owner, which in practice is rare: even a camera pointed at your own front door captures the postman, visitors and neighbours walking past. The obligation arises the moment the camera starts recording, not when someone complains or there's an inspection, so there's no point waiting until the system is installed to sort out the sign: they're two steps done at the same time, and the second costs far less than the first.

Those four things cover the essentials, but it's worth understanding why those four and not others: each answers a question asked by anyone entering the recorded area. "Am I being recorded?" is answered by the pictogram. "Who is doing it?" is answered by the name of the controller. "What for?" is answered by the purpose, and a generic line such as the security of people and property is enough here; there's no need to describe the system. And "what do I do if I want to ask, or have my images deleted?" is answered by the contact. If any of the four is missing, someone is left unable to answer one of those questions on their own, which is exactly what the sign exists to prevent. You don't need an elaborate design or a long text: one sentence per point, in a size that can be read standing at a reasonable distance, does the job perfectly. What doesn't comply is cramming all four into text so dense that nobody stops to read it.

Because that sign was designed to "warn that there's surveillance", which was the standard years ago, not to "identify who's doing the surveillance", which is what's required now. It's a common lag: the sign was bought once, a long time ago, and nobody has looked at it since because at a glance it seems to do its job. The problem is that this kind of sign leaves anyone entering with no way of exercising their rights over those images, which is precisely what the rules want to guarantee. The solution isn't to throw the old sign away, which is almost never necessary: just add a small sticker or a supplementary sign with the controller's name and the contact details, placed next to the one you already have. It's a fix that takes minutes and costs next to nothing, and it's the quickest check you can do yourself today: step outside, look at your sign and ask yourself whether someone who doesn't know you would know who to write to.

The rule of "before you enter, not inside" has more nuances than it seems in large installations. On an industrial estate with several units belonging to the same owner, each unit needs its own sign if it has its own cameras; one at the entrance to the whole site isn't enough. In a car park with a barrier, the sign goes before the barrier, not inside once you've parked. In an office building where only one company has cameras on its floor, that company's sign doesn't replace the one at the main entrance if the entrance is also recorded by the community of owners, and vice versa: they're different controllers and each informs about its own. And at a home with a camera on the door, the sign (or an equivalent notice, even if more discreet than at a business) must be visible before reaching the point where recording starts, not just when ringing the bell. The underlying idea is always the same: nobody should find out they were being recorded after the fact.

The two layers exist because they're trying to solve different problems with the same piece of paper, and putting everything on the entrance sign would make it unreadable. The first layer is what someone needs to know in three seconds, standing up, before deciding whether to go in: that there are cameras, who put them there and who to ask. The second is what's only needed if someone really wants to exercise a right over their data: details of how long the footage is kept, who else besides the controller can access it and exactly what they can request. Hardly anyone ever asks for the second layer, but it has to exist and be genuinely available to whoever asks for it, not be an empty promise on the sign. The usual way to provide it is a short document kept at the counter or published on a web page, and it's enough for the sign to say clearly where to find it for the whole system to work as it should.

You can, and it's handy for anyone who really wants to read the full second layer without filling the main sign with text. The limit is what it can and can't replace: the basic information (that there are cameras, who's recording and what for) must be readable standing up without getting your phone out, because not everyone walking past wants to, or can, scan a code at that moment. A sign that's just a QR code and a pictogram, without a single word of text, leaves out anyone who doesn't want to or can't use their phone right then, and that doesn't comply. The QR code works best as a supplement to the second layer: someone reads the essentials on the sign, and if they want more detail (time limits, recipients, how to exercise their rights) they scan the code and go straight to that page, without having to look for it themselves or ask at the counter.

No, as long as the camera really is a dummy and records nothing: without image capture there's no data processing, and without processing the obligation to inform doesn't arise. But be realistic about what a dummy camera buys you: it doesn't deter as much as you'd think, because anyone with a bit of experience quickly tells an empty housing from real equipment, and it certainly isn't any use as evidence if something happens. It's common to find businesses that started with a dummy camera for budget reasons and eventually replaced it with a real one without changing anything else: no sign, no notice, and nobody realised their legal position changed that day. If you have dummy cameras and at some point plan to move to a real system, bear it in mind from the start: the sign and the paperwork aren't an afterthought, they're part of the installation itself, just like the cabling or the recorder.

You still need one, and it's a case people underestimate because it feels like "my camera, my property". As soon as the lens reaches a person who isn't you (a courier ringing the bell, a visitor crossing the garden, a neighbour walking along the pavement outside), that person has the same rights as anywhere else, and the sign or equivalent notice is still required even though the owner is a private individual rather than a business. What's different at a home is that the notice can be more discreet than a commercial sign: a small sticker next to the doorbell is usually enough. The real limit for a home camera isn't the sign, it's the framing: routinely capturing the public road, or intruding on the neighbour's property beyond what's strictly needed to protect yours, is a different and more serious problem than having no sign, and needs looking at separately by adjusting the camera angle.