Any commercial CCTV system that captures identifiable people falls under UK GDPR and the Data Protection Act 2018. That means the footage you record is personal data, and you're responsible for handling it lawfully.
The basics: clear signage telling people they're being recorded and why, a documented retention period (footage shouldn't be kept indefinitely 'just in case'), and a process for responding to subject access requests if someone asks to see footage of themselves.
It's also worth reviewing camera placement regularly — systems installed years ago sometimes capture more than originally intended as layouts change, which can create unnecessary compliance exposure.
A well-documented CCTV policy, reviewed alongside your annual system service, closes most of the gap between 'installed' and 'compliant'.
