How to choose and set up smart cameras, doorbells and other connected devices securely, what UK law requires of manufacturers, and your responsibilities if a camera films beyond your home.
Smart cameras, video doorbells, speakers and plugs make homes more convenient, but every connected device is also a possible way in for attackers and a source of personal data. Most problems come from weak passwords, missing updates and careless settings, all of which you can control. This guide covers choosing devices, setting them up securely and staying on the right side of data protection law.
What UK law now requires of manufacturers?
Since 29 April 2024, the UK's product security regime under the Product Security and Telecommunications Infrastructure (PSTI) Act has required manufacturers of consumer connectable products sold in the UK to:
- ban universal default passwords such as "admin" or "12345";
- publish a way to report security vulnerabilities;
- state the minimum period for which the product will receive security updates.
That support period is a useful buying signal: a cheap device that will stop receiving updates in a year may not be good value.
Before you buy
- Check the security update period on the product page or packaging.
- Prefer established brands with a track record of updates and a clear privacy policy.
- Check where footage is stored: locally (on a memory card or home hub) or in the cloud, and whether cloud storage needs a subscription.
- Look for two-step verification on the app account and end-to-end encryption options for video.
- Be cautious with unknown brands from online marketplaces, which may lack updates or support.
Setting up securely: step by step
- Secure your router first: change its admin password, keep its firmware updated and use WPA2 or WPA3 Wi-Fi encryption.
- Create a strong, unique password for the device's app account, ideally with a password manager.
- Turn on two-step verification for the account.
- Install updates and turn on automatic updates if available.
- Review privacy settings: disable features you don't need, such as audio recording, sharing with neighbours or facial recognition.
- Consider a guest network for smart devices, so they are separated from your computers and phones.
- Check who has access: remove old users and devices from shared accounts.
The NCSC publishes guidance on using smart devices safely in the home, including how to set up and maintain them.
Cameras and the law: filming beyond your home
If your camera only captures images within your property, data protection law does not usually apply to you as a household. But if it captures images or audio beyond your boundary, such as a neighbour's garden, the street or a shared path, the ICO says you must comply with data protection law. That includes:
- having a clear reason for capturing those areas;
- letting people know, for example with a sign;
- keeping footage secure and only as long as you need it;
- responding if someone asks for footage of themselves (a subject access request) or asks you to delete it.
Audio recording is particularly intrusive; consider turning it off. Angle cameras to cover only what you need, and use privacy masking features to block out neighbours' windows and gardens. Talking to neighbours before installing a camera avoids many disputes.
Ongoing habits
- Check for updates every few months, and replace devices that are no longer supported.
- Review the app's connected devices and logins.
- Delete old footage you don't need.
- Before selling or recycling a device, remove it from your account and factory reset it.
Signs a device may be compromised
- Settings changing without you.
- Unknown logins or devices in the app.
- Unexpected sounds from a camera's speaker, or the camera moving.
If you suspect a problem, change the account password, check two-step verification, update the device, and contact the manufacturer.
Frequently asked questions
Are cloud subscriptions necessary?
Not always. Many devices offer local storage. Compare the ongoing cost before buying.
Can a landlord install cameras?
In shared areas, sometimes, with data protection obligations. Inside a tenant's home, it would be highly intrusive and is generally not acceptable without clear consent.
Sources and further reading
- GOV.UK: The UK Product Security and Telecommunications Infrastructure (PSTI) regime
- ICO: Home CCTV systems
- NCSC: Smart devices in the home
Facts checked on 20 October 2026. Spotted an error? Tell us and we will correct it.