Last updated and effective: August 1, 2026
We, McKinsey & Company, United States, and its subsidiaries and affiliates, understand that your privacy is important to you. We are committed to respecting your privacy and protecting your personal data. This privacy notice describes how we handle and protect your personal data when we collect it through our closed-circuit television ("CCTV") and video surveillance systems. This privacy notice supplements the McKinsey.com Privacy Notice, McKinsey HR Privacy Notice, and McKinsey EW Privacy Notice, as appropriate (collectively, the “Privacy Notice”). In case of a conflict between this supplemental notice and another McKinsey Privacy Notice, this supplemental notice will govern as regards personal data collected by the Firm for CCTV purposes. In case of a conflict between the Privacy Notice and applicable law, applicable law will govern. This Privacy Notice applies to all individuals whose images or information may be captured by our surveillance equipment, including employees, contractors, visitors, and members of the public.
This Privacy Notice should be read alongside any local or site-specific privacy notices, signage, or addenda that may provide additional information relevant to a particular location or jurisdiction.
Where CCTV is in operation, individuals will be informed through appropriate signage. By accessing or visiting a monitored area, you acknowledge and understand CCTV footage containing your image and other personal data may be collected and processed for the purposes described in this Privacy Notice. If you do not understand or agree with any part of this Privacy Notice, please refrain from accessing or visiting our offices or facilities and contact us using the details provided below before your visit.
1. How do we collect your personal data?
Our CCTV systems may collect the following categories of personal data:
- Video footage: Visual images and recordings of individuals and their activities within monitored areas.
- Metadata: Associated technical data including date, time, camera identifier, and location of recording.
Our CCTV systems do not capture audio recordings unless separately disclosed in a location-specific notice and permitted by applicable law. Where audio recording is in use, additional signage will be displayed and a supplementary notice will be provided.
Clearly visible signage is posted at or near the entrances to all monitored areas, alerting individuals to the presence of CCTV cameras before they enter the surveilled space. Signage identifies the data controller and provides a reference to this Notice or a means of obtaining further information.
2. Why and how are we using your personal data?
We operate CCTV systems solely for the following legitimate purposes:
- Protecting the health, safety, and security of employees, contractors, visitors, and members of the public on or near our premises;
- Safeguarding our physical premises, property, assets, systems, and confidential information;
- Preventing, deterring, detecting, and investigating criminal activity, theft, vandalism, and other security incidents;
- Supporting emergency response, evacuation procedures, and access control;
- Establishing, exercising, or defending legal claims; and
- Complying with legal or regulatory obligations where applicable.
Our primary legal basis for processing personal data through CCTV is our legitimate interests in security and safety. In certain circumstances, we may also rely on the following legal bases:
- Legal Obligation – where we are required by law or regulation to maintain CCTV surveillance.
- Vital Interests: – in exceptional circumstances where processing is necessary to protect the vital interests of a data subject or another individual (e.g., locating a missing person or responding to a medical emergency).
- Public Interest / Legal Claims – where footage is necessary for the establishment, exercise, or defense of legal claims.
In certain jurisdictions, we process CCTV data in accordance with local legal requirements. The applicable legal basis may include:
- Legitimate business interests in protecting persons, property, and assets;
- Compliance with local security, health and safety, or surveillance regulations;
- Consent, where required by local law (e.g., in certain circumstances in specific jurisdictions);
- Performance of a legal obligation; or
- Protection of vital interests.
Where a different or additional legal basis applies at a particular location, this will be identified in the applicable local notice or addendum.
3. What do we not do when we collect and process your personal data?
Our CCTV systems are NOT used for:
- Facial recognition or biometric identification: We do not deploy facial recognition technology, biometric analysis, or any automated identification systems in connection with our CCTV footage.
- Privacy-sensitive areas: CCTV cameras are not installed in, and do not monitor, areas where individuals have a heightened expectation of privacy, including restrooms, changing rooms, locker rooms, prayer or meditation rooms, and similar private spaces.
- Marketing or advertising: Footage is not used for marketing, advertising, customer profiling, or any commercial behavioral analysis.
4. Jurisdiction-specific variations
This Privacy Notice sets out our global approach to CCTV privacy. In certain jurisdictions, local laws may require additional or different measures. Local notices or addenda may supplement or, where required by local law, override provisions of this Privacy Notice.
Notable Jurisdiction-Specific Considerations:
- Works council / employee representative consultation – in jurisdictions where the installation or operation of CCTV in the workplace requires prior consultation with a works council, employee representative body, or labor authority, we undertake such consultation before activating surveillance in those locations.
- Signage content and format requirements – certain jurisdictions prescribe specific information that must appear on CCTV signage (e.g., controller identity, purpose, contact details, legal basis). Our signage complies with all applicable local content and format requirements.
- Prescribed maximum retention periods – some jurisdictions impose specific maximum retention periods for CCTV footage. Where such limits apply, our retention practices comply with the prescribed maximum, which may be shorter than the standard period stated in this Notice.
Where a local notice or addendum applies, it will be made available at the relevant site (e.g., via on-site signage, office receptionist, employee handbooks, or intranet postings) and will be provided upon request.
5. Contact us
We welcome questions, comments, and feedback on this Privacy Notice and our management of personal data, including any requests to exercise your privacy rights. If you have questions, concerns, feedback, or would like to submit a privacy rights request, you can always contact us at privacy@mckinsey.com. For your protection, we may need to verify your identity before assisting with your questions, comments, feedback, or privacy rights request.
Your California Privacy Rights Appendix
This appendix seeks to provide additional information to residents of California and supplements the information provided in the Privacy Notice.
We do not “sell” or “share” personal data governed by this supplemental notice (as those terms are defined under California privacy law). Moreover, we do not share personal data with third parties for their own direct marketing purposes without your consent.
To learn more about the categories of personal data we collect, how we collect it, why it is collected, with whom we share it, and how long we retain it, please see the items below.
Categories of personal information collected
Through our CCTV systems, we collect the following categories of personal information (as defined under the CCPA/CPRA):
- Sensory / Visual Data: Video images and recordings of individuals captured by surveillance cameras.
- Identifiers (indirect): Physical appearance and characteristics observable in footage that may, in combination with other information, identify an individual.
- Metadata: Date, time, location, and camera identifier associated with recordings.
Business / commercial purpose
Personal information collected via CCTV is used exclusively for the following business purposes, as described in section 2 of this Notice:
- Protecting the safety and security of individuals, premises, property, and assets;
- Preventing, detecting, and investigating security incidents, criminal activity, and fraud;
- Supporting emergency response and access management;
- Complying with legal obligations; and
- Establishing, exercising, or defending legal claims.
Categories of third parties receiving data
Personal information collected through CCTV may be disclosed to the following categories of third parties, as further described in the McKinsey.com Privacy Notice:
- Security service providers and monitoring companies;
- Law enforcement agencies and regulatory authorities (in response to lawful requests or legal obligations);
- Legal counsel and professional advisors;
- Insurers (in connection with claims); and
- Courts and tribunals (in connection with legal proceedings).