Can Someone Film My Property With a Drone?

What UK Law Actually Says About Drone Filming Over Property

The Civil Aviation Authority regulates drone operations in Great Britain under the Air Navigation Order 2016 as amended, and through the UK-retained version of EU regulation 2019/947, which established the Open, Specific, and Certified operational categories. A drone operator does not acquire any automatic right to overfly private land simply because airspace above a certain height is notionally uncontrolled. Landowners retain common-law rights in the column of air immediately above their property to the extent necessary for ordinary use and enjoyment. The 1978 case Bernstein v Skyviews is often cited as foundational authority for this principle, but it predates unmanned aircraft entirely and its precise application to drone overflights has not been definitively settled by UK courts — operators and brokers should treat it as useful background, not as a settled drone-specific rule.

Within the Open category, the UK CAA framework divides operations into three subcategories with distinct weight and separation requirements. Subcategory A1 covers drones under 250 g (and, where a C1 class label applies, under 900 g), which may fly over uninvolved persons but not over assemblies of people. Subcategory A2 covers drones up to 4 kg and requires a minimum 30-metre horizontal separation from uninvolved persons in normal mode, reducible to 5 metres in low-speed mode where the drone supports it. Subcategory A3 is reserved for operations away from residential, commercial, recreational, and industrial areas, with a 150-metre separation from such areas. None of these subcategories grant permission to record individuals on private land without a lawful basis under UK GDPR.

Where an operator requires a closer or more complex flight — hovering at low altitude over a residential garden, for instance, or conducting repeated passes over a commercial facility — the CAA's Specific category applies. This demands either a pre-defined risk assessment (PDRA) accepted by the CAA or a bespoke operational authorisation, and the risk methodology mirrors the SORA framework used across EASA member states, giving brokers placing cross-border programmes a common analytical language even post-Brexit. A commonly used starting point for lower-risk Specific-category work is PDRA-G01, which covers VLOS operations over a controlled ground area — operators should confirm with the CAA whether their specific flight profile falls within its scope.

Privacy, Data Protection, and the ICO's Reach

UK GDPR applies whenever a drone's camera captures images from which a living individual can be identified — a face, a vehicle registration plate, or even a distinctive garden feature linked to a known address can meet that threshold. The ICO publishes dedicated guidance on drone use (accessible via the ICO's 'Drones and the law' page), making clear that the domestic-purposes exemption is narrow and does not cover commercial operators filming on behalf of a client, even where the client owns the property being filmed. Operators should consult that page directly to verify their current obligations rather than relying on secondary summaries.

For commercial operators, the practical obligations include identifying a lawful basis for processing, providing a privacy notice where feasible, and implementing data-minimisation measures such as restricting recording to the contracted area and deleting footage that captures neighbouring properties. Failure to do so exposes the operator to regulatory enforcement and, more relevantly for insurance purposes, to civil claims from third parties whose data was captured without consent. UK GDPR provides a route for individuals to seek compensation for non-material damage arising from a breach; operators and brokers should take legal advice on the scope of that exposure rather than treating any specific provision as self-explanatory.

Brokers structuring liability programmes for aerial-imaging firms should confirm whether the policy wording extends to data-protection liability or whether a separate cyber and privacy endorsement is required. Hull-only covers will not respond to an ICO enforcement notice or a subject-access dispute, and the gap between a standard public-liability limit and the potential cost of a contested data-breach claim can be material.

When Does Drone Filming Become a Civil Wrong?

Trespass to airspace and private nuisance are the two most likely civil causes of action a property owner can bring against an operator. Trespass requires an intentional and direct intrusion into the claimant's airspace at a height that interferes with ordinary use; nuisance requires a substantial and unreasonable interference with the enjoyment of land, which repeated low-altitude overflights with a running camera can satisfy even without physical contact.

Harassment under the Protection from Harassment Act 1997 is a further avenue where a course of conduct is involved. The legal test for what constitutes a qualifying course of conduct is more nuanced than a simple incident count, and operators facing a harassment allegation should take legal advice rather than assume a bright-line threshold applies. Operators conducting surveillance-style flights over a residential address at the instruction of a client — in matrimonial or insurance-investigation contexts, for example — face the highest exposure here. Liability policies that exclude intentional acts or deliberate surveillance work may leave the operator unindemnified precisely when a claim is most likely.

For brokers, the underwriting question is whether the operator's declared use class accurately reflects the actual flight profile. An operator who describes their work as 'property marketing photography' but accepts instructions for investigative or monitoring flights is presenting a materially different risk. Manuscript endorsements that define permitted use categories and require prior written consent from the property owner before any residential overflight are a practical risk-management tool, not merely a coverage restriction.

Operator Obligations Before the Drone Leaves the Ground

Every commercial operator in Great Britain must hold a CAA Operator ID and ensure their remote pilots hold a valid flyer ID or, for Specific-category work, the appropriate qualification under an approved training scheme. Operator ID registration is required for any drone weighing 250 g or more, and also for any drone fitted with a camera regardless of weight. Registration is completed through the CAA's drone registration portal, costs £10.33 per year at the time of writing, and must be renewed annually — operators should verify the current fee directly with the CAA as it is subject to change. These are threshold eligibility requirements for any commercial liability programme: an operator flying without a current Operator ID is in breach of the ANO and may find their insurer entitled to avoid the policy on grounds of non-disclosure or breach of warranty.

The CAA holds enforcement powers under the ANO that go beyond administrative warnings. It can issue fixed-penalty notices for certain breaches and refer serious or persistent non-compliance to the Crown Prosecution Service. That enforcement exposure is directly relevant to the insurer-avoidance point above: a policy obtained without accurate disclosure of the operator's registration and category status is vulnerable at the point of claim, and a criminal referral arising from the same incident compounds the operator's position significantly.

Operators filming private property on behalf of a commercial client should obtain written confirmation from the commissioning party that all necessary consents — planning, landowner, and data-protection — are in place before flight. That paper trail is not just good practice; it is the evidence an insurer will request when a third-party complaint escalates into a formal claim. For Specific-category operations, note that BVLOS flights cannot be conducted under a standard PDRA such as PDRA-G01 — they require a bespoke Operational Authorisation from the CAA. This is a common misconception among operators transitioning from Open-category VLOS work, and brokers should confirm the correct authorisation is in place before binding cover.

Site surveys, NOTAM checks, and landowner permissions are operational prerequisites that underwriters increasingly treat as warranty conditions rather than recommendations. Where a flight plan requires overflight of congested areas or proximity to aerodromes, the operator must hold the relevant airspace authorisation obtained through the CAA's current drone registration and authorisation channels.

• Operator ID certificate (current, annually renewed, obtained via the CAA drone registration portal)
• Remote pilot flyer ID(s) for all pilots on the programme
• Current SORA or PDRA reference, or bespoke Operational Authorisation for Specific-category and BVLOS work
• Use-class declaration accurately reflecting the actual flight profile
• Evidence of landowner consent process for any residential or commercial overflight
• Confirmation of UK GDPR lawful basis and data-minimisation measures in place

How Liability Cover Responds — and Where It Falls Short

A standard commercial drone liability policy written on an aviation basis will respond to third-party bodily injury and property damage arising from the operation of the drone. Premiums scale with factors including hull value, maximum take-off mass, operational category, and the extent of BVLOS exposure; deductibles typically rise on autonomous or beyond-visual-line-of-sight operations where pilot intervention is limited. These are qualitative indicators — the actual figures depend on the specific risk and should be obtained from a specialist broker rather than assumed from any published guide.

Privacy and data-protection claims occupy a different coverage territory. Most aviation liability wordings were drafted before systematic aerial imaging became routine and do not expressly address ICO enforcement costs, subject-access litigation, or civil damages arising from data-protection breaches. Operators and their brokers should review policy schedules for explicit privacy-liability extensions or arrange a standalone cyber and privacy product to sit alongside the aviation cover.

Where a property owner brings a nuisance or trespass claim, the insurer's response will depend on whether the flight was authorised and whether the operator followed their declared procedures. An operator who can demonstrate a documented pre-flight consent process, a SORA-compliant risk assessment, and compliance with CAA category requirements is in a materially stronger position than one who cannot. The insurance programme is the last line of defence, not the first.

Frequently asked questions

Can a property owner force a drone operator to delete footage captured over their land?

Where the footage contains images of identifiable individuals, the property owner may exercise their right of erasure under UK GDPR, provided no overriding legitimate interest or legal obligation requires the operator to retain it. The ICO can compel compliance if the operator refuses. This right is separate from any airspace or trespass claim and applies even where the flight itself was technically lawful under CAA rules — an operator can be fully compliant with the ANO and still face a valid data-protection erasure request.

What documents should a broker collect at inception for a commercial drone liability programme?

At a minimum: the operator's current CAA Operator ID certificate, flyer IDs for all remote pilots on the programme, the SORA or PDRA reference (or bespoke Operational Authorisation) covering the intended flight category, a use-class declaration that accurately reflects the actual work undertaken, and evidence of the operator's landowner consent process for residential or commercial overflights. For Specific-category programmes involving BVLOS, the bespoke Operational Authorisation from the CAA is a separate document from any PDRA and must be collected independently. Missing any of these at inception creates a disclosure gap that can affect the insurer's ability to respond at claim.

Does Open-category compliance mean a drone operator can film any property without further authorisation?

No. Open-category compliance addresses airspace safety requirements — weight thresholds, separation distances from uninvolved persons, and restricted-zone avoidance — but it does not confer any right to record individuals on private land. UK GDPR obligations apply independently of CAA category, and civil liability for nuisance or trespass to airspace is not extinguished by regulatory compliance. An operator flying a sub-250 g drone within A1 parameters can still face an ICO complaint, a civil nuisance claim, or a harassment allegation if the flight profile and footage handling do not meet the relevant legal standards.