The revelation comes as new legislation is about to take effect in Scotland which could render even more systems illegal.
Companies whose premises have CCTV systems in operation must alert the Information Commissioner that they are gathering personal information about the people they are recording. They must also put up signs to warn the public that recording is taking place.
A new law will come into force in Scotland on 1st November requiring those operating systems on a contract to have a separate licence. The law, which is already in effect in England and Wales, does not apply to operators working directly for the company whose premises are being surveyed.
Bernie Brooks of CCTV compliance consultancy DatPro told OUT-LAW Radio that he comes across few systems that operate within the law.
"From my own my experience after personally surveying many, many hundreds of buildings, I would say probably less than 5% are compliant," said Brooks. "I would say that 95% are non-compliant in one way, shape, form or another with the [Data Protection] Act. Obviously that's quite a worrying thing. If the system is non-compliant it could invalidate the usefulness of the evidence in a court of law."
Brooks's assessment matches that of non-profit CCTV awareness raising body Camerawatch. It said in June that its research showed that over 90% of the UK's 4.2 million CCTV systems were not compliant with the Data Protection Act.
"That has profound implications for the reputation of the CCTV and camera surveillance industry and all concerned with it," said Camerawatch chairman Gordon Ferrie in June.
The new law in Scotland could push even more systems into illegal territory. The new licences for individuals is operated by the Security Industry Authority (SIA).
"If you operate CCTV equipment monitoring public or private space and you are monitoring members of the public then it is likely you will need a SIA licence," said SIA head of investigations Jennifer Pattinson. "The reason for licensing is to remove the criminal element from the private security industry but also to improve levels of training and professionalism in the industry."
People who work directly for the firm which owns the monitored premises do not need a licence. Pattinson said that this was because companies which directly employ security workers are likely to conduct the kind of thorough background checks that it does when issuing a licence.
The news that almost all systems are likely to operate illegally will raise questions about the effectiveness of CCTV.
The news follows the revelation last week that London's dense network of CCTV cameras may not have an effect on the solving of crimes. An analysis of London's 10,000 cameras showed that boroughs with many cameras had no better crime-solving statistics than those with few cameras.