CCTV and Data Protection Course (UK): Lessons 2026

Lesson 1: The law and who enforces it

When a camera records people who can be recognised, it collects personal data. The ICO says the images and voices of people who can be identified are their personal information. That means data protection law applies.

The main laws are the UK GDPR and the Data Protection Act 2018 (DPA 2018). They apply across the UK. The regulator is the Information Commissioner's Office (ICO). It publishes guidance on video surveillance, which covers CCTV, smart doorbells and wireless cameras, ANPR, facial recognition and other fixed and mobile cameras used by organisations. The ICO says this guidance is under review after the Data (Use and Access) Act, so check for updates.

The data protection principles

Article 5 of the UK GDPR sets out seven principles. Here is what they mean for CCTV:

Controllers and processors

The controller decides why and how the footage is used. The controller is legally responsible for following the law. A processor works only on the controller's instructions, under a written contract. Controllers who use surveillance usually have to pay the ICO's data protection fee unless they are exempt.

Lesson 2: Running a system lawfully

Before a system is used

A data protection impact assessment (DPIA) should be done before deploying a system that is likely to result in a high risk to people. If the DPIA finds a high risk that cannot be reduced, the organisation must consult the ICO before it starts.

The ICO says the lawful basis for most surveillance will be legitimate interests, or public task for public bodies. Consent is hard to get from people in a public space, so it is rarely used.

Anzeichen

Signs must be clearly visible and readable. They should say that surveillance is in use and give:

• who runs the system (unless this is obvious)
• the purpose of the system
• basic contact details, such as a website, phone number or email address

Sound, time and security

• Audio should be switched off by default and used only in exceptional cases, for example with a trigger switch.
• Date and time should be checked regularly. Take extra care after the clocks change for summer or winter time. Exported copies should keep the time and date information.
• Security: limit access to authorised people, use encryption where possible and install manufacturer updates.

How long to keep footage

The UK GDPR and the DPA 2018 do not set any minimum or maximum retention period. The organisation sets the shortest period that meets its purpose. When footage is no longer needed, it should be deleted.

Lesson 3: Codes, nations and SIA licensing

Some CCTV rules differ between the nations of the UK.

The code's principles include using a system only for a specified purpose with a pressing need, being transparent, keeping no more images than needed, restricting access and keeping images secure.

SIA licensing

The law requires a licence for some CCTV work. The SIA says a Public Space Surveillance (CCTV) licence is needed if you work under a contract for services and use CCTV to watch or identify people in order to guard against disorder or protect people from assault. This includes watching footage from bodycams or headcams for these purposes.

• Door supervisor, close protection and security guarding licences cover using CCTV to identify a trespasser or protect property.
• You do not need an SIA licence just for wearing a bodycam or headcam if you never watch its footage.
• People who manage, supervise or employ staff doing licensable work need a non-front line licence.

Lesson 4: Requests for footage

Subject access requests

People have the right to a copy of their own personal data, including footage of themselves. This is a subject access request (SAR). The ICO says:

• A request can be made verbally or in writing, including on social media. No special words or form are needed.
• The answer is due within one month of receiving the request.
• The time can be extended by up to two more months if the request is complex or the person has made several requests. The person must be told why within one month.
• If you ask the person to clarify, for example which date they want, the clock pauses until they reply.
• In most cases, no fee can be charged.
• The organisation must make a reasonable and proportionate search.
• You do not have to reveal other people unless they agree or it is reasonable to disclose without their consent.

Requests from the police

Data protection law has an exemption for the prevention and detection of crime. It applies only where following the normal rules would be likely to harm that purpose. The ICO says exemptions must be used case by case, not as a blanket rule, and the reasons should be recorded. Follow your procedure, check the request is genuine and record what was handed over, to whom and why.

Home cameras

If a home camera records beyond the property boundary, the ICO says data protection law applies. The owner should have a clear reason, use a sign, store footage securely and delete it regularly.

Lesson 5: Misuse of footage and data breaches

CCTV gives operators a lot of power over other people's privacy. Use cameras only for the purpose of the system, never out of curiosity or for personal reasons.

Under section 170 of the DPA 2018, it is an offence to knowingly or recklessly obtain or disclose personal data without the consent of the controller. Copying footage to your own phone or posting it online can be this offence.

Data breaches

A personal data breach is a security incident that affects personal data, for example lost, changed or wrongly shared footage, or someone getting unauthorised access to it.

Checklist for operators

• Report a stolen device, lost USB stick or wrongly sent clip to your supervisor at once.
• Never share footage on social media or messaging apps.
• Log every copy of footage you make or hand over.
• Report cameras that are broken, moved or showing private areas.