Do I need an SIA licence to work as a CCTV operator?

If you work under a contract for services and use CCTV to watch or identify people to guard against disorder or protect people from assault, the SIA says you need a Public Space Surveillance (CCTV) licence. This course does not give you a licence or replace licence training.

How long can CCTV footage be kept?

The law sets no fixed period. The ICO says to keep it for the shortest time your purpose needs and then delete it.

Can someone ask for CCTV footage of themselves?

Yes. This is a subject access request. It can be made in writing or verbally, and it must usually be answered within one month.

Can I give footage to the police?

Often yes, but follow your site procedure. Exemptions for preventing and detecting crime are decided case by case, and the disclosure and reasons should be recorded.

Is the certificate accredited or officially recognised?

No. It is a private certificate of completion for knowledge only. It is not recognised, accredited or approved by any government, licensing body, regulator or educational institution, and it does not replace any licence, certification or training required by law.

CCTV and Data Protection Course (UK) 2026

Question 1 of 25

A member of the public wants to complain about how a shop uses its CCTV. Which body deals with data protection in the UK?

The Security Industry Authority (SIA)
The Health and Safety Executive (HSE)
The Information Commissioner's Office
Trading Standards at the local council

Show answer

Answer: C. The Information Commissioner's Office

The ICO is the UK's data protection regulator. Its video surveillance guidance covers CCTV used by organisations under the UK GDPR and the Data Protection Act 2018.

Question 2 of 25

A camera records clear pictures of shoppers who can be recognised. What are these images under data protection law?

Business records with no privacy rules
Public property that anyone may use
Personal data only if sound is recorded
Personal data about the people shown

Show answer

Answer: D. Personal data about the people shown

The ICO says images and voices of people who can be identified are their personal information, so data protection law applies.

Question 3 of 25

Which data protection principle means footage must not be kept for longer than it is needed?

Accuracy
Accountability
Storage limitation
Purpose limitation

Show answer

Answer: C. Storage limitation

Storage limitation is one of the principles in Article 5 of the UK GDPR. Data must not be kept longer than needed for its purpose.

Question 4 of 25

A camera only needs to watch a car park entrance, but it also films a bus stop across the road. Which principle is most at risk?

Accountability
Accuracy
Integrity and confidentiality
Data minimisation

Show answer

Answer: D. Data minimisation

Data minimisation means collecting only what you need for your purpose. Filming an extra public area is more than the purpose needs.

Question 5 of 25

Your manager says the law requires all CCTV footage to be kept for exactly 31 days. What does the ICO say?

The 31-day rule applies only in Scotland
The law sets a minimum of 90 days
That is correct for every UK system
The law sets no fixed minimum or maximum

Show answer

Answer: D. The law sets no fixed minimum or maximum

The ICO says the UK GDPR and the DPA 2018 do not set a minimum or maximum retention period. Keep footage for the shortest time your purpose needs.

Question 6 of 25

According to the ICO, what should a CCTV sign usually tell people?

Opening hours and the number of cameras
The names of the control room staff
Who runs it, why, and how to contact them
The camera make, model and serial number

Show answer

Answer: C. Who runs it, why, and how to contact them

ICO guidance says signs should be clear and readable and give the operator, the purpose and basic contact details, such as a website, phone number or email.

Question 7 of 25

A new CCTV system can also record sound. What does the ICO recommend?

Turn audio on only during the night shift
Keep audio on at all times for evidence
Let each operator choose when to use it
Keep audio off by default, for rare use only

Show answer

Answer: D. Keep audio off by default, for rare use only

The ICO says audio should be switched off by default and used only in exceptional cases, for example with a trigger switch.

Question 8 of 25

The ICO gives an example of when the date and time stamp on recordings may become wrong. What is it?

When the clocks change for summer or winter time
When a camera lens is cleaned
When footage is played back at high speed
When operators change shift

Show answer

Answer: A. When the clocks change for summer or winter time

The ICO asks for regular checks that the date and time stamp is accurate and gives the clock change between summer and winter time as an example.

Question 9 of 25

When should a data protection impact assessment (DPIA) be done for a surveillance system?

Before using a system likely to be high risk
Only after a data breach has been reported
Once the system has been running for a year
Only after someone complains to the ICO

Show answer

Answer: A. Before using a system likely to be high risk

The ICO says a DPIA should be done before deploying a surveillance system that is likely to result in a high risk to people.

Question 10 of 25

A DPIA shows a high risk that cannot be reduced. What must happen before the processing starts?

The ICO must be consulted
The police must inspect the cameras
The SIA must issue a new licence
The local council must approve the signs

Show answer

Answer: A. The ICO must be consulted

If high risks cannot be reduced, the organisation must consult the ICO before it starts the processing.

Question 11 of 25

Which lawful basis does the ICO say is most likely for CCTV run by a private company?

Vital interests
Legitimate interests
A contract with every visitor
Consent from every person filmed

Show answer

Answer: B. Legitimate interests

The ICO says the lawful basis for surveillance will usually be legitimate interests, or public task for public bodies. Consent is hard to get in public spaces.

Question 12 of 25

Under data protection law, who is the controller of a CCTV system?

Whoever decides why and how footage is used
The company that installed all the cameras
Any person who appears in the recordings
The operator who is on shift at the time

Show answer

Answer: A. Whoever decides why and how footage is used

The controller decides the purposes and means of the processing and is legally responsible for following data protection law.

Question 13 of 25

Where does the Surveillance Camera Code of Practice apply?

Northern Ireland only
Scotland only
The whole of the UK
England and Wales

Show answer

Answer: D. England and Wales

The code is made under the Protection of Freedoms Act 2012 and applies to public places in England and Wales. Scotland and Northern Ireland are not covered.

Question 14 of 25

Who must have regard to the Surveillance Camera Code of Practice?

Relevant authorities, like police and councils
Only shops that sell alcohol late at night
Only private firms with more than 250 staff
Every household that has a video doorbell

Show answer

Answer: A. Relevant authorities, like police and councils

Section 33 of the Protection of Freedoms Act 2012 says relevant authorities, such as the police and local authorities, must have regard to the code. Others are encouraged to follow it.

Question 15 of 25

Which document sets out principles for public space CCTV in Scotland?

The Surveillance Camera Code for England
The Licensing Act 2003
The Highway Code
The CCTV Strategy for Scotland (2011)

Show answer

Answer: D. The CCTV Strategy for Scotland (2011)

The ICO notes that the Scottish Government's CCTV Strategy for Scotland (2011) sets out principles for public space CCTV operators.

Question 16 of 25

A contracted operator watches CCTV to guard against disorder and protect people from assault. Which SIA licence covers this?

Close Protection
Cash and Valuables in Transit
No licence is needed for CCTV work
Public Space Surveillance (CCTV)

Show answer

Answer: D. Public Space Surveillance (CCTV)

The SIA says a CCTV licence is needed to use CCTV to watch or identify people in order to guard against disorder or protect people from assault.

Question 17 of 25

A licensed door supervisor uses a CCTV screen only to spot a trespasser and protect property. What does the SIA say?

Only the police may watch CCTV screens
They must also hold a CCTV licence
They need a separate data protection licence
Their door supervisor licence covers this

Show answer

Answer: D. Their door supervisor licence covers this

The SIA says door supervisor, close protection and security guarding licences cover using CCTV to identify a trespasser or protect property.

Question 18 of 25

A contracted officer wears a body camera but never watches any of its footage. Does this need a CCTV licence?

Yes, but only when working night shifts
Only if the camera can also record sound
Yes, anyone wearing a body camera needs one
No, not for wearing it without viewing

Show answer

Answer: D. No, not for wearing it without viewing

The SIA says you do not need a licence if you wear a bodycam or headcam but do not watch any of its footage.

Question 19 of 25

How long does an organisation normally have to answer a subject access request?

Six months
One month
One week
Three months

Show answer

Answer: B. One month

The ICO says a subject access request must be answered without undue delay and at the latest within one month of receiving it.

Question 20 of 25

When can the time to answer a subject access request be extended by up to two more months?

If the footage was recorded at a weekend
If the staff member who handles it is away
If it is complex or the person sent several
If the person did not use the official form

Show answer

Answer: C. If it is complex or the person sent several

The time limit can be extended by up to two further months if the request is complex or the person has made several requests. The person must be told within one month.

Question 21 of 25

A visitor tells you at reception that they want a copy of CCTV footage of themselves. How should this be treated?

As a valid request, even though it was spoken
As invalid until they write a formal letter
As a police matter that must be refused
As invalid unless they say 'subject access'

Show answer

Answer: A. As a valid request, even though it was spoken

The ICO says a request can be made verbally or in writing, and no special words are needed. Pass it on using your site procedure.

Question 22 of 25

Footage asked for in a subject access request also shows other people. What does the ICO say?

Others need not be shown unless they agree or it is reasonable
The clip can be sent only once the police have approved it
The whole request must be refused because others appear
The whole clip must be sent with every face clearly shown

Show answer

Answer: A. Others need not be shown unless they agree or it is reasonable

The ICO says you do not have to give information that reveals another person unless they consent or it is reasonable to disclose it without consent.

Question 23 of 25

An operator copies footage of a fight onto their own phone to post online, without the company agreeing. What is this?

A possible offence under section 170 of the DPA 2018
Allowed, because the fight was in a public place
A private matter for the operator alone
Allowed, if the operator deletes it within a week

Show answer

Answer: A. A possible offence under section 170 of the DPA 2018

Section 170 of the Data Protection Act 2018 makes it an offence to knowingly or recklessly obtain or disclose personal data without the consent of the controller.

Question 24 of 25

A laptop holding CCTV footage is stolen, and the breach is likely to put people at risk. When should it be reported to the ICO?

Within 7 days after the police are told
At the end of the financial year
Within 72 hours of becoming aware of it
Within 30 days of the theft taking place

Show answer

Answer: C. Within 72 hours of becoming aware of it

A reportable breach must be reported without undue delay and no later than 72 hours after the organisation becomes aware of it.

Question 25 of 25

How does the ICO say exemptions, such as the one for preventing and detecting crime, should be used?

As a blanket rule for all police requests
Case by case, with the reasons recorded
Only by the police, never by companies
Only after a court order is issued

Show answer

Answer: B. Case by case, with the reasons recorded

The ICO says each exemption must be considered case by case, not as a blanket rule, and the reasons should be documented.

CCTV and Data Protection Course (UK) 2026

Quick answer

What you will learn

What to know before the test

Frequently asked questions

Sources

Related tests