CCTV and Data Protection Course (UK) 2026

1. Pregunta 1 de 25

   A member of the public wants to complain about how a shop uses its CCTV. Which body deals with data protection in the UK?

   • AThe Security Industry Authority (SIA)
   • BThe Health and Safety Executive (HSE)
   • CThe Information Commissioner's Office
   • DTrading Standards at the local council
   Ver respuesta

   Respuesta: C. The Information Commissioner's Office

   The ICO is the UK's data protection regulator. Its video surveillance guidance covers CCTV used by organisations under the UK GDPR and the Data Protection Act 2018.

2. Pregunta 2 de 25

   A camera records clear pictures of shoppers who can be recognised. What are these images under data protection law?

   • ABusiness records with no privacy rules
   • BPublic property that anyone may use
   • CPersonal data only if sound is recorded
   • DPersonal data about the people shown
   Ver respuesta

   Respuesta: D. Personal data about the people shown

   The ICO says images and voices of people who can be identified are their personal information, so data protection law applies.

3. Pregunta 3 de 25

   Which data protection principle means footage must not be kept for longer than it is needed?

   • AAccuracy
   • BAccountability
   • CStorage limitation
   • DPurpose limitation
   Ver respuesta

   Respuesta: C. Storage limitation

   Storage limitation is one of the principles in Article 5 of the UK GDPR. Data must not be kept longer than needed for its purpose.

4. Pregunta 4 de 25

   A camera only needs to watch a car park entrance, but it also films a bus stop across the road. Which principle is most at risk?

   • AAccountability
   • BAccuracy
   • CIntegrity and confidentiality
   • DData minimisation
   Ver respuesta

   Respuesta: D. Data minimisation

   Data minimisation means collecting only what you need for your purpose. Filming an extra public area is more than the purpose needs.

5. Pregunta 5 de 25

   Your manager says the law requires all CCTV footage to be kept for exactly 31 days. What does the ICO say?

   • AThe 31-day rule applies only in Scotland
   • BThe law sets a minimum of 90 days
   • CThat is correct for every UK system
   • DThe law sets no fixed minimum or maximum
   Ver respuesta

   Respuesta: D. The law sets no fixed minimum or maximum

   The ICO says the UK GDPR and the DPA 2018 do not set a minimum or maximum retention period. Keep footage for the shortest time your purpose needs.

6. Pregunta 6 de 25

   According to the ICO, what should a CCTV sign usually tell people?

   • AOpening hours and the number of cameras
   • BThe names of the control room staff
   • CWho runs it, why, and how to contact them
   • DThe camera make, model and serial number
   Ver respuesta

   Respuesta: C. Who runs it, why, and how to contact them

   ICO guidance says signs should be clear and readable and give the operator, the purpose and basic contact details, such as a website, phone number or email.

7. Pregunta 7 de 25

   A new CCTV system can also record sound. What does the ICO recommend?

   • ATurn audio on only during the night shift
   • BKeep audio on at all times for evidence
   • CLet each operator choose when to use it
   • DKeep audio off by default, for rare use only
   Ver respuesta

   Respuesta: D. Keep audio off by default, for rare use only

   The ICO says audio should be switched off by default and used only in exceptional cases, for example with a trigger switch.

8. Pregunta 8 de 25

   The ICO gives an example of when the date and time stamp on recordings may become wrong. What is it?

   • AWhen the clocks change for summer or winter time
   • BWhen a camera lens is cleaned
   • CWhen footage is played back at high speed
   • DWhen operators change shift
   Ver respuesta

   Respuesta: A. When the clocks change for summer or winter time

   The ICO asks for regular checks that the date and time stamp is accurate and gives the clock change between summer and winter time as an example.

9. Pregunta 9 de 25

   When should a data protection impact assessment (DPIA) be done for a surveillance system?

   • ABefore using a system likely to be high risk
   • BOnly after a data breach has been reported
   • COnce the system has been running for a year
   • DOnly after someone complains to the ICO
   Ver respuesta

   Respuesta: A. Before using a system likely to be high risk

   The ICO says a DPIA should be done before deploying a surveillance system that is likely to result in a high risk to people.

10. Pregunta 10 de 25

    A DPIA shows a high risk that cannot be reduced. What must happen before the processing starts?

    • AThe ICO must be consulted
    • BThe police must inspect the cameras
    • CThe SIA must issue a new licence
    • DThe local council must approve the signs
    Ver respuesta

    Respuesta: A. The ICO must be consulted

    If high risks cannot be reduced, the organisation must consult the ICO before it starts the processing.

11. Pregunta 11 de 25

    Which lawful basis does the ICO say is most likely for CCTV run by a private company?

    • AVital interests
    • BLegitimate interests
    • CA contract with every visitor
    • DConsent from every person filmed
    Ver respuesta

    Respuesta: B. Legitimate interests

    The ICO says the lawful basis for surveillance will usually be legitimate interests, or public task for public bodies. Consent is hard to get in public spaces.

12. Pregunta 12 de 25

    Under data protection law, who is the controller of a CCTV system?

    • AWhoever decides why and how footage is used
    • BThe company that installed all the cameras
    • CAny person who appears in the recordings
    • DThe operator who is on shift at the time
    Ver respuesta

    Respuesta: A. Whoever decides why and how footage is used

    The controller decides the purposes and means of the processing and is legally responsible for following data protection law.

13. Pregunta 13 de 25

    Where does the Surveillance Camera Code of Practice apply?

    • ANorthern Ireland only
    • BScotland only
    • CThe whole of the UK
    • DEngland and Wales
    Ver respuesta

    Respuesta: D. England and Wales

    The code is made under the Protection of Freedoms Act 2012 and applies to public places in England and Wales. Scotland and Northern Ireland are not covered.

14. Pregunta 14 de 25

    Who must have regard to the Surveillance Camera Code of Practice?

    • ARelevant authorities, like police and councils
    • BOnly shops that sell alcohol late at night
    • COnly private firms with more than 250 staff
    • DEvery household that has a video doorbell
    Ver respuesta

    Respuesta: A. Relevant authorities, like police and councils

    Section 33 of the Protection of Freedoms Act 2012 says relevant authorities, such as the police and local authorities, must have regard to the code. Others are encouraged to follow it.

15. Pregunta 15 de 25

    Which document sets out principles for public space CCTV in Scotland?

    • AThe Surveillance Camera Code for England
    • BThe Licensing Act 2003
    • CThe Highway Code
    • DThe CCTV Strategy for Scotland (2011)
    Ver respuesta

    Respuesta: D. The CCTV Strategy for Scotland (2011)

    The ICO notes that the Scottish Government's CCTV Strategy for Scotland (2011) sets out principles for public space CCTV operators.

16. Pregunta 16 de 25

    A contracted operator watches CCTV to guard against disorder and protect people from assault. Which SIA licence covers this?

    • AClose Protection
    • BCash and Valuables in Transit
    • CNo licence is needed for CCTV work
    • DPublic Space Surveillance (CCTV)
    Ver respuesta

    Respuesta: D. Public Space Surveillance (CCTV)

    The SIA says a CCTV licence is needed to use CCTV to watch or identify people in order to guard against disorder or protect people from assault.

17. Pregunta 17 de 25

    A licensed door supervisor uses a CCTV screen only to spot a trespasser and protect property. What does the SIA say?

    • AOnly the police may watch CCTV screens
    • BThey must also hold a CCTV licence
    • CThey need a separate data protection licence
    • DTheir door supervisor licence covers this
    Ver respuesta

    Respuesta: D. Their door supervisor licence covers this

    The SIA says door supervisor, close protection and security guarding licences cover using CCTV to identify a trespasser or protect property.

18. Pregunta 18 de 25

    A contracted officer wears a body camera but never watches any of its footage. Does this need a CCTV licence?

    • AYes, but only when working night shifts
    • BOnly if the camera can also record sound
    • CYes, anyone wearing a body camera needs one
    • DNo, not for wearing it without viewing
    Ver respuesta

    Respuesta: D. No, not for wearing it without viewing

    The SIA says you do not need a licence if you wear a bodycam or headcam but do not watch any of its footage.

19. Pregunta 19 de 25

    How long does an organisation normally have to answer a subject access request?

    • ASix months
    • BOne month
    • COne week
    • DThree months
    Ver respuesta

    Respuesta: B. One month

    The ICO says a subject access request must be answered without undue delay and at the latest within one month of receiving it.

20. Pregunta 20 de 25

    When can the time to answer a subject access request be extended by up to two more months?

    • AIf the footage was recorded at a weekend
    • BIf the staff member who handles it is away
    • CIf it is complex or the person sent several
    • DIf the person did not use the official form
    Ver respuesta

    Respuesta: C. If it is complex or the person sent several

    The time limit can be extended by up to two further months if the request is complex or the person has made several requests. The person must be told within one month.

21. Pregunta 21 de 25

    A visitor tells you at reception that they want a copy of CCTV footage of themselves. How should this be treated?

    • AAs a valid request, even though it was spoken
    • BAs invalid until they write a formal letter
    • CAs a police matter that must be refused
    • DAs invalid unless they say 'subject access'
    Ver respuesta

    Respuesta: A. As a valid request, even though it was spoken

    The ICO says a request can be made verbally or in writing, and no special words are needed. Pass it on using your site procedure.

22. Pregunta 22 de 25

    Footage asked for in a subject access request also shows other people. What does the ICO say?

    • AOthers need not be shown unless they agree or it is reasonable
    • BThe clip can be sent only once the police have approved it
    • CThe whole request must be refused because others appear
    • DThe whole clip must be sent with every face clearly shown
    Ver respuesta

    Respuesta: A. Others need not be shown unless they agree or it is reasonable

    The ICO says you do not have to give information that reveals another person unless they consent or it is reasonable to disclose it without consent.

23. Pregunta 23 de 25

    An operator copies footage of a fight onto their own phone to post online, without the company agreeing. What is this?

    • AA possible offence under section 170 of the DPA 2018
    • BAllowed, because the fight was in a public place
    • CA private matter for the operator alone
    • DAllowed, if the operator deletes it within a week
    Ver respuesta

    Respuesta: A. A possible offence under section 170 of the DPA 2018

    Section 170 of the Data Protection Act 2018 makes it an offence to knowingly or recklessly obtain or disclose personal data without the consent of the controller.

24. Pregunta 24 de 25

    A laptop holding CCTV footage is stolen, and the breach is likely to put people at risk. When should it be reported to the ICO?

    • AWithin 7 days after the police are told
    • BAt the end of the financial year
    • CWithin 72 hours of becoming aware of it
    • DWithin 30 days of the theft taking place
    Ver respuesta

    Respuesta: C. Within 72 hours of becoming aware of it

    A reportable breach must be reported without undue delay and no later than 72 hours after the organisation becomes aware of it.

25. Pregunta 25 de 25

    How does the ICO say exemptions, such as the one for preventing and detecting crime, should be used?

    • AAs a blanket rule for all police requests
    • BCase by case, with the reasons recorded
    • COnly by the police, never by companies
    • DOnly after a court order is issued
    Ver respuesta

    Respuesta: B. Case by case, with the reasons recorded

    The ICO says each exemption must be considered case by case, not as a blanket rule, and the reasons should be documented.

Teclado: 1–4 para responder, Intro para la siguiente pregunta.