CCTV and Data Protection Course (UK) 2026

1. Question 1 sur 25

   A member of the public wants to complain about how a shop uses its CCTV. Which body deals with data protection in the UK?

   • AThe Security Industry Authority (SIA)
   • BThe Health and Safety Executive (HSE)
   • CThe Information Commissioner's Office
   • DTrading Standards at the local council
   Voir la réponse

   Réponse: C. The Information Commissioner's Office

   The ICO is the UK's data protection regulator. Its video surveillance guidance covers CCTV used by organisations under the UK GDPR and the Data Protection Act 2018.

2. Question 2 sur 25

   A camera records clear pictures of shoppers who can be recognised. What are these images under data protection law?

   • ABusiness records with no privacy rules
   • BPublic property that anyone may use
   • CPersonal data only if sound is recorded
   • DPersonal data about the people shown
   Voir la réponse

   Réponse: D. Personal data about the people shown

   The ICO says images and voices of people who can be identified are their personal information, so data protection law applies.

3. Question 3 sur 25

   Which data protection principle means footage must not be kept for longer than it is needed?

   • AAccuracy
   • BAccountability
   • CStorage limitation
   • DPurpose limitation
   Voir la réponse

   Réponse: C. Storage limitation

   Storage limitation is one of the principles in Article 5 of the UK GDPR. Data must not be kept longer than needed for its purpose.

4. Question 4 sur 25

   A camera only needs to watch a car park entrance, but it also films a bus stop across the road. Which principle is most at risk?

   • AAccountability
   • BAccuracy
   • CIntegrity and confidentiality
   • DData minimisation
   Voir la réponse

   Réponse: D. Data minimisation

   Data minimisation means collecting only what you need for your purpose. Filming an extra public area is more than the purpose needs.

5. Question 5 sur 25

   Your manager says the law requires all CCTV footage to be kept for exactly 31 days. What does the ICO say?

   • AThe 31-day rule applies only in Scotland
   • BThe law sets a minimum of 90 days
   • CThat is correct for every UK system
   • DThe law sets no fixed minimum or maximum
   Voir la réponse

   Réponse: D. The law sets no fixed minimum or maximum

   The ICO says the UK GDPR and the DPA 2018 do not set a minimum or maximum retention period. Keep footage for the shortest time your purpose needs.

6. Question 6 sur 25

   According to the ICO, what should a CCTV sign usually tell people?

   • AOpening hours and the number of cameras
   • BThe names of the control room staff
   • CWho runs it, why, and how to contact them
   • DThe camera make, model and serial number
   Voir la réponse

   Réponse: C. Who runs it, why, and how to contact them

   ICO guidance says signs should be clear and readable and give the operator, the purpose and basic contact details, such as a website, phone number or email.

7. Question 7 sur 25

   A new CCTV system can also record sound. What does the ICO recommend?

   • ATurn audio on only during the night shift
   • BKeep audio on at all times for evidence
   • CLet each operator choose when to use it
   • DKeep audio off by default, for rare use only
   Voir la réponse

   Réponse: D. Keep audio off by default, for rare use only

   The ICO says audio should be switched off by default and used only in exceptional cases, for example with a trigger switch.

8. Question 8 sur 25

   The ICO gives an example of when the date and time stamp on recordings may become wrong. What is it?

   • AWhen the clocks change for summer or winter time
   • BWhen a camera lens is cleaned
   • CWhen footage is played back at high speed
   • DWhen operators change shift
   Voir la réponse

   Réponse: A. When the clocks change for summer or winter time

   The ICO asks for regular checks that the date and time stamp is accurate and gives the clock change between summer and winter time as an example.

9. Question 9 sur 25

   When should a data protection impact assessment (DPIA) be done for a surveillance system?

   • ABefore using a system likely to be high risk
   • BOnly after a data breach has been reported
   • COnce the system has been running for a year
   • DOnly after someone complains to the ICO
   Voir la réponse

   Réponse: A. Before using a system likely to be high risk

   The ICO says a DPIA should be done before deploying a surveillance system that is likely to result in a high risk to people.

10. Question 10 sur 25

    A DPIA shows a high risk that cannot be reduced. What must happen before the processing starts?

    • AThe ICO must be consulted
    • BThe police must inspect the cameras
    • CThe SIA must issue a new licence
    • DThe local council must approve the signs
    Voir la réponse

    Réponse: A. The ICO must be consulted

    If high risks cannot be reduced, the organisation must consult the ICO before it starts the processing.

11. Question 11 sur 25

    Which lawful basis does the ICO say is most likely for CCTV run by a private company?

    • AVital interests
    • BLegitimate interests
    • CA contract with every visitor
    • DConsent from every person filmed
    Voir la réponse

    Réponse: B. Legitimate interests

    The ICO says the lawful basis for surveillance will usually be legitimate interests, or public task for public bodies. Consent is hard to get in public spaces.

12. Question 12 sur 25

    Under data protection law, who is the controller of a CCTV system?

    • AWhoever decides why and how footage is used
    • BThe company that installed all the cameras
    • CAny person who appears in the recordings
    • DThe operator who is on shift at the time
    Voir la réponse

    Réponse: A. Whoever decides why and how footage is used

    The controller decides the purposes and means of the processing and is legally responsible for following data protection law.

13. Question 13 sur 25

    Where does the Surveillance Camera Code of Practice apply?

    • ANorthern Ireland only
    • BScotland only
    • CThe whole of the UK
    • DEngland and Wales
    Voir la réponse

    Réponse: D. England and Wales

    The code is made under the Protection of Freedoms Act 2012 and applies to public places in England and Wales. Scotland and Northern Ireland are not covered.

14. Question 14 sur 25

    Who must have regard to the Surveillance Camera Code of Practice?

    • ARelevant authorities, like police and councils
    • BOnly shops that sell alcohol late at night
    • COnly private firms with more than 250 staff
    • DEvery household that has a video doorbell
    Voir la réponse

    Réponse: A. Relevant authorities, like police and councils

    Section 33 of the Protection of Freedoms Act 2012 says relevant authorities, such as the police and local authorities, must have regard to the code. Others are encouraged to follow it.

15. Question 15 sur 25

    Which document sets out principles for public space CCTV in Scotland?

    • AThe Surveillance Camera Code for England
    • BThe Licensing Act 2003
    • CThe Highway Code
    • DThe CCTV Strategy for Scotland (2011)
    Voir la réponse

    Réponse: D. The CCTV Strategy for Scotland (2011)

    The ICO notes that the Scottish Government's CCTV Strategy for Scotland (2011) sets out principles for public space CCTV operators.

16. Question 16 sur 25

    A contracted operator watches CCTV to guard against disorder and protect people from assault. Which SIA licence covers this?

    • AClose Protection
    • BCash and Valuables in Transit
    • CNo licence is needed for CCTV work
    • DPublic Space Surveillance (CCTV)
    Voir la réponse

    Réponse: D. Public Space Surveillance (CCTV)

    The SIA says a CCTV licence is needed to use CCTV to watch or identify people in order to guard against disorder or protect people from assault.

17. Question 17 sur 25

    A licensed door supervisor uses a CCTV screen only to spot a trespasser and protect property. What does the SIA say?

    • AOnly the police may watch CCTV screens
    • BThey must also hold a CCTV licence
    • CThey need a separate data protection licence
    • DTheir door supervisor licence covers this
    Voir la réponse

    Réponse: D. Their door supervisor licence covers this

    The SIA says door supervisor, close protection and security guarding licences cover using CCTV to identify a trespasser or protect property.

18. Question 18 sur 25

    A contracted officer wears a body camera but never watches any of its footage. Does this need a CCTV licence?

    • AYes, but only when working night shifts
    • BOnly if the camera can also record sound
    • CYes, anyone wearing a body camera needs one
    • DNo, not for wearing it without viewing
    Voir la réponse

    Réponse: D. No, not for wearing it without viewing

    The SIA says you do not need a licence if you wear a bodycam or headcam but do not watch any of its footage.

19. Question 19 sur 25

    How long does an organisation normally have to answer a subject access request?

    • ASix months
    • BOne month
    • COne week
    • DThree months
    Voir la réponse

    Réponse: B. One month

    The ICO says a subject access request must be answered without undue delay and at the latest within one month of receiving it.

20. Question 20 sur 25

    When can the time to answer a subject access request be extended by up to two more months?

    • AIf the footage was recorded at a weekend
    • BIf the staff member who handles it is away
    • CIf it is complex or the person sent several
    • DIf the person did not use the official form
    Voir la réponse

    Réponse: C. If it is complex or the person sent several

    The time limit can be extended by up to two further months if the request is complex or the person has made several requests. The person must be told within one month.

21. Question 21 sur 25

    A visitor tells you at reception that they want a copy of CCTV footage of themselves. How should this be treated?

    • AAs a valid request, even though it was spoken
    • BAs invalid until they write a formal letter
    • CAs a police matter that must be refused
    • DAs invalid unless they say 'subject access'
    Voir la réponse

    Réponse: A. As a valid request, even though it was spoken

    The ICO says a request can be made verbally or in writing, and no special words are needed. Pass it on using your site procedure.

22. Question 22 sur 25

    Footage asked for in a subject access request also shows other people. What does the ICO say?

    • AOthers need not be shown unless they agree or it is reasonable
    • BThe clip can be sent only once the police have approved it
    • CThe whole request must be refused because others appear
    • DThe whole clip must be sent with every face clearly shown
    Voir la réponse

    Réponse: A. Others need not be shown unless they agree or it is reasonable

    The ICO says you do not have to give information that reveals another person unless they consent or it is reasonable to disclose it without consent.

23. Question 23 sur 25

    An operator copies footage of a fight onto their own phone to post online, without the company agreeing. What is this?

    • AA possible offence under section 170 of the DPA 2018
    • BAllowed, because the fight was in a public place
    • CA private matter for the operator alone
    • DAllowed, if the operator deletes it within a week
    Voir la réponse

    Réponse: A. A possible offence under section 170 of the DPA 2018

    Section 170 of the Data Protection Act 2018 makes it an offence to knowingly or recklessly obtain or disclose personal data without the consent of the controller.

24. Question 24 sur 25

    A laptop holding CCTV footage is stolen, and the breach is likely to put people at risk. When should it be reported to the ICO?

    • AWithin 7 days after the police are told
    • BAt the end of the financial year
    • CWithin 72 hours of becoming aware of it
    • DWithin 30 days of the theft taking place
    Voir la réponse

    Réponse: C. Within 72 hours of becoming aware of it

    A reportable breach must be reported without undue delay and no later than 72 hours after the organisation becomes aware of it.

25. Question 25 sur 25

    How does the ICO say exemptions, such as the one for preventing and detecting crime, should be used?

    • AAs a blanket rule for all police requests
    • BCase by case, with the reasons recorded
    • COnly by the police, never by companies
    • DOnly after a court order is issued
    Voir la réponse

    Réponse: B. Case by case, with the reasons recorded

    The ICO says each exemption must be considered case by case, not as a blanket rule, and the reasons should be documented.

Clavier : 1–4 pour répondre, Entrée pour la question suivante.