Do I need an SIA licence to work as a CCTV operator?

If you work under a contract for services and use CCTV to watch or identify people to guard against disorder or protect people from assault, the SIA says you need a Public Space Surveillance (CCTV) licence. This course does not give you a licence or replace licence training.

How long can CCTV footage be kept?

The law sets no fixed period. The ICO says to keep it for the shortest time your purpose needs and then delete it.

Can someone ask for CCTV footage of themselves?

Yes. This is a subject access request. It can be made in writing or verbally, and it must usually be answered within one month.

Can I give footage to the police?

Often yes, but follow your site procedure. Exemptions for preventing and detecting crime are decided case by case, and the disclosure and reasons should be recorded.

Is het certificaat geaccrediteerd of officieel erkend?

Nee. Het is een privé bewijs van deelname, alleen voor je kennis. Het is niet erkend, geaccrediteerd of goedgekeurd door een overheid, vergunningsinstantie, toezichthouder of onderwijsinstelling, en het vervangt geen wettelijk verplichte vergunning, certificering of opleiding.

CCTV and Data Protection Course (UK) 2026

Vraag 1 van 25

A member of the public wants to complain about how a shop uses its CCTV. Which body deals with data protection in the UK?

The Security Industry Authority (SIA)
The Health and Safety Executive (HSE)
The Information Commissioner's Office
Trading Standards at the local council

Toon antwoord

Antwoord: C. The Information Commissioner's Office

The ICO is the UK's data protection regulator. Its video surveillance guidance covers CCTV used by organisations under the UK GDPR and the Data Protection Act 2018.

Vraag 2 van 25

A camera records clear pictures of shoppers who can be recognised. What are these images under data protection law?

Business records with no privacy rules
Public property that anyone may use
Personal data only if sound is recorded
Personal data about the people shown

Toon antwoord

Antwoord: D. Personal data about the people shown

The ICO says images and voices of people who can be identified are their personal information, so data protection law applies.

Vraag 3 van 25

Which data protection principle means footage must not be kept for longer than it is needed?

Accuracy
Accountability
Storage limitation
Purpose limitation

Toon antwoord

Antwoord: C. Storage limitation

Storage limitation is one of the principles in Article 5 of the UK GDPR. Data must not be kept longer than needed for its purpose.

Vraag 4 van 25

A camera only needs to watch a car park entrance, but it also films a bus stop across the road. Which principle is most at risk?

Accountability
Accuracy
Integrity and confidentiality
Data minimisation

Toon antwoord

Antwoord: D. Data minimisation

Data minimisation means collecting only what you need for your purpose. Filming an extra public area is more than the purpose needs.

Vraag 5 van 25

Your manager says the law requires all CCTV footage to be kept for exactly 31 days. What does the ICO say?

The 31-day rule applies only in Scotland
The law sets a minimum of 90 days
That is correct for every UK system
The law sets no fixed minimum or maximum

Toon antwoord

Antwoord: D. The law sets no fixed minimum or maximum

The ICO says the UK GDPR and the DPA 2018 do not set a minimum or maximum retention period. Keep footage for the shortest time your purpose needs.

Vraag 6 van 25

According to the ICO, what should a CCTV sign usually tell people?

Opening hours and the number of cameras
The names of the control room staff
Who runs it, why, and how to contact them
The camera make, model and serial number

Toon antwoord

Antwoord: C. Who runs it, why, and how to contact them

ICO guidance says signs should be clear and readable and give the operator, the purpose and basic contact details, such as a website, phone number or email.

Vraag 7 van 25

A new CCTV system can also record sound. What does the ICO recommend?

Turn audio on only during the night shift
Keep audio on at all times for evidence
Let each operator choose when to use it
Keep audio off by default, for rare use only

Toon antwoord

Antwoord: D. Keep audio off by default, for rare use only

The ICO says audio should be switched off by default and used only in exceptional cases, for example with a trigger switch.

Vraag 8 van 25

The ICO gives an example of when the date and time stamp on recordings may become wrong. What is it?

When the clocks change for summer or winter time
When a camera lens is cleaned
When footage is played back at high speed
When operators change shift

Toon antwoord

Antwoord: A. When the clocks change for summer or winter time

The ICO asks for regular checks that the date and time stamp is accurate and gives the clock change between summer and winter time as an example.

Vraag 9 van 25

When should a data protection impact assessment (DPIA) be done for a surveillance system?

Before using a system likely to be high risk
Only after a data breach has been reported
Once the system has been running for a year
Only after someone complains to the ICO

Toon antwoord

Antwoord: A. Before using a system likely to be high risk

The ICO says a DPIA should be done before deploying a surveillance system that is likely to result in a high risk to people.

Vraag 10 van 25

A DPIA shows a high risk that cannot be reduced. What must happen before the processing starts?

The ICO must be consulted
The police must inspect the cameras
The SIA must issue a new licence
The local council must approve the signs

Toon antwoord

Antwoord: A. The ICO must be consulted

If high risks cannot be reduced, the organisation must consult the ICO before it starts the processing.

Vraag 11 van 25

Which lawful basis does the ICO say is most likely for CCTV run by a private company?

Vital interests
Legitimate interests
A contract with every visitor
Consent from every person filmed

Toon antwoord

Antwoord: B. Legitimate interests

The ICO says the lawful basis for surveillance will usually be legitimate interests, or public task for public bodies. Consent is hard to get in public spaces.

Vraag 12 van 25

Under data protection law, who is the controller of a CCTV system?

Whoever decides why and how footage is used
The company that installed all the cameras
Any person who appears in the recordings
The operator who is on shift at the time

Toon antwoord

Antwoord: A. Whoever decides why and how footage is used

The controller decides the purposes and means of the processing and is legally responsible for following data protection law.

Vraag 13 van 25

Where does the Surveillance Camera Code of Practice apply?

Northern Ireland only
Scotland only
The whole of the UK
England and Wales

Toon antwoord

Antwoord: D. England and Wales

The code is made under the Protection of Freedoms Act 2012 and applies to public places in England and Wales. Scotland and Northern Ireland are not covered.

Vraag 14 van 25

Who must have regard to the Surveillance Camera Code of Practice?

Relevant authorities, like police and councils
Only shops that sell alcohol late at night
Only private firms with more than 250 staff
Every household that has a video doorbell

Toon antwoord

Antwoord: A. Relevant authorities, like police and councils

Section 33 of the Protection of Freedoms Act 2012 says relevant authorities, such as the police and local authorities, must have regard to the code. Others are encouraged to follow it.

Vraag 15 van 25

Which document sets out principles for public space CCTV in Scotland?

The Surveillance Camera Code for England
The Licensing Act 2003
The Highway Code
The CCTV Strategy for Scotland (2011)

Toon antwoord

Antwoord: D. The CCTV Strategy for Scotland (2011)

The ICO notes that the Scottish Government's CCTV Strategy for Scotland (2011) sets out principles for public space CCTV operators.

Vraag 16 van 25

A contracted operator watches CCTV to guard against disorder and protect people from assault. Which SIA licence covers this?

Close Protection
Cash and Valuables in Transit
No licence is needed for CCTV work
Public Space Surveillance (CCTV)

Toon antwoord

Antwoord: D. Public Space Surveillance (CCTV)

The SIA says a CCTV licence is needed to use CCTV to watch or identify people in order to guard against disorder or protect people from assault.

Vraag 17 van 25

A licensed door supervisor uses a CCTV screen only to spot a trespasser and protect property. What does the SIA say?

Only the police may watch CCTV screens
They must also hold a CCTV licence
They need a separate data protection licence
Their door supervisor licence covers this

Toon antwoord

Antwoord: D. Their door supervisor licence covers this

The SIA says door supervisor, close protection and security guarding licences cover using CCTV to identify a trespasser or protect property.

Vraag 18 van 25

A contracted officer wears a body camera but never watches any of its footage. Does this need a CCTV licence?

Yes, but only when working night shifts
Only if the camera can also record sound
Yes, anyone wearing a body camera needs one
No, not for wearing it without viewing

Toon antwoord

Antwoord: D. No, not for wearing it without viewing

The SIA says you do not need a licence if you wear a bodycam or headcam but do not watch any of its footage.

Vraag 19 van 25

How long does an organisation normally have to answer a subject access request?

Six months
One month
One week
Three months

Toon antwoord

Antwoord: B. One month

The ICO says a subject access request must be answered without undue delay and at the latest within one month of receiving it.

Vraag 20 van 25

When can the time to answer a subject access request be extended by up to two more months?

If the footage was recorded at a weekend
If the staff member who handles it is away
If it is complex or the person sent several
If the person did not use the official form

Toon antwoord

Antwoord: C. If it is complex or the person sent several

The time limit can be extended by up to two further months if the request is complex or the person has made several requests. The person must be told within one month.

Vraag 21 van 25

A visitor tells you at reception that they want a copy of CCTV footage of themselves. How should this be treated?

As a valid request, even though it was spoken
As invalid until they write a formal letter
As a police matter that must be refused
As invalid unless they say 'subject access'

Toon antwoord

Antwoord: A. As a valid request, even though it was spoken

The ICO says a request can be made verbally or in writing, and no special words are needed. Pass it on using your site procedure.

Vraag 22 van 25

Footage asked for in a subject access request also shows other people. What does the ICO say?

Others need not be shown unless they agree or it is reasonable
The clip can be sent only once the police have approved it
The whole request must be refused because others appear
The whole clip must be sent with every face clearly shown

Toon antwoord

Antwoord: A. Others need not be shown unless they agree or it is reasonable

The ICO says you do not have to give information that reveals another person unless they consent or it is reasonable to disclose it without consent.

Vraag 23 van 25

An operator copies footage of a fight onto their own phone to post online, without the company agreeing. What is this?

A possible offence under section 170 of the DPA 2018
Allowed, because the fight was in a public place
A private matter for the operator alone
Allowed, if the operator deletes it within a week

Toon antwoord

Antwoord: A. A possible offence under section 170 of the DPA 2018

Section 170 of the Data Protection Act 2018 makes it an offence to knowingly or recklessly obtain or disclose personal data without the consent of the controller.

Vraag 24 van 25

A laptop holding CCTV footage is stolen, and the breach is likely to put people at risk. When should it be reported to the ICO?

Within 7 days after the police are told
At the end of the financial year
Within 72 hours of becoming aware of it
Within 30 days of the theft taking place

Toon antwoord

Antwoord: C. Within 72 hours of becoming aware of it

A reportable breach must be reported without undue delay and no later than 72 hours after the organisation becomes aware of it.

Vraag 25 van 25

How does the ICO say exemptions, such as the one for preventing and detecting crime, should be used?

As a blanket rule for all police requests
Case by case, with the reasons recorded
Only by the police, never by companies
Only after a court order is issued

Toon antwoord

Antwoord: B. Case by case, with the reasons recorded

The ICO says each exemption must be considered case by case, not as a blanket rule, and the reasons should be documented.

CCTV and Data Protection Course (UK) 2026

Kort antwoord

Wat je leert

Wat je moet weten voor het examen

Veelgestelde vragen

Bronnen

Gerelateerde examens