Many CCTV compliance failures involve no hacking at all: cameras record too much, keep footage too long and cannot produce a lawful copy when someone asks for it. Video surveillance captures personal data about everyone in view, so under the GDPR and UK GDPR it needs a documented lawful basis, a necessity case, clear signs, a retention rule and a way to answer access requests within statutory deadlines. This guide covers those obligations for organisations running CCTV, body worn video, smart doorbells and cloud video platforms at offices, shops, warehouses and public-facing sites, with the European Data Protection Board (EDPB) and UK Information Commissioner's Office (ICO) positions side by side. It is written for data protection officers, facilities and security managers and the IT teams who run video management systems. Camera and network hardening is covered separately in the IP Camera and CCTV Security Guide.
Key takeaways
- Necessity comes before cameras. The EDPB expects a real, documented problem and a check that fencing, lighting, locks or patrols would not do the job; speculative risk is not enough.
- Short retention is the default. The EDPB says footage should in most cases be erased after a few days, with stronger justification needed beyond 72 hours; the ICO says no law sets a fixed period, so the purpose must.
- Signs are the first layer of your privacy notice. They must be visible before people enter the monitored area and name the operator, the purpose and how to get more information.
- Plan for access requests before the first one arrives. You have one month to respond, must be able to find a person's footage, and should mask other people rather than refuse.
- Audio, facial recognition and covert recording are a different risk class. Audio should be off by default, biometric identification is special category data, and covert monitoring of workers is rarely justifiable.
Which rules apply
CCTV that captures identifiable people is processing personal data, so the GDPR (in the EU) or the UK GDPR and Data Protection Act 2018 (in the UK) apply in full. Several other instruments shape how regulators read those rules.
| Instrument | Who it applies to | What it adds | Status (checked November 2026) |
|---|---|---|---|
| GDPR | Controllers and processors in scope of EU law | Lawful basis, transparency, minimisation, retention, rights, security, DPIA | In force |
| EDPB Guidelines 3/2019 on processing of personal data through video devices | Interpretation for all EU controllers | Detailed positions on necessity, signage, retention, access, biometrics | Version 2.0 adopted 29 January 2020 |
| UK GDPR and Data Protection Act 2018 | UK controllers and processors | Same core principles; Article 10 and Schedule 1 conditions for criminal offence data | In force; ICO video surveillance guidance is under review following the Data (Use and Access) Act |
| Surveillance Camera Code of Practice (Protection of Freedoms Act 2012) | Guidance on use of surveillance camera systems by local authorities and the police in England and Wales | 12 guiding principles; a useful benchmark for private operators too | Amended code in effect from 12 January 2022 |
| EU AI Act Article 5 | Providers and deployers of AI systems | Prohibits building facial recognition databases by untargeted scraping of CCTV footage; restricts real-time remote biometric identification in public spaces for law enforcement | Article 5 prohibitions apply from 2 February 2025 |
For the wider UK regime see the UK GDPR and Data Protection Act 2018 Guide, and for national differences in the EU the GDPR Variations in Six EU Member States page. Some member states have specific video surveillance or workplace monitoring laws, so check local rules before deploying.
Lawful basis and necessity
- Private organisations: legitimate interests (Article 6(1)(f)) is the usual basis. The ICO notes that consent is difficult to obtain in public spaces. Record a legitimate interests assessment covering purpose, necessity and balancing.
- Public authorities: the EDPB states that public authorities cannot rely on legitimate interests when carrying out their tasks; they normally rely on public task (Article 6(1)(e)) under a legal basis in national law.
- The interest must be real and present: the EDPB says property protection can justify cameras only in a real and hazardous situation, and recommends documenting incidents and reassessing the need periodically.
- Consider alternatives first: fencing, regular patrols, better lighting and locks may be as effective. If they are, cameras are not necessary.
- Stop at the boundary: necessity generally ends at the property line. Use physical positioning and privacy masking so cameras do not cover pavements, neighbouring property or public roads.
- Domestic systems: the household exemption is construed narrowly. The EDPB's garden example applies only if the camera does not reach a public space or neighbouring property; once it does, the owner is a controller.
When a DPIA is required
Article 35(3)(c) GDPR requires a data protection impact assessment for systematic monitoring of a publicly accessible area on a large scale, and the EDPB notes that many video surveillance cases will need one. The ICO says you must carry out a DPIA where worker monitoring is likely to capture special category data, and treats facial recognition as high risk. If high risk remains after mitigation, prior consultation with the supervisory authority is required. Use the DPIA Guide: Running a Data Protection Impact Assessment and the DPIA Template.
Transparency and signage
The EDPB recommends a layered approach: the warning sign is the first layer and points to a full notice (the second layer). The ICO adds that publishing information online alone is not enough.
| Element | First layer (sign) | Second layer (full notice) |
|---|---|---|
| Placement | Visible before entering the monitored area, roughly at eye level, sized for pedestrians or drivers as appropriate | Website, reception, intranet for staff |
| Identity | Controller name and a contact route (website, phone or email); DPO contact where one exists | Full controller and DPO details |
| Purpose and basis | Purpose, and the legitimate interest where relied on | Article 13 information in full |
| Rights | That data subject rights exist | How to make an access, erasure or objection request |
| Surprises | Anything unexpected: audio recording, sharing with third parties, transfers outside the EU or UK, long storage periods | Recipients, retention periods, transfer safeguards |
Make signs more prominent where people would not expect monitoring, and state separately when audio is recorded.
Retention: how long to keep footage
The two regulators frame retention differently but reach the same practical result.
- EDPB position: damage or incidents are usually recognisable within one or two days, so footage should in most cases be erased, ideally automatically, after a few days. The longer the storage period, especially beyond 72 hours, the more argument is needed for its legitimacy.
- ICO position: neither the UK GDPR nor the DPA 2018 sets a minimum or maximum period. The purpose decides, and retention must not be based on storage capacity or manufacturer defaults.
- Preservation on request: keep specific clips longer only for a documented reason, such as an active investigation where law enforcement asks for preservation or an insurance claim, and record the clip, the reason and the review date.
- Deletion must be real: use automatic overwrite on recorders and lifecycle rules on cloud storage, securely wipe recorders before disposal, and check regularly that retention settings are being applied.
| Use case | Starting point for the retention decision | What would justify longer |
|---|---|---|
| Office reception and car park | A few days, overwritten automatically | A recurring weekend gap before incidents are noticed, documented |
| Retail floor and stockrooms | A few days to cover the reporting cycle for losses | Evidence that losses are found later, for example at stock counts |
| Warehouse and loading bays | Aligned to the period in which damage claims are normally raised | Contractual claim windows, recorded in the DPIA |
| Body worn video | Delete unless an incident is flagged | Flagged incidents kept for the complaint or legal process |
| Preserved incident clips | Until the investigation or claim closes | Legal hold, with a named owner and review date |
These are starting points for your own assessment, not regulator-set periods. See the Data Retention and Secure Deletion Guide.
Handling subject access requests for footage
A person has the right to a copy of footage of themselves (Article 15). Under the ICO's subject access guidance you must respond without undue delay and within one month, extendable by up to two further months for complex or multiple requests, with the requester told why within the first month. A fee is generally not allowed. If footage is overwritten before the request arrives, there is nothing to disclose; once a request is received, preserve the relevant footage.
- Log and preserve: record the request date and immediately stop the relevant footage from being overwritten.
- Locate: ask for the date, time window and location, and a description or photo if needed. The EDPB notes that the requester should specify when they entered the monitored area. The ICO allows you to pause the clock while you wait for reasonable clarification.
- Verify identity: confirm the requester is the person in the footage, proportionately, without collecting more data than needed.
- Protect others: mask, blur or scramble other identifiable people. The EDPB says this is preferable to refusing; the ICO's three-step test applies to third-party information.
- Disclose securely: provide an encrypted file or supervised viewing, record what was disclosed, and keep an audit trail.
- Close: release the preservation hold unless another reason to keep the clip exists.
Erasure and objection requests also apply. The EDPB says irreversible blurring can satisfy erasure, and that an objection should be answered within one month. See the DSAR Guide: Handling Data Subject Requests.
Disclosure to police, insurers and other third parties
- Own legal basis: the EDPB treats every disclosure as a separate processing activity that needs its own Article 6 basis. Where national law requires cooperation with law enforcement, Article 6(1)(c) can apply.
- Recipients are responsible too: police processing of the footage falls under the Law Enforcement Directive (EU) or Part 3 of the DPA 2018 (UK), not the GDPR.
- Disclosure log: record requester, legal basis, clip reference, approver and delivery method. The ICO advises an audit trail where footage may be used as evidence.
- No public posting: sharing clips on social media to identify a suspect is a new purpose with its own risks; route it through the DPO.
Audio, biometrics and workplace monitoring
| Feature | Regulator position | Practical control |
|---|---|---|
| Audio recording | ICO: more intrusive than video; off by default and used only with an evidenced need, for example via a trigger switch | Disable microphones on cameras and doorbells in the configuration baseline; audit for re-enablement |
| Facial recognition | EDPB: biometric processing to uniquely identify people is special category data; private use will in most cases need explicit consent and a non-biometric alternative. ICO: high risk, DPIA required | Disable face matching features by default; enable only after DPIA and a documented Article 9 condition |
| Analytics without identification | EDPB: merely distinguishing categories of people without identifying anyone falls outside Article 9 | Still in scope of the GDPR; cover in the DPIA |
| Worker monitoring | ICO: workers must be told the extent, nature and purpose; continuous video or audio monitoring is justified only in rare circumstances | Staff notice, monitoring policy, no cameras in areas with a high expectation of privacy |
| Covert recording | ICO: unlikely to be justifiable in usual circumstances | Senior approval, time-limited, specific suspected criminal activity, DPIA |
| Building face databases from footage | EU AI Act Article 5(1)(e): prohibited when done by untargeted scraping | Contract terms forbidding vendors from reusing footage for model training |
See the Employee Monitoring and Privacy Guide and the Biometric Data in the Workplace page for more detail.
Where identity fits
Access to footage is an identity problem. Video management systems often run with shared operator logins, default administrator accounts on recorders and long-lived vendor support access. The EDPB expects access control with authentication and logging, and the ICO expects access to be limited to authorised people. Give every operator a named account through single sign-on, separate viewing, export and administration roles, log every export and review the logs, and treat the cloud provider's support access as third-party privileged access with a processor contract under Article 28. See the GDPR Article 28 Processor Guide.
Implementation: bringing an existing estate into line
- Inventory: list every camera, recorder, cloud account and body worn device with its location, field of view, audio capability, retention setting and owner.
- Purpose per zone: write the purpose and lawful basis for each zone, remove cameras with no current justification, and reposition or mask those covering public or neighbouring space.
- DPIA: complete or refresh the DPIA, including a legitimate interests assessment and the retention rationale.
- Configure: set retention, disable audio and facial matching unless approved, apply privacy masks, and enforce named accounts with role-based access.
- Signs and notices: install first-layer signs at every entry point and publish the second-layer notice.
- Procedures: publish the access request, disclosure and preservation procedures, and train operators.
- Test: run a mock access request end to end, including masking and secure delivery, and time it.
- Review: reassess necessity and retention at least annually and after any change in incidents or site use. The rollback for a change that proves too intrusive is simple: switch off or reposition the camera and delete the excess footage.
Measuring compliance
- Retention conformance: share of recorders and cloud accounts whose oldest footage is within the documented retention period (target 100%).
- Access request timeliness: share of footage requests completed within one month (target 100%), and median days to respond.
- Exports logged and approved: exports with a matching disclosure log entry, per quarter.
- Named access: share of video system accounts that are individual, SSO-backed and reviewed in the last quarter.
- Feature drift: devices with audio or facial matching enabled outside an approved DPIA (target zero).
Common failure patterns
- Manufacturer default retention: recorders keep footage until the disk is full, often for weeks. The ICO is explicit that capacity and defaults are not a retention policy.
- Cameras that see too much: fields of view that cover the street, neighbouring gardens or staff break areas, with no privacy masking.
- No way to find footage: an access request arrives, nobody can search the system by time and location, and the footage is overwritten while the request circulates.
- Audio left on: doorbells and cameras ship with microphones enabled, and nobody switches them off or updates the signs.
- Uncontrolled exports: clips shared by email or messaging apps with police, insurers or colleagues, with no log and no basis recorded.
- Broad provider access to archives: in the Verkada camera breach, attackers used support credentials on the provider's side to view live and archived footage from customer sites. The customer-side lessons are to keep archives short so less is exposed, and to agree in the processor contract how provider support staff reach your footage.
Framework mapping
| Requirement | Reference | Evidence to keep |
|---|---|---|
| Lawfulness and necessity | GDPR Art. 5(1)(a), 6(1)(e) or (f); EDPB 3/2019 | Legitimate interests assessment, incident log |
| Minimisation and storage limitation | GDPR Art. 5(1)(c) and (e) | Camera inventory with fields of view, retention settings |
| Transparency | GDPR Art. 12 and 13 | Sign photos, second-layer notice |
| Access, erasure, objection | GDPR Art. 15, 17, 21 | Request log, masking records |
| Security of footage | GDPR Art. 32; ISO/IEC 27001:2022 A.7.4 Physical security monitoring and A.5.34 Privacy and protection of PII | Access reviews, export logs, encryption settings |
| High-risk processing | GDPR Art. 35(3)(c), Art. 9 for biometrics | DPIA, Article 9 condition |
| Processors and cloud video | GDPR Art. 28 | Processor contract, support access terms, transfer assessment |
Practitioner checklist
- Keep a camera inventory with purpose, lawful basis, field of view, audio status and retention for each device.
- Complete a DPIA for any large-scale or public-facing system and for any biometric or worker-focused monitoring.
- Set retention to the shortest period the purpose supports and confirm deletion actually happens.
- Install first-layer signs before every monitored entry point and publish the full notice.
- Disable audio and facial matching by default; enable only with a documented justification.
- Make footage searchable by time and location, and preserve it as soon as an access request arrives.
- Mask third parties in disclosed footage and deliver copies securely.
- Log every export and disclosure with the legal basis and approver.
- Use named, SSO-backed accounts with separate view, export and admin roles, reviewed quarterly.
- Review necessity and retention annually and after any change in site use.
Standards and references
- EDPB: Guidelines 3/2019 on processing of personal data through video devices
- ICO: Guidance on video surveillance (including CCTV)
- ICO: Complying with the data protection principles when using surveillance systems
- ICO: A guide to subject access
- ICO: Monitoring workers, specific considerations for different methods
- GOV.UK: Amended Surveillance Camera Code of Practice
- EU AI Act: Article 5, Prohibited AI practices
Related NHI Mgmt Group resources: IP Camera and CCTV Security Guide · GDPR Compliance Guide for Security Teams · DSAR Guide · Employee Monitoring and Privacy Guide. This guide summarises GDPR, UK GDPR and regulator guidance on video surveillance and is not legal advice.