Guide
Data protection for security CCTV and body-worn cameras
Data protection obligations for private security companies operating CCTV systems and body-worn cameras. Covers the two legal frameworks (UK GDPR and the Surveillance Camera Code), data protection impact assessments, signage, retention periods, and responding to subject access requests.
If your security company operates CCTV, body-worn video (BWV), or other surveillance cameras, you are processing personal data. This creates specific legal obligations under both the UK General Data Protection Regulation (UK GDPR) and the Surveillance Camera Code of Practice issued under the Protection of Freedoms Act 2012.
Getting this wrong carries serious consequences. The Information Commissioner's Office (ICO) can issue fines, and individuals whose data you mishandle can bring claims against you. Your SIA licence conditions also require you to comply with data protection law, so a breach could put your licence at risk.
This guide explains what the two frameworks require of you, how they interact, and the practical steps you need to take to stay compliant.
Two frameworks you must follow
Security CCTV sits under two overlapping legal frameworks. You need to satisfy both.
UK GDPR and the Data Protection Act 2018 apply because CCTV footage of identifiable people is personal data. This framework governs how you collect, store, share, and delete that data. The ICO enforces it.
The Surveillance Camera Code of Practice sets out 12 guiding principles for the use of surveillance cameras in public places. It was issued under the Protection of Freedoms Act 2012 and is overseen by the Surveillance Camera Commissioner (now part of the Biometrics and Surveillance Camera Commissioner's role). Public authorities must have regard to the code; private security companies operating in public spaces should treat it as best practice that regulators and courts will reference.
In practice, a system that meets UK GDPR requirements and follows the Surveillance Camera Code will satisfy both frameworks. The key areas where they overlap are purpose limitation, proportionality, transparency, retention, and access rights.
ICO requirements for CCTV operators
The ICO sets out specific expectations for organisations operating CCTV. As a security company, you are typically the data processor acting on behalf of your client (the data controller), but you may also be a controller in your own right if you determine the purposes and means of the surveillance — for example, if you install and operate a system at your own premises.
Your obligations differ depending on your role, and your contract with each client must clearly define who is controller and who is processor. If you get this wrong, both parties face enforcement risk.
Data protection impact assessments
A data protection impact assessment (DPIA) is mandatory before you deploy any new CCTV or BWV system that is likely to result in a high risk to individuals' rights. In practice, most security surveillance systems in public or semi-public spaces will meet this threshold.
The DPIA should document:
- The purpose of the surveillance and why it is necessary
- Why less intrusive alternatives are insufficient
- What footage you will capture and where
- How long you will retain it and why
- Who will have access and under what conditions
- Technical and organisational security measures
- How you will handle subject access requests
If the DPIA identifies high residual risks that you cannot mitigate, you must consult the ICO before proceeding. Do not treat the DPIA as a one-off exercise — review it whenever you change the system, expand coverage, or deploy cameras in a new location.
If you operate CCTV on behalf of a client, the client (as controller) is responsible for ensuring a DPIA is completed. However, as processor you must assist them, and your contract should require this. If neither party completes a DPIA, both may face enforcement action.
Signage, retention and subject access requests
Signage. You must display clear signs wherever cameras are operating. Signs need to be visible before a person enters the surveilled area and must state the purpose of the surveillance and who to contact. A small sign hidden behind a plant will not satisfy the ICO. For body-worn cameras, the wearer must inform people they are being recorded unless doing so would compromise safety.
Retention. Keep footage only as long as you need it for the stated purpose. There is no single mandatory retention period in law, but the ICO considers 30 days reasonable for most routine security surveillance. If you need to retain footage longer — for example, because of an ongoing investigation or incident — document the reason and review regularly. Automatic deletion at the end of the retention period is the safest approach.
Subject access requests (SARs). Anyone captured on your CCTV can request a copy of footage that identifies them. You must respond within one calendar month. Before releasing footage, you need to redact or obscure other identifiable individuals unless they have also consented. Failing to respond to a SAR on time is one of the most common ICO complaints about CCTV operators.
Build a SAR response process before you receive your first request. Identify who handles requests, how you locate footage, what redaction tools you use, and how you verify the requester's identity. Scrambling to work this out under time pressure leads to missed deadlines.
Training your operatives
SIA-licensed operatives working with CCTV must hold the correct training qualification, which includes data protection modules. Beyond the licensing requirement, all staff who access, review, or manage footage need practical training on your organisation's data protection procedures — including how to handle SARs, when to escalate, and what constitutes a data breach.
What to do if something goes wrong
Data breach. If footage is lost, stolen, accessed without authorisation, or sent to the wrong person, assess whether the breach poses a risk to the individuals involved. If there is a risk, you must notify the ICO within 72 hours. If there is a high risk, you must also notify the affected individuals. As a processor, you must notify the controller without undue delay and let them handle the ICO reporting — but do not use this as a reason to delay.
ICO investigation. The ICO can investigate complaints and carry out audits. Cooperate fully. Common triggers include unanswered SARs, missing signage, and excessive retention. Keep records that demonstrate compliance — your DPIA, retention schedule, SAR log, and training records will be your evidence.
Client disputes. If your client instructs you to do something that would breach data protection law — such as refusing to delete footage or sharing it without a lawful basis — you should refuse and document your reasons. Processing unlawful instructions does not absolve you of liability as a processor.
Related guidance
- SIA licence requirements for licensing obligations covering CCTV operatives
- Data protection and UK GDPR basics for general data protection duties
- Security industry regulations overview for the full regulatory landscape