There is no single UK rule saying that every business must keep CCTV footage for 7, 14, 30 or 90 days. The appropriate retention period depends on why the CCTV is being used and how long the recordings are genuinely needed for that purpose.
For many businesses, the important thing is not choosing an arbitrary number of days. It is having a clear reason for the retention period, making sure the CCTV system is configured accordingly and deleting footage when it is no longer required.
For businesses, landlords and property managers across Horley, Reigate, Redhill, Crawley, Surrey and West Sussex, this guide explains:
- Whether CCTV has a legal maximum retention period
- Why 30 days is not a universal rule
- How a business should choose a retention period
- What happens when an incident needs to be preserved
- How CCTV storage capacity affects recording time
- Who should be allowed to view footage
- What CCTV signs need to communicate
- How subject access requests affect CCTV management
- Why camera positioning matters
- How JPEC Fire & Security can help
Is there a legal CCTV retention period in the UK?
No single minimum or maximum retention period applies to every CCTV system operated by a UK business.
The UK GDPR and Data Protection Act 2018 do not simply state that all CCTV recordings must be deleted after a particular number of days.
Instead, organisations need to consider the purpose for which the footage is being collected and how long it is genuinely necessary to retain it.
This means two businesses using apparently similar CCTV systems could reasonably have different retention periods if their circumstances and purposes are different.
Do businesses have to delete CCTV after 30 days?
No. Thirty days is commonly associated with CCTV systems, but it is not a universal legal limit that automatically applies to every business.
A business should be able to explain why it has selected its particular retention period.
Keeping footage simply because the recorder has enough storage for it is not a good basis for deciding how long personal information should be retained.
Equally, automatically deleting footage too quickly could make a security system less useful if incidents are not normally discovered until several days later.
The retention period needs to reflect the actual purpose and circumstances.
How should a business decide how long to keep CCTV?
Start with the reason the cameras are there.
A business may use CCTV to help prevent and investigate theft, protect employees and visitors, monitor entrances or protect property and equipment.
The organisation should then consider how quickly an incident would normally become apparent.
For example, a shop may notice missing stock relatively quickly, while a business operating a less frequently visited site could take longer to discover damage or unauthorised access.
The retention period should be long enough to serve the legitimate purpose of the system without storing recordings indefinitely.
Can we keep CCTV footage just in case we need it one day?
Keeping recordings indefinitely simply because they might potentially become useful is difficult to justify.
The storage limitation principle requires personal information to be retained for no longer than necessary for the purpose for which it is being processed.
The Information Commissioner’s Office advises organisations to establish appropriate retention periods and delete footage when it is no longer required.
A clear CCTV policy can help the business document why footage is being recorded, how long it is normally kept and how it is deleted.
Can CCTV footage be kept for longer after an incident?
Yes, where there is a genuine reason to preserve particular footage.
For example, a recording may need to be retained where it relates to a reported theft, accident, security incident, insurance matter or police investigation.
This does not necessarily mean the entire CCTV archive needs to be kept for longer.
Relevant footage can potentially be identified and preserved while the normal retention policy continues to apply to unrelated recordings.
The organisation should document why the footage is being retained and ensure it remains appropriately protected.
What happens if the police ask for CCTV footage?
CCTV can provide useful evidence following theft, criminal damage, assault or other incidents.
If the police request relevant footage, the organisation needs to handle the disclosure appropriately and preserve the necessary recording so it is not automatically overwritten before it can be provided.
The system should therefore allow authorised users to locate and export recordings efficiently.
A professionally configured system should also retain useful information such as the correct date and time alongside the video.
Businesses should make sure staff responsible for CCTV understand what to do when a legitimate request is received.
Does CCTV automatically delete old footage?
Many digital CCTV systems use continuous or scheduled recording to a network video recorder or digital video recorder.
When the allocated storage becomes full, the system can normally be configured to overwrite older recordings automatically.
This creates a rolling recording period.
The actual amount of footage retained depends on the system configuration rather than simply the physical size of the recorder.
It is therefore important to understand what your CCTV system is actually retaining rather than assuming it records for a particular number of days.
What affects how much CCTV footage can be stored?
Several technical factors influence recording capacity.
These can include:
- the number of cameras
- camera resolution
- frame rate
- video compression
- continuous or motion-based recording
- hours of operation
- hard-drive capacity
- camera settings
Increasing image quality or adding additional cameras can increase storage requirements.
JPEC Fire & Security can design the recording system around the required camera coverage, image quality and appropriate retention requirements rather than simply installing the largest hard drive available.
Is more CCTV storage always better?
No.
From a technical perspective, a larger storage capacity can retain more footage. From a data-protection perspective, however, the fact that you can keep recordings for longer does not automatically mean that you should.
The retention period should be based on need rather than the maximum capability of the recorder.
This is an important distinction when specifying a CCTV system.
The storage should support the agreed retention period rather than the retention period being determined purely by whatever storage happened to be supplied.
Do CCTV recordings count as personal data?
Where CCTV footage contains images from which people can be identified, the recordings can constitute personal data.
That means businesses operating CCTV need to consider data-protection requirements alongside the security benefits of the system.
This affects areas such as why cameras are being used, where they are positioned, how footage is stored, who can access it and how long it is retained.
Installing CCTV is therefore not purely a question of choosing cameras and connecting them to a recorder.
Does a business need a reason for using CCTV?
Yes. Organisations should be clear about why CCTV is necessary and what problem it is intended to address.
Examples might include protecting a building against burglary, reducing theft, improving security around entrances or protecting staff and visitors.
The organisation also needs an appropriate lawful basis for processing personal data through its surveillance system.
The exact basis depends on the circumstances, so businesses should not simply copy another organisation’s CCTV policy without considering their own use of the system.
Do businesses need CCTV signs?
Businesses using CCTV should normally make people aware that surveillance is taking place.
The ICO advises organisations to display clear and visible signs where CCTV is operating.
The information should help people understand that they are being recorded, why the system is being used and who is responsible for it.
Signage should be positioned so people can see it appropriately in relation to the monitored area.
A camera hidden high on a building is not a substitute for providing appropriate privacy information.
Where should CCTV cameras be positioned?
Cameras should be positioned to capture what is necessary for the security purpose without unnecessarily recording areas that do not need to be monitored.
For a commercial property, useful areas may include entrances, exits, loading areas, car parks, reception points, stock areas or vulnerable external boundaries.
The correct coverage depends on the premises.
A small shop in Horley will have very different requirements from a warehouse near Crawley or a multi-building commercial site elsewhere in Surrey or West Sussex.
A site survey allows camera positions and viewing angles to be planned before installation.
Should CCTV record neighbouring properties or public areas?
The system should not capture more than is genuinely necessary for its intended purpose.
Some external commercial cameras may inevitably capture part of a public area because of where entrances or boundaries are located.
However, cameras should not be pointed unnecessarily into neighbouring premises, private areas or unrelated spaces.
Careful positioning and appropriate system configuration can reduce unnecessary recording while maintaining useful security coverage.
Who should be allowed to view CCTV footage?
Access should be restricted to people who genuinely need it.
A CCTV recorder should not become something that any employee can browse whenever they want.
Depending on the organisation, authorised access might be limited to particular managers, security personnel or other nominated staff.
The ICO advises organisations to protect surveillance recordings appropriately and restrict access to authorised individuals.
Password management, user permissions and physical security of recording equipment can all contribute to protecting footage.
Should the CCTV recorder be secured?
Yes. The physical and digital security of the recording equipment matters.
A recorder positioned openly where anybody can access or remove it creates an obvious weakness.
Where appropriate, recording equipment can be installed in a secure location with controlled access.
Network-connected systems should also be configured with appropriate security measures, including suitable passwords and user permissions.
Security cameras provide limited benefit if the recordings themselves are poorly protected.
Can employees ask to see CCTV footage of themselves?
Individuals have data-protection rights in relation to personal information held about them, and this can include CCTV footage in which they are identifiable.
A request for footage may therefore need to be handled as a subject access request depending on the circumstances.
Providing footage can become more complicated where recordings also contain identifiable images of other people.
Businesses should have procedures for recognising and handling requests and should obtain appropriate data-protection advice where necessary.
The CCTV system should make it reasonably practical for authorised staff to locate and export relevant footage.
What if customers or members of the public are recorded?
The same fundamental data-protection considerations apply where identifiable customers, visitors or members of the public are captured.
The business should be transparent about its use of CCTV and should only collect footage necessary for its stated purpose.
Public-facing premises such as shops, offices, leisure facilities and reception areas should pay particular attention to signage and camera positioning.
The fact that an area is accessible to the public does not mean CCTV recordings can be handled without considering data protection.
Can CCTV record employees at work?
CCTV can sometimes be used in workplaces, but monitoring employees raises additional privacy considerations.
Businesses should be clear about why monitoring is necessary and proportionate and should consider the reasonable expectations of employees.
The ICO identifies workplace monitoring as an area where organisations may need to consider a Data Protection Impact Assessment depending on the nature and risk of the processing.
Using cameras for general building security is also different from using surveillance specifically to monitor employee performance or behaviour.
Employers considering workplace monitoring should obtain appropriate data-protection advice for their circumstances.
Should CCTV record audio?
Audio recording can be considerably more intrusive than video alone and should not simply be enabled because a camera happens to contain a microphone.
A business needs to be able to justify the personal information it collects.
If audio is not necessary for the stated security purpose, recording it can create additional privacy and data-protection concerns without providing a meaningful security benefit.
The required functions should therefore be considered during system design and configuration rather than leaving every available feature switched on by default.
What happens if the CCTV footage is too poor to identify anything?
A CCTV system needs to produce images suitable for the purpose for which it was installed.
A camera can technically be recording while still providing limited useful evidence because of poor positioning, insufficient resolution, glare, darkness or an unsuitable field of view.
Lighting conditions are particularly important around entrances and external areas because image quality can change significantly between daytime and night-time.
Camera specification and positioning should therefore be considered together.
Simply increasing the number of cameras does not guarantee better security coverage.
Should the date and time on CCTV be checked?
Yes. Accurate time and date information can be extremely important when reviewing an incident.
If the recorder’s clock is incorrect, finding the relevant footage becomes more difficult and the usefulness of exported recordings can be reduced.
The system should therefore be correctly configured during commissioning and checked as part of appropriate ongoing maintenance.
Businesses should also know how to confirm that cameras are recording rather than discovering a problem only after an incident has occurred.
Does CCTV need maintenance?
Yes. CCTV should not simply be installed and forgotten.
Cameras can move, lenses can become dirty, vegetation can obstruct external views and recording equipment can develop faults.
Changes to a building can also make the original camera positions less effective.
Periodic checks can confirm that cameras remain correctly positioned, footage is being recorded, image quality is suitable and the system’s date and time are correct.
Retention settings should also be reviewed if cameras or recording settings are changed.
What should be included in a business CCTV policy?
The exact level of documentation depends on the organisation, but a CCTV policy can help establish how the system is managed.
It may cover:
- why CCTV is being used
- the areas being monitored
- the lawful basis for processing
- who is responsible for the system
- who can access recordings
- how long footage is normally retained
- how footage is securely deleted
- how incidents are preserved
- how footage requests are handled
- how the system is reviewed
The policy should reflect what the organisation actually does rather than being a generic document that bears little relation to the installed system.
Do CCTV rules change when the system is upgraded?
The underlying data-protection responsibilities remain relevant, but an upgrade is a good opportunity to review how the system is being used.
Higher-resolution cameras, additional coverage, remote access, cloud functions or different recording capabilities can change the amount and type of personal information being processed.
A business should therefore consider whether its original purpose, retention arrangements, privacy information and security controls remain appropriate.
Upgrading the hardware without reviewing the way footage is managed can leave an organisation with a technically better system but outdated procedures.
Can JPEC configure how long CCTV recordings are stored?
Yes. CCTV storage and recording arrangements form part of properly specifying and configuring a system.
The required retention period can be considered alongside the number of cameras, image quality, recording method and available storage.
The aim is to provide sufficient capacity for the agreed requirements without treating maximum storage capability as the reason to retain footage unnecessarily.
JPEC Fire & Security can also explain how recordings are accessed and exported so nominated users understand how to retrieve footage following an incident.
JPEC Fire & Security can help
JPEC Fire & Security designs, installs, configures and maintains CCTV systems for businesses, landlords, property managers and organisations across Horley, Reigate, Redhill, Crawley, Surrey, West Sussex and surrounding areas.
We can survey the premises and design camera coverage around the areas that genuinely need monitoring, taking account of entrances, boundaries, vulnerable areas, lighting conditions and the level of image detail required.
Recording equipment can then be specified around the number of cameras, image quality and appropriate retention requirements rather than relying on generic settings.
We can also integrate CCTV with other security systems where appropriate, including access control, door entry and intruder alarms.
Whether you are installing CCTV for the first time, replacing an outdated system or reviewing existing camera coverage, JPEC Fire & Security can provide a properly designed solution for the individual premises.
To arrange a CCTV survey or discuss an existing system, contact JPEC Fire & Security.
This article provides general information and is not legal or data-protection advice. CCTV requirements, lawful use and retention arrangements should be considered for the individual organisation and circumstances. Current ICO guidance should be consulted where personal data is being processed.
