CCTV Usage Policy
​
(UK GDPR & Data Protection Act 2018 Compliant)
Retention Period: Less Than 14 Days
1. Purpose of CCTV
​
The CCTV system is used to protect staff, customers, visitors, and property by deterring and detecting crime, monitoring security incidents, and assisting law enforcement when required. The system is not used for staff monitoring or performance management.
2. System Overview
​
The business operates four CCTV cameras covering entrances, exits, and vulnerable areas. Due to their positioning, some cameras may capture limited footage beyond the property boundary, including public areas or neighbouring land. This is necessary to secure access points and prevent crime. All footage captured outside the boundary is treated with the same safeguards as internal footage.
3. Legal Basis for Processing
​
CCTV footage is processed under the lawful basis of legitimate interests (Article 6(1)(f) UK GDPR), specifically the prevention and detection of crime and the protection of people and property.
4. Transparency and Signage
​
Clear and visible signs are displayed at all entry points to inform individuals that CCTV is in operation, the purpose of the system, and contact details for further information.
5. Minimising Intrusion Beyond the Boundary
​
Where cameras capture areas outside the premises:
• Cameras are angled to avoid unnecessary intrusion.
• Only areas relevant to security needs are monitored.
• Footage is not used to observe public behaviour unrelated to security.
• Camera positions are reviewed periodically to ensure proportionality.
​6. Retention and Deletion of Footage
​
• Footage is retained for a maximum of 14 days, and often less depending on storage capacity.
• The retention period is based on operational need and the requirement to identify and investigate incidents.
• After the retention period, footage is automatically overwritten unless required for an active investigation, legal claim, or law‑enforcement request.
• Any footage retained for these purposes is deleted once no longer required.
7. Access and Disclosure
​
Access to CCTV footage is restricted to authorised personnel. Disclosure is permitted only when:
• Requested by law enforcement for the investigation of a crime.
• Required by law or regulatory authorities.
• Necessary to establish, exercise, or defend legal claims.
Footage is not shared with third parties for marketing or non‑security purposes.
​
8. Subject Access Requests (SARs)
​
Individuals may request access to footage in which they appear. Requests must be made in writing and include sufficient detail (date, time, location) to identify the footage. Responses will be provided within one month, subject to lawful exemptions and the need to protect the privacy of others.
9. Security of Footage
​
• Footage is stored on secure, password‑protected systems.
• Access is logged and monitored.
• Equipment is maintained to ensure image quality and system reliability.
• Staff with access receive appropriate data‑protection training.
10. ICO Registration
​
The business is registered with the Information Commissioner’s Office (ICO) and pays the required data protection fee, unless exempt.
11. Policy Review
​
This policy is reviewed annually or sooner if camera locations change, new equipment is installed, or relevant legislation or ICO guidance is updated.