Using CCTV and how long you can keep footage

Closed circuit television (CCTV) and other video surveillance, including smart doorbells, body worn video and ANPR cameras, can help protect people and property. However, when a camera captures images or audio of identifiable people, that recording is their personal information and data protection law (the UK GDPR and the Data Protection Act 2018) applies.

When does data protection law apply?

If your CCTV only captures the inside of your own home, data protection law does not usually apply. If it records beyond your own property boundary – for example a neighbour’s property, a shared driveway, a communal area or a public footpath or street – then you are processing other people’s personal information and you must follow the rules.

Your responsibilities as a CCTV operator

• Have a clear, justifiable reason for using the cameras (for example crime prevention or protecting property).
• Capture no more than you need – position cameras to avoid recording public areas or other people’s property where possible, and use privacy filters or blanking to mask areas you do not need.
• Let people know recording is taking place, for example by displaying clear signage.
• Store recordings securely so only people who need to see them can access them.
• Respond appropriately to requests from people who appear in the footage.
• Delete footage regularly, automatically, or both.

How long can you keep CCTV footage?

There is no single fixed retention period set in law. The key principle is storage limitation: you must not keep footage for longer than is necessary for the purpose you collected it. In practice this means:

• Decide a standard retention period based on why you are recording – many organisations and households use a short period such as around 30 days, after which footage is automatically overwritten or deleted.
• Only keep footage longer than your standard period if there is a specific reason – for example because it is needed as evidence for an ongoing incident, insurance claim or police investigation. Once that reason ends, delete it.
• Document your retention period and make sure deletion happens regularly or automatically.

Keeping footage “just in case” indefinitely is not compliant. The longer you hold recordings, the greater the privacy intrusion and the security risk.

Responding to requests for footage

People who are recorded have the right to ask for a copy of footage they appear in. This is a subject access request. You must normally respond within one calendar month. When sharing footage you should protect the privacy of other people who appear in it, for example by blurring them.

Rights of people who are recorded

• Right of access – request a copy of the footage they appear in.
• Right to erasure – ask for footage of them to be deleted.
• Right to object – object to being recorded; the operator must have a strong reason to continue.

Where to get more help

The Information Commissioner’s Office (ICO) provides detailed video surveillance guidance and a CCTV self-assessment checklist at ico.org.uk. You can contact the ICO helpline on 0303 123 1113.

Source: Information Commissioner’s Office (ico.org.uk). Contains public sector information licensed under the Open Government Licence v3.0.