GDPR CCTV Policy Template UK: 2026 Guide

A UK CCTV policy is a short written document that names who controls the system, why it exists, how long footage is kept, who can see it and how requests for footage are handled. It applies to business systems that capture identifiable people, while purely household use is generally outside data protection rules, according to GOV.UK.

The ICO's CCTV guidance is under review following the Data (Use and Access) Act, so check the live ICO page before you or your client signs anything off.

What should a GDPR CCTV policy contain, clause by clause?

A GDPR CCTV policy typically runs from purpose and scope through legal basis, signage, retention and access requests to review and adoption. This is one real-world structure from a published group CCTV surveillance policy, not a legal mandate:

1. Introduction
2. Purpose
3. Scope
4. Legal basis
5. Transparency and signage
6. Data minimisation
7. DPIA
8. Access
9. Operation, retention and storage
10. Data subject rights
11. Governance and review
12. Adoption

Treat it as the skeleton of a GDPR CCTV policy template, then fill each clause with your own site's facts. Retention periods, camera locations and who may view footage are yours to define.

Policy, privacy notice or checklist?

These are three different documents. The policy is internal and controls how staff behave. The privacy notice is public-facing and shorter. The ICO's checklist for limited CCTV systems is an audit aid for small premises such as shops, not a policy.

Ireland's Data Protection Commission treats a CCTV data protection policy as best practice, shared with employees and optionally published. That is Irish regulator guidance, not UK.

Is CCTV covered by GDPR?

Yes, for business use: footage of identifiable people is personal data, so UK GDPR and the Data Protection Act 2018 apply. The ICO's self-assessment questions start with purpose, the Article 6 legal basis, necessity and proportionality, and note that a DPIA may be needed.

Household cameras are the exception. The ICO says data protection rules do not apply to a camera on your own home used for household purposes, such as deterring burglary. Anyone filmed can usually request their footage free of charge, and you normally have one calendar month to respond.

How do you write the purpose and lawful basis clauses?

Name the controller, state specific purposes, bar incompatible uses, and document a lawful basis, which for private operators often points to legitimate interests.

Purpose clause

The ICO's checklist for limited CCTV systems is aimed at small premises such as shops, and its wording translates neatly into a fill-in-the-blank clause:

CCTV at [site address] is controlled by [named controller]. It was judged necessary for [crime prevention and detection / safety of individuals / security of premises]. Footage will not be used for purposes incompatible with these. Necessity and proportionality are reviewed [interval].

The "incompatible purposes" line does real work. GOV.UK's example is that a system installed to detect crime should not then be used to monitor staff productivity. If you later want a second use, update the clause first and check it is proportionate.

Lawful basis clause

The checklist asks for a documented lawful basis, and your policy should cite UK GDPR Article 6, plus Articles 9 and 10 and the Data Protection Act 2018 where footage could reveal special category or criminal offence data. For example:

Our lawful basis is Article 6(1)(f), legitimate interests, recorded in an assessment dated [date]. Where footage may include criminal offence data (Article 10) or special category data (Article 9), the DPA 2018 condition relied on is [condition].

Avoid consent as your basis for anything public-facing. Visitors and passers-by cannot realistically refuse or withdraw it without leaving, and Century Fire & Security's GDPR page lists consent among the bases it discusses.

Legitimate interests need a necessity test and a balancing test. EDPB Guidelines 3/2019 (version 2.0, adopted 29 January 2020) set that out, but they are EU guidance. Treat them as persuasive rather than binding in the UK, and follow the ICO where the two differ.

How long can CCTV be stored, and who can access it?

No fixed UK maximum applies: you choose a retention period, justify it, and restrict access to a small set of authorised people. The ICO checklist for limited CCTV systems says footage should be stored securely "for a defined period", with a limited number of authorised people able to reach it.

Retention clause

Footage is overwritten after [__] days because [reason]; extracts are kept only while [incident / legal need].

The reason should tie back to your stated purpose. Remember that anyone can ask to see images of themselves, and you usually must supply them free within 1 calendar month, so a very short overwrite cycle can leave you with nothing to provide.

To size storage, use this general formula with the live figure taken from your NVR datasheet:

cameras × bitrate (Mbps) × seconds retained ÷ 8 = megabytes

Browse hard drives and recorders at Clear Security, or ask for a suggested system sized to your retention period.

Access clause

Footage may be viewed only by [named roles]. Every view, export or deletion is logged with date, user and reason in [log location]. The recorder is kept in [locked room or cabinet].

Name roles, not individuals, so the clause survives staff changes. Where your NVR supports separate user accounts, give each person their own login rather than sharing one, so the log means something. Your own electrician or installer can fit the recorder in a lockable location, following the product's installation guide.

How should the policy handle police disclosure and the camera register?

Name one role and a deputy who may release footage, and log every release with date, requester, reason, and exactly what was released. Keep a camera-by-camera register, with the installer completing the field of view and private land columns at handover.

Name who may release footage, log every release, and keep a camera-by-camera register that your installer helps you complete.

Police disclosure clause

The ICO checklist for limited CCTV systems expects images clear enough to be easily disclosed to authorised third parties such as law enforcement. The EDPB's video-surveillance guidelines (version 2.0, adopted 29 January 2020) give EU background on the same point. The clause should set out:

• Who may release: one named role, plus a deputy, so footage never leaves on a casual request.
• Request log: date, requester, reason, and exactly what was released (cameras, time window).
• Export format: footage the recipient can actually play. Check your recorder's datasheet for export options and state the format in the policy.

Posting clips online to identify someone is best left to the police, as Century Fire & Security also notes. Your policy can say so explicitly.

Camera register template

Camera ID	Location	Field of view	Purpose	Private land / non-visitors captured?	Signage present?	Audio on/off	Date last checked
(template) CAM-01
(template) CAM-02

Why the installer fills in half of it

Field of view and "private land or non-visitors captured" depend on lens angle and mounting position, which the person fitting the camera sees on the day. Clear Security only sells equipment, so your own installer or electrician should complete those two columns at handover. Lens details are in each product's datasheet. Re-check the register whenever a camera is moved.

Browse the range at https://clearsecurity.co.uk or ask for a suggested system.

What should the review schedule and installer handover look like?

Review the policy on a fixed date you choose and whenever the system changes. The installer should hand over a one-page sheet tying the written policy to the real equipment, and check the recorder's actual retention against the policy.

Review the policy on a fixed date you choose and whenever the system changes, and have the installer hand over a one-page sheet that ties the written policy to the real kit. The ICO's checklist for limited CCTV systems has columns for date checked, who checked and next review date. It also asks you to keep reviewing whether CCTV remains necessary and proportionate.

Review table

Trigger	Re-check	Record
Routine date (set by the controller)	Is CCTV still necessary? Is the purpose unchanged?	Checked date, by whom, next review
New or moved camera	Camera register, signage, field of view	Updated register
Change of purpose	Lawful basis, proportionality, whether a DPIA is needed	Revised purpose clause
Complaint or access request	Whether the policy handled it as written	Outcome noted
System upgrade or NVR swap	Retention behaviour, access accounts	Fresh retention check

Installer handover sheet (fill in)

• Policy document and version: ______
• Camera register attached (Y/N): ______
• Signage locations: ______
• NVR retention setting: ______
• Named controller: ______
• ICO registration number: ______
• Date handed over / by: ______
• Next review date: ______

Setting versus policy

Check what the recorder actually does, not what the clause says. Most recorders overwrite the oldest footage once the disk fills, so retention is the outcome of usable capacity divided by the combined daily write rate of all cameras. Find the oldest playable recording and compare its age with the policy clause. If footage is held longer than stated, or shorter, one of the two documents is wrong.

Schools and larger sites

More staff, pupils and visitors means more people who might make an access request, so name who receives them. Where cameras serve purposes beyond security, the ICO checklist notes that a Data Protection Impact Assessment may be needed to show those uses are proportionate. The customer's own installer or electrician fits the equipment, so ask them to complete this sheet.