UK School CCTV Guidance 2026: Legal Rules

School CCTV is lawful in the UK, but footage of identifiable pupils, staff and visitors is personal data, so the school or trust, as data controller, must run it in line with UK GDPR and the Data Protection Act 2018. In practice that means a clear purpose, a written policy, visible signage, limited access to footage and a defined retention period. The ICO's video surveillance guidance is currently marked as under review following the Data (Use and Access) Act, so check the live ICO page before you finalise a specification or policy.

What does ICO CCTV guidance for schools actually require?

School CCTV is legal, but footage of identifiable people is personal data, so schools must handle it under UK GDPR and the Data Protection Act 2018, per GOV.UK data protection in schools. Clearway also names the Human Rights Act 1998 as a governing rule for school CCTV.

The ICO's video surveillance guidance covers CCTV, ANPR and facial recognition. The ICO marks it as under review following the Data (Use and Access) Act, so check the live ICO page before you sign off a design or policy.

What the guidance asks of a school in practice

The ICO's principles say footage should be:

• accurate;
• not excessive;
• used only for defined purposes;
• still necessary and proportionate throughout the system's life.

Clearway's summary adds that a school, college or nursery should produce a policy setting out how, where and why cameras are used, including the system's purposes and objectives. Camera positions must match that stated purpose, the school must make people aware of coverage, and access to footage has to be controlled.

Where cameras monitor individuals, those people have rights to access the data held about them. GOV.UK points to the Department for Education for school-specific CCTV guidance, and separately for protecting children's biometric information.

Which lawful basis can a school use for CCTV?

A school can usually rely on public task or legitimate interests for CCTV, but consent is a poor fit. The GOV.UK guidance lists public task, consent and legitimate interests as the options for images.

The captured GOV.UK extract covers photos and videos in detail, while its CCTV section is only partly captured. Treat what follows on CCTV as general guidance applying those principles, not a quotation of the school-CCTV rules.

Why consent rarely works

Consent is hard to apply because anyone who steps onto the site is recorded, including pupils, staff, contractors and visitors. Nobody can realistically opt out of a perimeter or corridor camera and still attend. That is reasoning from how CCTV operates, not an ICO statement. Consent also has to be freely given and withdrawable, which a fixed camera can't offer.

The right to object

Whichever basis you choose, people can object. GOV.UK says objections must be considered case by case, and the school may carry on only if it can show compelling grounds.

GOV.UK's ID-card example is about photos, so read it only as an illustration of that principle. The school must weigh the individual's objection and be able to justify continuing, rather than rely on a blanket policy.

Takeaway: pick and record one lawful basis for each purpose (for example, site security), then state it in the privacy notice.

Once the basis and purposes are written down, they can shape camera positions and the school's CCTV policy. If you're planning a system, browse the range at Clear Security or ask for a suggested system.

What goes into a school CCTV policy and DPIA?

A school CCTV policy must say how, where and why cameras are used and define the system's purposes, with a DPIA behind it. Clearway's summary of the rules adds that camera locations must match the stated purpose and that the school must tell people CCTV is in operation. Images of identifiable people count as personal data, per GOV.UK data protection in schools guidance.

A sequence to follow

The sample policy from LMETB is Irish, so it is not UK law. Its running order is still a sensible good-practice template for a UK DPIA and policy:

1. Justification for using CCTV
2. Camera locations
3. Covert recording
4. Signage
5. Access control
6. Police requests
7. Supplier arrangements
8. Review

Work through each point in writing, and record why a less intrusive option would not meet the purpose.

Check the law your policy cites

One example school policy in our research still lists the Data Protection Act 1998 as related legislation. Governors should confirm their own policy cites current law: Clearway names the Data Protection Act 2018 (UK GDPR) and the Human Rights Act 1998. An out-of-date document suggests nobody has done step eight.

The staff angle

Staff are filmed too. The NEU publishes a CCTV model policy and checklist aimed at union reps, which is a useful benchmark for how staff-facing safeguards should read in your own document.

Are cameras allowed in classrooms, and who can view the footage?

Classrooms are not covered by a blanket ban, but they are the hardest place to justify cameras, and a DPIA should decide it rather than habit. The sources cited here contain no classroom-specific rule, so treat what follows as general guidance, not a legal position.

The test to apply comes from the ICO's video surveillance guidance: use must be necessary and proportionate throughout the system's lifecycle, limited to defined purposes, and not excessive. Cameras covering corridors or entrances rarely raise the same questions as cameras watching lessons. Whether a primary or secondary school can meet the test in a classroom is something to document in a DPIA, with a named purpose and a less intrusive alternative considered first.

Who can view the footage

Limit viewing to named roles, such as the headteacher and the site manager, and keep a log of every access. Clearway says access to confidential data must be managed and controlled. Parents and pupils have no automatic right to browse footage, and staff outside those roles should not be able to open the recorder.

Subject access and police requests

People filmed can ask for footage of themselves, according to Clearway. As general guidance, protect other people's images (for example by masking) before release, and record every police request: who asked, what was provided and when.

How long should a school keep CCTV footage, and what does it cost to comply?

There is no fixed number of days to quote: under UK GDPR a school keeps footage no longer than necessary, sets a period for each stated purpose, and writes it into its CCTV policy. The ICO's video surveillance guidance says use must stay necessary and proportionate throughout the system's lifecycle. The GOV.UK schools guidance treats identifiable images as personal data.

Storage maths

Retention is the lever you control, because it sets how much drive capacity you buy:

storage needed = bitrate per camera × number of cameras × retention days

Doubling retention roughly doubles the capacity required, so a justified, shorter period costs less to run. Take each camera's bitrate from its datasheet.

What drives the compliance cost

• DPIA preparation and sign-off time
• Signage at every area covered
• Storage capacity for the agreed retention period
• Access controls on who can view or export footage
• Scheduled reviews to confirm the system is still necessary

For hardware choices, see our Best CCTV for Schools 2026: UK Guide.

Who fits it

We sell equipment only. The school's own electrician or installer fits it, working from each product's datasheet or installation guide. The Biometrics and Surveillance Camera Commissioner publishes recommended standards for installers and maintainers, with the page last updated on 27 May 2026, and a school can ask its installer which of them they follow.

Related products

Related products from our own range:

• CCTV warning sticker — 24-hour CCTV warning sticker.Self-adhesive warning sticker stating that the premises are under 24-hour CCTV surveillance.