Quick answer: UK law doesn't set a fixed period. Under UK GDPR, you keep footage only as long as you need it for the reason you have CCTV, then delete it. For most commercial premises that works out at about 30 days. That's long enough to find an incident that was spotted late, and to export the footage for the police or your insurer. Sites where problems often surface later, such as warehouses, yards and sites closed for long periods, may need longer. SPS Technical designs systems to keep at least 30 days, and up to 45 days where a site needs it.
Retention is one of the most common things we find set wrong when we take over a system. Some recorders keep a week because the hard drive was too small. Others keep six months because nobody changed the factory setting. Neither is a good answer. This guide explains what the law says, how to choose a period, and how much storage it takes.
What the law says
The Information Commissioner's Office (ICO) is clear that UK GDPR and the Data Protection Act 2018 don't prescribe any minimum or maximum retention period. Instead:
- The purpose decides the period. Work out why you have CCTV, such as preventing crime, protecting staff or investigating incidents, and how long you realistically need footage for that purpose.
- Keep it as short as works. The ICO says the retention period should be the shortest period that serves your purpose.
- Defaults are not a reason. Keeping footage for months just because the recorder's factory setting or hard drive allows it is likely to be keeping it for longer than necessary.
- Delete it securely, and check you do. Footage should be overwritten or deleted when the period ends, with regular checks that this is actually happening.
- Longer for a specific reason is fine. Footage of an incident can be exported and kept for as long as an investigation, claim or court case needs it.
Choosing a period for your site
| Situation | Typical period | Why |
|---|---|---|
| Most offices, shops and commercial premises | 30–31 days | Covers a month of trading, so incidents spotted late can still be found and exported |
| Warehouses, yards and sites with stock checks | 31–45 days | Theft is often found at a stock count or audit, weeks after it happened |
| Sites closed for long periods (seasonal, schools in holidays) | Longer than the closure | So footage from the start of a closure is still there when the site reopens |
| Premises with licensing or insurance conditions | As the condition states | Some premises licences and insurance policies set a period; check yours |
Whatever you choose, write it down with the reason. If someone asks for their footage, or the ICO asks how you decided, you can show your thinking.
How much storage does it take?
Storage is what usually stops a system reaching its retention period. The number of cameras, image quality and how busy the scene is all add up. These figures come from our CCTV storage calculator. They assume H.265 cameras recording all the time at normal activity, with 10% spare capacity, unless stated.
| Cameras | Image quality | Storage for 30 days | Storage for 45 days |
|---|---|---|---|
| 4 | 4MP | 4 TB | 6 TB |
| 8 | 4MP | 8 TB | 12 TB |
| 16 | 5MP | 20 TB | 32 TB |
| 32 (busy scenes) | 4MP | 48 TB (31 days) | 80 TB |
Recording only on motion or events can cut storage substantially. However, it relies on the detection being set up well, or you risk gaps exactly when something happens.
Common problems we find
- The recorder keeps far less than people think. Cameras get added or upgraded to higher resolution, and the same hard drive now holds a week, not a month.
- A hard drive has failed. Many recorders keep running with a failed drive, so recording quietly stops. Remote health monitoring checks every hour that each system is recording and sends an email alert if it isn't.
- The clock is wrong. An incorrect date and time stamp makes footage hard to use as evidence. It should be checked at every service visit.
- Nobody knows how to export. Footage gets overwritten while staff work out how to save it. Short training at handover, and a written procedure, avoid this.
- Retention was never decided. The system is still on its factory setting. That can be too short to be useful, or longer than the law allows you to justify.
Frequently asked questions
Is there a legal minimum for keeping CCTV footage in the UK?
No. UK GDPR and the Data Protection Act 2018 set no minimum or maximum. You decide based on your purpose and keep footage no longer than necessary.
Why do so many businesses keep 30 or 31 days?
A month is long enough to find most incidents, including those discovered late, and to export footage for the police or an insurer. It also keeps storage costs sensible. It is common practice, not a legal rule.
Can I keep footage of an incident for longer?
Yes. Export the relevant clips and keep them for as long as the investigation, claim or court case needs them. Then delete them.
How do I check how many days my system keeps?
Open playback on the recorder and find the earliest recording available. If it's shorter than you expected, the hard drive may be too small or failing. Our free CCTV health check can help you work out what to look at.
What if someone asks for footage of themselves?
People can ask for a copy of footage that shows them (a subject access request). You usually have one month to respond. That's one more reason to know how to find and export footage quickly.
Get your retention right
We check retention, storage and drive health at every CCTV service, and we size storage at survey for new commercial CCTV systems. Book a free site survey, call Hull on 01482 226570, or work out your storage needs first. For live response to intruders, see our active CCTV monitoring guide.