UK GDPR and the Data Protection Act 2018 for CCTV and access control, explained
Reviewed by the SPS Technical team · Last checked 12 October 2026
Quick answer
CCTV footage and access control records that identify people are personal data under UK GDPR and the Data Protection Act 2018. If you run them you are the data controller: you need a lawful reason, clear signage, a short and justified retention period, secure storage, and a process to answer subject access requests within one month. Most organisations also need to pay the ICO data protection fee.
What it means for you
- Put up clear signs saying CCTV is in use, who runs it and how to contact them.
- Set and stick to a retention period, often around 30 days unless there is a reason to keep footage longer.
- Restrict who can view and export footage, and keep a record of disclosures.
- Answer subject access requests within one month, blurring other people where needed.
- Carry out a data protection impact assessment for new or higher-risk systems.
Who it applies to
Any business, school, landlord or organisation that operates CCTV, body-worn video or access control that records identifiable people.
Common questions
How long can I keep CCTV footage?
The law does not set a fixed period. Keep footage only as long as you need it for the purpose; many organisations use around 30 days, keeping specific clips longer when they relate to an incident.
Can someone ask for a copy of CCTV footage of themselves?
Yes. It is a subject access request, and you must normally respond within one month, protecting the identity of anyone else in the footage.
Do I need to register with the ICO for CCTV?
Most organisations that process personal data, including CCTV, must pay the ICO data protection fee unless an exemption applies. The ICO website has a short self-assessment.
Official sources
This page is a plain-English summary, not a copy of the official document.
Reviewed by the SPS Technical team · Last updated October 2026