--- title: "UK GDPR / DPA 2018 explained in plain English | SPS Technical" url: https://sps-technical.com/resources/standards/uk-gdpr-cctv description: "CCTV footage and access control records that identify people are personal data under UK GDPR and the Data Protection Act 2018. If you run them you are the…" lang: en-GB --- UK GDPR / DPA 2018 Current edition Law and data protection # UK GDPR and the Data Protection Act 2018 for CCTV and access control, explained Reviewed by the SPS Technical team · Last checked 12 October 2026 ## Quick answer CCTV footage and access control records that identify people are personal data under UK GDPR and the Data Protection Act 2018. If you run them you are the data controller: you need a lawful reason, clear signage, a short and justified retention period, secure storage, and a process to answer subject access requests within one month. Most organisations also need to pay the ICO data protection fee. ## What it means for you - Put up clear signs saying CCTV is in use, who runs it and how to contact them. - Set and stick to a retention period, often around 30 days unless there is a reason to keep footage longer. - Restrict who can view and export footage, and keep a record of disclosures. - Answer subject access requests within one month, blurring other people where needed. - Carry out a data protection impact assessment for new or higher-risk systems. ## Who it applies to Any business, school, landlord or organisation that operates CCTV, body-worn video or access control that records identifiable people. ## Common questions How long can I keep CCTV footage? The law does not set a fixed period. Keep footage only as long as you need it for the purpose; many organisations use around 30 days, keeping specific clips longer when they relate to an incident. Can someone ask for a copy of CCTV footage of themselves? Yes. It is a subject access request, and you must normally respond within one month, protecting the identity of anyone else in the footage. Do I need to register with the ICO for CCTV? Most organisations that process personal data, including CCTV, must pay the ICO data protection fee unless an exemption applies. The ICO website has a short self-assessment. ## Official sources - ICO guidance on video surveillance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/ - ICO: biometric data guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/biometric-data-guidance-biometric-recognition/ This page is a plain-English summary, not a copy of the official document. Reviewed by the SPS Technical team · Last updated October 2026 ## Structured data ```json [ { "@context": "https://schema.org", "@id": "https://sps-technical.com/#organization", "@type": "Organization", "name": "SPS Technical", "legalName": "SPS Security Ltd", "parentOrganization": { "@id": "https://sps-security.com/#organization" }, "description": "SPS Technical is the fire and security systems division of SPS Security Ltd, providing commercial fire alarm, CCTV, intruder alarm and access control design, installation, maintenance, monitoring and system takeovers across Yorkshire, Lincolnshire and the Humber.", "url": "https://sps-technical.com", "logo": "https://media.base44.com/images/public/6989f2350e53aab8836435e3/0ceea3d11_SPSTECHNICALLOGO.jpg", "telephone": "+441482226570", "email": "info@sps-technical.com", "foundingDate": "1992", "address": { "@type": "PostalAddress", "streetAddress": "Neptune House, Neptune Street", "addressLocality": "Hull", "addressRegion": "East Yorkshire", "postalCode": "HU3 2BP", "addressCountry": "GB" }, "hasCredential": [ { "@type": "EducationalOccupationalCredential", "name": "SSAIB registration HUMB018: intruder alarms (PD 6662), CCTV (SSAIB Code of Practice SS2003), access control (SSAIB Code of Practice SS2002) and fire alarm systems", "credentialCategory": "certification", "recognizedBy": { "@type": "Organization", "name": "SSAIB", "url": "https://www.ssaib.org" } }, { "@type": "EducationalOccupationalCredential", "name": "BAFE SP203-1 certificate 104302 (BAFE organisation ID 303286): fire detection and alarm system design, installation, commissioning and maintenance", "credentialCategory": "certification", "recognizedBy": { "@type": "Organization", "name": "BAFE", "url": "https://www.bafe.org.uk" } }, { "@type": "EducationalOccupationalCredential", "name": "ISO 9001:2015 certificate 1208-QMS-001", "credentialCategory": "certification", "recognizedBy": { "@type": "Organization", "name": "Alcumus ISOQAR" } }, { "@type": "EducationalOccupationalCredential", "name": "ISO 14001:2015 certificate 1208-EMS-001", "credentialCategory": "certification", "recognizedBy": { "@type": "Organization", "name": "Alcumus ISOQAR" } }, { "@type": "EducationalOccupationalCredential", "name": "CHAS membership CHAS-0004703", "credentialCategory": "certification", "recognizedBy": { "@type": "Organization", "name": "CHAS" } }, { "@type": "EducationalOccupationalCredential", "name": "Constructionline Bronze registration 92018", "credentialCategory": "certification", "recognizedBy": { "@type": "Organization", "name": "Constructionline" } }, { "@type": "EducationalOccupationalCredential", "name": "SafeContractor certificate PE5040", "credentialCategory": "certification", "recognizedBy": { "@type": "Organization", "name": "Alcumus SafeContractor" } }, { "@type": "EducationalOccupationalCredential", "name": "Paxton Gold Installer", "credentialCategory": "certification", "recognizedBy": { "@type": "Organization", "name": "Paxton" } }, { "@type": "EducationalOccupationalCredential", "name": "Approved installer of police-response intruder alarms: Humberside Police, Lincolnshire Police, North Yorkshire Police, South Yorkshire Police, West Yorkshire Police, Nottinghamshire Police, Derbyshire Constabulary, Greater Manchester Police", "credentialCategory": "certification", "recognizedBy": { "@type": "Organization", "name": "UK police forces (NPCC Police Requirements for Security Systems)" } } ], "areaServed": [ { "@type": "AdministrativeArea", "name": "East Yorkshire" }, { "@type": "AdministrativeArea", "name": "North Lincolnshire" }, { "@type": "AdministrativeArea", "name": "Lincolnshire" }, { "@type": "AdministrativeArea", "name": "South Yorkshire" }, { "@type": "AdministrativeArea", "name": "West Yorkshire" }, { "@type": "AdministrativeArea", "name": "North Yorkshire" } ], "knowsAbout": [ "Fire alarm systems", "CCTV systems", "Intruder alarm systems", "Access control systems", "System monitoring", "Planned preventative maintenance", "Fire and security system takeovers", "Multi-site fire and security maintenance", "Maintenance and compliance" ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://sps-technical.com/" }, { "@type": "ListItem", "position": 2, "name": "Resources", "item": "https://sps-technical.com/resources" }, { "@type": "ListItem", "position": 3, "name": "UK GDPR / DPA 2018" } ] }, { "@context": "https://schema.org", "@type": "Article", "@id": "https://sps-technical.com/resources/standards/uk-gdpr-cctv#article", "headline": "UK GDPR and the Data Protection Act 2018 for CCTV and access control, explained", "description": "CCTV footage and access control records that identify people are personal data under UK GDPR and the Data Protection Act 2018. If you run them you are the…", "url": "https://sps-technical.com/resources/standards/uk-gdpr-cctv", "mainEntityOfPage": "https://sps-technical.com/resources/standards/uk-gdpr-cctv", "inLanguage": "en-GB", "dateModified": "2026-10-12", "author": { "@id": "https://sps-technical.com/#organization" }, "publisher": { "@id": "https://sps-technical.com/#organization" }, "about": { "@type": "DefinedTerm", "name": "UK GDPR / DPA 2018", "description": "UK GDPR and the Data Protection Act 2018 for CCTV and access control", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/" }, "citation": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/cctv-and-video-surveillance/guidance-on-video-surveillance-including-cctv/" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "How long can I keep CCTV footage?", "acceptedAnswer": { "@type": "Answer", "text": "The law does not set a fixed period. Keep footage only as long as you need it for the purpose; many organisations use around 30 days, keeping specific clips longer when they relate to an incident." } }, { "@type": "Question", "name": "Can someone ask for a copy of CCTV footage of themselves?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. It is a subject access request, and you must normally respond within one month, protecting the identity of anyone else in the footage." } }, { "@type": "Question", "name": "Do I need to register with the ICO for CCTV?", "acceptedAnswer": { "@type": "Answer", "text": "Most organisations that process personal data, including CCTV, must pay the ICO data protection fee unless an exemption applies. The ICO website has a short self-assessment." } } ] } ] ```