If you run CCTV at your business, one question comes up more than any other: how long should you keep the footage? People often assume there is a fixed legal number. There is not, and that surprises most operators.
What actually governs CCTV in the UK is data protection law. Because recognisable footage of people is personal data, the same rules that cover customer records and staff files also cover your camera recordings. That changes the question from "how long can I keep it?" to "how long do I genuinely need it?"
The short answer
There is no single, legally mandated retention period for CCTV footage in the UK for general use. The Data Protection Act 2018 and UK GDPR require you to keep personal data for no longer than is necessary for the purpose you collected it, a principle called storage limitation.
In practice, many organisations settle on around 30 to 31 days for routine security footage. That is a convention rather than a statute: it is long enough to notice and investigate most incidents, and short enough to defend as proportionate. Some settings justify longer, and some justify much shorter.
The Information Commissioner's Office (ICO), the UK regulator, expects you to set a retention period based on why you are recording, write it down, and then actually delete footage when that period expires.
Why there is no fixed number
Retention has to match purpose, and purposes differ:
- A small shop recording to deter and investigate theft may only need a couple of weeks.
- A pharmacy monitoring a controlled drug cabinet may keep relevant footage longer to support audit trails and inspections.
- A car park operator dealing with slow-to-surface damage claims may justify a longer window.
- Footage tied to a specific ongoing incident or investigation can, and should, be preserved beyond the normal period until the matter is resolved.
The common thread is that you decide the period deliberately, document the reasoning, and apply it consistently. A retention period you cannot explain is difficult to defend if the ICO or an individual ever asks.
Is CCTV footage personal data?
Yes. If a person can be identified from the footage, directly or indirectly, it is their personal data under UK GDPR, and your organisation is the data controller responsible for it. That has several consequences:
- You need a lawful basis for recording, usually legitimate interests for security, and you should be able to show you considered the privacy impact.
- People must be told recording is taking place, which is what CCTV signage is for.
- Footage must be stored securely, with access limited to those who genuinely need it.
- Individuals have rights over footage of themselves, including the right to request a copy.
For higher-risk systems, such as surveillance in a healthcare or clinical setting, a Data Protection Impact Assessment (DPIA) is expected before installation, not afterwards.
Who can view CCTV footage at work?
Access should be restricted to a small number of authorised people with a clear reason, for example a manager, a designated security lead or a data protection contact. It should not be casually available to any member of staff, and every occasion footage is viewed or exported should be logged so there is accountability.
Outside the organisation, the police can request footage in connection with the prevention or detection of crime, using the law enforcement provisions in the Data Protection Act 2018. You can share footage with them where that applies, but you should record what you disclosed, to whom and why.
Individuals also have rights, but those rights are limited to footage of themselves, which is an important distinction covered below.
Can people request CCTV footage?
An individual can make a subject access request (SAR) for footage that shows them. When they do:
- You normally have one calendar month to respond.
- You cannot usually charge a fee.
- You must protect the privacy of other people in the same footage, typically by blurring or otherwise obscuring third parties before releasing it.
What someone cannot do is demand footage of other people, or of an incident that does not involve them, simply because it was captured on your cameras. Requests for footage of a third party, such as another driver in a car park, are generally routed through the police or an insurer rather than handed over directly.
Does CCTV footage get deleted automatically?
On most modern systems, yes, by design. Recorders overwrite the oldest footage once storage is full or once your configured retention period is reached, so old recordings are removed without anyone having to intervene. This is a feature, not a flaw: automatic deletion is how you actually meet the storage limitation principle instead of quietly hoarding recordings forever.
Two things matter here. First, the automatic deletion window should be set to match the retention period you decided on, not left at whatever the hardware shipped with. Second, when footage relates to a live incident, you need a way to export and preserve it before the system overwrites it.
Getting retention right without overthinking it
A workable approach for most UK businesses looks like this:
- Write down why you record and what you use footage for.
- Set a retention period that matches that purpose, and configure the recorder to enforce it automatically.
- Put up clear signage telling people they are being recorded and who the controller is.
- Restrict and log access to recordings.
- Have a simple process for preserving footage tied to a specific incident, and for handling subject access requests within the month.
None of this requires a large compliance function. It does require the camera system to be configured and supported properly, which is where good installation and ongoing management pay off.
Where Synergi Tech fits
Synergi Tech designs, installs and supports IP CCTV systems for UK businesses, and we configure retention, secure storage and access controls as part of the build rather than as an afterthought. That means recorders set to your agreed retention period, encrypted storage, and a sensible process for exporting footage when you need it.
For sectors with specific obligations, we tailor the approach: our healthcare and pharmacy CCTV systems cover controlled drug monitoring and patient privacy, and our wider CCTV installation services apply the same standards to retail, offices and industrial sites. If you want a system that is secure and straightforward to keep compliant, get in touch for a site survey.
This article is general guidance, not legal advice. For a definitive view on your obligations, consult the ICO's CCTV guidance or a data protection specialist.
Frequently asked questions
How long is CCTV footage kept in the UK?
There is no single legal retention period for general CCTV use in the UK. Data protection law requires you to keep footage only as long as necessary for your stated purpose. In practice many organisations keep routine security footage for around 30 to 31 days, but the right period depends on why you record, and footage linked to a specific incident should be preserved until the matter is resolved.
Is CCTV footage personal data?
Yes. If an individual can be identified from the footage, it is their personal data under UK GDPR, and your organisation is the data controller. That means you need a lawful basis for recording, must display signage, must store footage securely with restricted access, and must honour individuals' rights over footage of themselves.
Who can view CCTV footage at work?
Access should be limited to a small number of authorised people with a genuine reason, such as a manager or a designated security or data protection lead, and each viewing should be logged. It should not be openly available to all staff. The police can request footage for the prevention or detection of crime under the Data Protection Act 2018.
Can I request CCTV footage of myself?
Yes. You can make a subject access request for footage that shows you. The organisation normally has one calendar month to respond, usually cannot charge a fee, and must protect the privacy of other people in the footage, typically by obscuring them. You cannot demand footage of other people or of incidents that do not involve you.
Does CCTV footage get deleted automatically?
On most systems, yes. Recorders overwrite the oldest footage once storage fills up or the configured retention period is reached, which is how automatic deletion helps you meet the storage limitation principle. The deletion window should be set to match your agreed retention period, and you should have a way to export and preserve footage that relates to a specific incident before it is overwritten.