CCTV and UK GDPR: Signage, Retention and Subject Access Requests Explained

A camera protecting a yard or car park is processing personal data, which means UK GDPR and the Data Protection Act apply from the day it goes live. None of the obligations are difficult, but the ICO expects them to actually be in place. Here is the working checklist. Last updated: July 2026. This is general guidance, not legal advice — the ICO's video surveillance guidance is the authoritative source. Have a reason, write it down You need a documented lawful basis — for site security that is almost always legitimate interests. Write a short statement of why the cameras are there, what they cover and why less intrusive options are insufficient. Ten minutes of writing; it is the first thing asked for in any complaint. Signage: visible, honest, contactable Signs must tell people they are entering a monitored area, who operates the system and how to contact them. Place them at every entrance, keep them legible from a distance, and make sure the contact details actually work. Covert monitoring of workers or the public has a very high legal bar — assume it is off the table. Retention: keep less, for a reason There is no fixed legal retention period — you set one and justify it. For most commercial sites 14 to 31 days covers incident discovery; keep footage longer only when it is evidence in a live matter. Cloud platforms that auto-delete on schedule make compliance the default rather than a chore. Subject access requests: one month Anyone caught on camera can request their footage, and you have one calendar month to respond. You must supply their images while protecting other people's — blurring third parties where needed. Know how to export footage from your system before the first request arrives. Sharing with police You can share footage in response to a proper request for crime prevention or investigation — log what was shared, with whom and why. Where the right system helps Modern cloud CCTV makes most of this automatic: scheduled deletion, audit logs, and clip export in minutes rather than an evening with a DVR. Our systems with Fortix AI build retention and export controls in. Questions about a compliant setup? Talk to our team.