Body Worn Camera Policy Template UK (2026 Guide)

Last updated: 2 October 2026

A body worn camera policy template UK organisations can rely on must set out the legal basis for recording under UK GDPR, retention and deletion rules, staff and public notification requirements, and access procedures — typically reviewed at least annually and always following a Data Protection Impact Assessment before deployment.

Key Takeaways

Pulse Operations notes that a body worn camera policy template UK-wide must reference the Data Protection Act 2018, UK GDPR, the Human Rights Act 1998 and the Protection of Freedoms Act 2012.
Pulse Operations highlights that the Information Commissioner's Office expects most organisations to complete a Data Protection Impact Assessment before deploying body worn cameras, per ICO guidance on body worn video.
Pulse Operations points to findings that complaints against West Midlands Police officers fell by 93% over 12 months following body worn video rollout, according to a Cambridge University-supported study covering almost 2,000 officers across four UK forces and two US police departments, per the West Midlands Police and Crime Commissioner (2016).
Retention periods should be justified and documented, not defaulted to "keep everything indefinitely."
Pulse Operations's own patrol platform shows that photo-based evidence — the same principle underpinning body worn camera policy — only holds up when every record is timestamped, attributable and stored tamper-evidently.

What is a body worn camera policy?

A body worn camera policy is a written document that sets out when, how and why an organisation records footage using body-worn devices, and who is accountable for that footage under data protection law. It exists to satisfy the accountability principle in UK GDPR — the requirement that organisations not only comply with data protection law but demonstrate that compliance in writing.

For businesses in retail, security, healthcare or facilities management, the policy is the difference between a defensible position if challenged by the ICO and an ad hoc practice that collapses under scrutiny. It typically sits alongside — but is distinct from — a separate operational procedure document, which covers day-to-day steps like turning cameras on, tagging incidents and uploading footage.

A generic template downloaded from the internet rarely reflects your sector, retention needs or existing systems. Pulse Operations builds compliance documentation around what operators actually do on site — patrols, incidents, occurrence book entries — because a policy that doesn't match operational reality fails the first time it's tested.

What legal framework governs body worn cameras in the UK?

The legal framework governing body worn cameras in the UK rests on four pillars: the Data Protection Act 2018, UK GDPR, the Human Rights Act 1998, and the Protection of Freedoms Act 2012. Together these determine whether recording is lawful, proportionate and properly governed.

UK GDPR requires a lawful basis for processing personal data — footage of identifiable people counts as personal data, and audio can capture special category data if it includes health details or protected characteristics. The Human Rights Act 1998 brings Article 8, the right to respect for private and family life, into UK law, meaning any recording must be proportionate to its aim. The Protection of Freedoms Act 2012 established the Surveillance Camera Code of Practice, originally overseen by the Biometrics and Surveillance Camera Commissioner.

Fraser Sampson, the former UK Biometrics and Surveillance Camera Commissioner, has warned that "the Code has not kept pace with the rapid evolution of technology" — a signal that organisations shouldn't treat older guidance as the final word. Read the Surveillance Camera Commissioner's Office blog and background on the Biometrics and Surveillance Camera Commissioner role for the latest position.

Does an organisation need a DPIA before deploying body worn cameras?

Yes — a Data Protection Impact Assessment (DPIA), the ICO's structured risk assessment for high-risk processing, is expected before most organisations deploy body worn cameras. Body worn video is treated by the ICO as inherently high-risk processing because it involves systematic monitoring of identifiable individuals in public or semi-public spaces.

The ICO's body worn video guidance sets out that a DPIA should cover the necessity and proportionality of recording, retention and disposal arrangements, and special category data risks, including audio capture. A DPIA is a documented process, not a formality — it must be revisited whenever cameras, storage systems or use cases change.

Local authorities publish working examples: Coventry City Council's ICO DPIA template for body worn cameras is a genuinely useful reference for private-sector teams building their first assessment, showing the structure regulators expect to see completed, not just referenced.

What key sections should a body worn camera policy template include?

A compliant body worn camera policy template UK organisations use should include a defined lawful basis, retention schedule, access and disclosure procedure, and named accountable roles. Missing any one of these is the most common reason a policy fails an audit or an ICO enquiry.

Section	What it must cover
Purpose and scope	Why cameras are used, which roles wear them, which sites are covered
Lawful basis	UK GDPR Article 6 (and Article 9 if special category data) basis for processing
Notification	Signage, verbal notice, privacy information given to staff and public
Recording rules	When cameras must/must not be activated; covert recording restrictions
Retention and deletion	Standard retention period, extended retention triggers, secure deletion method
Access and disclosure	Who can view footage, approval process, subject access request handling
Roles and accountability	Named policy owner, data protection lead, review cycle
Incident escalation	Linking footage to incident reports and, where relevant, police disclosure

Published examples worth benchmarking against include Mid Sussex District Council's Body Worn Camera Policy and the DWP's Body Worn Video Policy, both of which show how public bodies structure principles of use and governance. For SIA-licensed security operations, the same principles apply to broader occurrence recording — Pulse Operations's own tamper-evident daily occurrence book, covering 18 incident types, follows the identical logic of named accountability and time-stamped entries.

How long should body worn camera footage be retained?

Body worn camera footage should be retained only for as long as necessary to fulfil its recorded purpose, with a documented and defensible schedule rather than an indefinite default. Most policies set a short standard retention window — commonly 30 to 31 days for routine, non-evidential footage — with extended retention triggered only where footage is flagged as evidence for an incident, complaint, or legal proceeding.

Retention decisions should be proportionate: keeping every recording "just in case" breaches the storage limitation principle under UK GDPR. A defensible schedule states the standard period, the trigger for extension, who authorises extension, and the secure deletion method used once the period expires.

Storage should be encrypted, access-logged and restricted to named roles. This is the same principle Pulse Operations applies to its own audit log — a hash-chained (SHA-256), tamper-evident record with a built-in integrity check that walks the whole chain, so nobody can quietly edit history after the fact (as of August 2026). A body worn camera retention system without equivalent tamper-evidence is difficult to defend if footage is ever challenged in court or at an employment tribunal.

How should staff and the public be informed that recording is taking place?

Staff and the public must be informed that body worn cameras are recording through clear signage, verbal notice at the point of interaction, and a written privacy notice explaining what happens to the footage. UK GDPR's transparency principle requires this notification unless a specific, documented exemption applies — for example, where covert recording is justified for preventing or detecting crime.

Effective practice includes: visible signage on cameras or uniforms stating recording is in progress; a standard verbal announcement ("this interaction is being recorded") at the start of an encounter where practical; and a privacy notice accessible via QR code, website link or printed handout that names the data controller, retention period, and subject access rights.

Covert recording — where staff aren't told cameras are active, or footage captures non-public areas like staff rooms — carries significant legal risk and should only ever be used under a documented, narrowly scoped exception, reviewed by a data protection lead. Employees have privacy expectations in break rooms, changing areas and other non-public spaces that a policy must explicitly protect.

"As well as the clear evidential benefit provided by the cameras, this is very much about providing a tool to support and protect our frontline officers." — Chris Todd, Chief Superintendent, Project Lead, West Midlands Police

How does policy differ across retail, healthcare, security and policing?

A body worn camera policy differs by sector primarily in its lawful basis, retention triggers and disclosure routes — a retail security team, an NHS trust and a police force each face different legal duties even though the underlying technology is identical. Policing use is governed heavily by evidential standards and public interest disclosure; a study across four UK forces and two US police departments monitoring almost 2,000 officers found complaints fell 93% over 12 months following body worn video rollout, per the West Midlands Police and Crime Commissioner (2016), and separate research found a 57% reduction in police use of force with body-worn cameras in a Brazil-based study, per Queen Mary University of London (2026).

Private security operations — SIA-licensed guards, mobile patrol officers, keyholders — need a policy calibrated to the Private Security Industry Act 2001 licensing framework and client contractual obligations, not police-style evidential standards. Retail settings must address customer footage and shoplifting-related disclosure to police. Healthcare settings carry additional special category data sensitivity around patient information.

Even where demand for equipment outstrips supply — Police Scotland had access to only 941 body-worn video cameras despite force chiefs requesting between 10,000 and 11,000, per The Sunday Post / Scottish Conservatives FOI request (2022) — the policy obligations don't scale down. A five-camera retail deployment needs the same rigour as a force-wide rollout, just at proportionate scale.

In practice, on a landmark West London mixed-use development covering retail, residential, plant rooms and service yards, Priority First — the founding operation behind Pulse — needed proof that all 152 checkpoints across the site were genuinely walked, not just claimed. The same logic that governs body worn camera evidence — timestamped, attributable, unfalsifiable — applied to patrol verification: every checkpoint became photo-mandatory, with 540+ patrols logged in the first five months on record (production data, July 2026). A missed checkpoint shows as a gap, not a dispute raised six weeks later.

Common mistakes when adapting a generic template

The most common mistake when adapting a generic body worn camera policy template is copying retention periods, sector language, or disclosure procedures from a public-sector template without checking they fit a private operation. A DWP or council policy written for statutory functions won't map cleanly onto a retail chain or security contractor without material amendment.

Other frequent gaps include:

No named accountable role — policies that reference "the organisation" instead of a named data protection lead or policy owner
Retention set to "indefinite" or left blank — both breach the storage limitation principle
Missing DPIA reference — a policy that doesn't cite an underlying DPIA looks unfinished to an auditor
No review date — a policy with no scheduled review is treated as stale by regulators
Ignoring covert recording restrictions — templates rarely spell out when covert use is (and isn't) lawful
Copy-pasted signage wording that doesn't match the actual sites or devices in use

Templates should be treated as a starting structure, not a finished document — every section needs sector-specific review before sign-off.

Your body worn camera policy checklist

Confirm your lawful basis under UK GDPR Article 6, and Article 9 if audio may capture special category data
Complete a Data Protection Impact Assessment before deployment, referencing ICO guidance
Set a documented, proportionate retention period with a named extension trigger
Fit visible signage and prepare a written privacy notice for staff and public
Name a policy owner and data protection lead responsible for approval and review
Restrict footage access to named roles, with an access log for every view or export
Build a subject access request process that can locate and redact footage within statutory timescales
Schedule an annual policy review, or sooner following ICO or Surveillance Camera Code updates

FAQ

What should be included in a body worn camera policy UK?

A UK body worn camera policy should include a stated lawful basis under UK GDPR, a documented retention and deletion schedule, notification arrangements for staff and the public, named accountable roles, and a clear access and disclosure procedure. It should reference the underlying DPIA rather than stand alone.

Is a DPIA required for body worn cameras in the UK?

Yes, in most cases. The ICO treats body worn video as high-risk processing because it involves systematic recording of identifiable individuals, so a Data Protection Impact Assessment should be completed and kept up to date before and during deployment, per ICO guidance.

How long can body worn camera footage be legally retained?

There's no single legal retention period fixed in statute — organisations must set a proportionate, documented period based on purpose, commonly around 30 to 31 days for routine footage, extended only when flagged for an incident, complaint or legal proceeding. Indefinite retention without justification breaches UK GDPR's storage limitation principle.

Do employers need to inform staff and the public before using body worn cameras?

Yes. UK GDPR's transparency principle requires clear signage, verbal notice where practical, and a written privacy notice, unless a specific, narrowly documented exemption for covert recording applies — such as preventing or detecting crime.

Can members of the public request footage of themselves under a subject access request?

Yes. Individuals identifiable in footage can submit a subject access request, and organisations must locate, review and — where third parties also appear — redact the footage before disclosure, within the statutory timescale set by UK GDPR.

What is the difference between a body worn camera policy and a procedure?

A policy sets out the principles, legal basis and governance for using body worn cameras; a procedure sets out the practical steps staff follow day to day, such as when to switch cameras on, how to label footage, and how to escalate an incident. Both documents should reference each other but serve different audiences.

Do private businesses and security staff need a different policy to the police?

Yes. Private organisations, including SIA-licensed security operations, must build policies around their own lawful basis, retention needs and contractual obligations rather than adopting police-style evidential frameworks. Sector-specific review of any template — retail, security, healthcare — is essential before use.

Building a defensible record, whatever the camera

Pulse Operations doesn't write body worn camera policy templates — but the discipline behind a compliant one is the same discipline Pulse Operations builds into every patrol, incident and occurrence book entry: named accountability, a timestamp that can't be quietly edited, and a record that holds up when someone asks "prove it." Security and facilities teams drafting a body worn camera policy often find their bigger governance gap is patrol and incident evidence, not camera footage.

Pulse Operations's audit log is hash-chained (SHA-256) and tamper-evident, with a built-in integrity check that walks the whole chain — the same principle a defensible retention and access schedule requires for camera footage. Across live operations, 96.2% of checkpoints carry a watermarked photo (trailing 90 days, as of July 2026 — see /benchmark for methodology), because a record nobody can quietly alter is the only kind worth keeping.

If your organisation is reviewing its evidence and compliance stack alongside a body worn camera rollout, Pulse Operations's compliance runway brings SIA, BS 7858, DBS, right to work, training and Martyn's Law tracking onto one expiries dashboard. Get in touch with Pulse Operations to see how photo-verified evidence and tamper-evident logging fit alongside your camera policy, or read the guide to proving patrols actually happened for the same evidential thinking applied to physical security.

Explore Pulse Operations services

Take the 2-minute tour Pulse for security companies Pulse for facilities management Mobile patrol & keyholding

Written by

Lauren Dawkins — Founder, Pulse

Lauren Dawkins is a founder of Pulse, the operations platform for UK security and facilities companies. Pulse was built inside the founding team's own security and FM operation — real patrols, real clients, real compliance — before being opened to other operators.

Founding team, Pulse · UK security & facilities operations