CCTV Policy Template UK: What It Must Include (2026)

Last updated: 3 October 2026

Pulse Operations sets out that a CCTV policy template UK businesses can rely on must set out the lawful basis for recording, retention periods, signage, staff monitoring rules and subject access request handling under UK GDPR and the Data Protection Act 2018. There is no single approved template — the ICO judges organisations on substance, not paperwork.

Key Takeaways

• Pulse Operations notes that the ICO requires any organisation using CCTV to identify a lawful basis under UK GDPR before recording starts, not after.
• Research commissioned by the ICO found 70% of those surveyed would find monitoring in the workplace intrusive, per HFW's analysis of ICO guidance on monitoring workers (2023).
• Pulse Operations notes that UK law sets no fixed retention period for CCTV footage — organisations must justify whatever period they choose against their stated purpose.
• The ICO data protection fee runs in three tiers: Tier 1 organisations pay £52 a year, Tier 2 pay £78, and Tier 3 pay £3,763, according to Goodwille's guide to ICO registration (2026).
• The Surveillance Camera Code of Practice was updated and laid before Parliament on 16 November 2021, coming into force on 12 January 2022, per GOV.UK (2022).

What legal obligations under UK GDPR and the Data Protection Act 2018 apply to CCTV use?

UK GDPR — the retained EU data protection regulation that continues to apply in the UK after Brexit — treats CCTV footage of identifiable people as personal data, and the Data Protection Act 2018 sets the domestic framework alongside it. Any business capturing images of employees, visitors or the public on camera is processing personal data the moment a face becomes identifiable.

That means the standard data protection principles apply in full: lawfulness, fairness and transparency; purpose limitation; data minimisation; storage limitation; and accountability. The ICO's CCTV and video surveillance guidance is explicit that organisations must be able to justify why cameras are pointed where they are, not simply that cameras exist.

A lawful basis has to be chosen before recording starts — usually "legitimate interests" for crime prevention or asset protection, though public authorities more often rely on "public task". The ICO has warned that continuous recording is hard to defend: "continuous audio and video recording can be highly intrusive and you are unlikely to be able to justify it in most circumstances," according to the Information Commissioner's Office. Where CCTV monitors employees specifically, the same guidance now sits alongside the ICO's dedicated workplace monitoring guidance, updated to reflect growing concern about intrusive tracking.

For high-risk processing — facial recognition, ANPR, covert monitoring — a Data Protection Impact Assessment (DPIA) is required before deployment, documenting the risk to individuals and the mitigations put in place.

Does the organisation need to register with the ICO as a data controller?

Most businesses using CCTV for crime prevention or security purposes must pay the ICO's annual data protection fee and register as a data controller. The ICO's registration FAQs confirm that any company using CCTV for these purposes falls within scope, with very narrow exemptions.

The fee itself is banded by organisation size. Tier 1 covers micro organisations with up to 10 staff and turnover under £632,000, paying £52 a year; Tier 2 organisations pay £78; and Tier 3, the larger organisations, pay £3,763 a year, according to Goodwille's guide to ICO registration (2026). Failing to pay when required is itself an offence, separate from any breach of the data protection principles.

A residential landlord with a single doorbell camera is often exempt under the "domestic purposes" carve-out. A managing agent running CCTV across a block of flats, a retailer with in-store cameras, or a security contractor operating a control room are not — they are processing personal data commercially and need to register.

What must a CCTV policy document include to be compliant with ICO guidance?

A compliant CCTV policy is a written document that sets out why cameras are used, who controls the footage, and how individuals' rights are protected, aligned to the ICO's CCTV guidance and, for local authorities and police, the statutory Surveillance Camera Code. There's no ICO-approved template to download and sign — the regulator assesses whether the content is adequate, not whether the format matches a model.

At minimum, a policy should cover:

• Purpose and lawful basis — why cameras are installed and which UK GDPR condition justifies it
• Camera locations and coverage — a schedule of what's monitored, avoiding areas like toilets or changing rooms
• Data controller and responsible person — who owns the policy and handles requests
• Retention schedule — how long footage is kept and how it's deleted
• Access and disclosure rules — who can view footage, and conditions for sharing with police
• Signage requirements — how the public and staff are notified
• Subject access request (SAR) procedure — how individuals can request their own footage
• DPIA reference — for any high-risk processing such as ANPR or facial recognition
• Security measures — encryption, access logs, and storage location

Commercial precedents such as the LexisNexis workplace CCTV policy precedent and the Docue CCTV policy template are built around this same structure, adapted for private-sector use rather than the public-authority focus of the statutory Code.

For local authorities and policing bodies specifically, the Surveillance Camera Code of Practice: guide for local authorities sets out 12 guiding principles — covering necessity, proportionality, transparency and regular review — that make a useful checklist even for private operators wanting a defensible standard.

How long can CCTV footage legally be retained before deletion?

UK law sets no fixed minimum or maximum retention period for CCTV footage — the storage limitation principle in UK GDPR requires footage to be kept only as long as necessary for the stated purpose, then deleted. A retail unit investigating theft might justify 30 days; a site with a history of serious incidents might justify longer, provided that's documented.

A common practical default across the security industry is 28 to 31 days, long enough to catch most incident reporting delays without holding data indefinitely. But the ICO does not endorse any single figure — the burden is on the organisation to write down its retention period and be ready to explain why it chose it.

This is where Pulse Operations sees policies fail in practice. Retention gets set once, in a document nobody revisits, while the DVR quietly overwrites on a 7-day loop that nobody checked against the stated policy. A written retention schedule is only as good as the system enforcing it — which is why an auditable log of what was recorded, when, and when it was deleted matters as much as the policy text itself.

Who should manage and review the CCTV policy internally?

A named individual — typically a data protection lead, operations manager or, for larger organisations, a Data Protection Officer (DPO) — should own the CCTV policy, control access to footage and handle subject access requests. Accountability is one of the core UK GDPR principles: a policy with no named owner is one the ICO will treat as unmanaged.

That person's responsibilities typically include:

• Approving new camera locations and reviewing the DPIA
• Authorising and logging any footage shared with police or third parties
• Handling SARs within statutory timescales
• Reviewing the policy on a set schedule, not just when something goes wrong
• Maintaining the access log — who viewed which footage, and when

For security and FM operators running CCTV across multiple sites, this ownership question multiplies fast. A single security manager can't personally audit camera coverage, retention and access logs across 16 buildings on paper. This is precisely the estate-management problem Pulse Operations built its compliance runway around — a single expiries and evidence view across SIA licensing, BS 7858 screening, statutory building compliance and now, by extension, CCTV governance, rather than a policy document sitting in a folder nobody opens.

What signage requirements exist for CCTV monitoring?

CCTV signage must tell people they're being recorded, who's responsible, and why — before they enter the monitored area, not after. The ICO's guidance treats visible, legible signage as the primary transparency mechanism for public-facing CCTV, standing in for a privacy notice that most passers-by will never read in full.

Good signage practice includes:

• Positioning signs at the entrance to the monitored area, not just inside it
• Including the controller's name and a contact point for queries
• Making text large enough to read at a normal walking pace
• Covering car parks, entrances and any ANPR cameras separately, since number-plate capture is its own processing activity

Public-space CCTV illustrates the scale this can reach: Islington Council's control room monitors 155 public space cameras, including 21 4G HD cameras and 10 ANPR cameras, across the borough, according to Islington Council (2026). At that scale, signage, retention and access logging aren't a single document — they're an operating system, which is exactly why local authorities work to the statutory Surveillance Camera Code rather than a generic private-sector policy.

How should the policy address staff monitoring and workplace privacy?

Workplace CCTV monitoring must be proportionate, transparent to employees, and limited to a stated purpose — the same lawfulness test applied to public-facing cameras, but with a sharper privacy expectation because staff spend entire shifts inside the monitored area. The ICO has been clear that intrusive monitoring carries real reputational risk: research it commissioned found 70% of those surveyed would find monitoring in the workplace intrusive, per HFW's summary of the ICO's guidance on monitoring workers (2023).

The ICO's own messaging around that guidance framed the goal as "empowering" employees to "challenge intrusive practices," attributed to the Commissioner for Regulatory Policy at the Information Commissioner's Office. A policy silent on staff monitoring, or one that only mentions CCTV in the context of "security," misses this expectation entirely.

Covert monitoring of staff is the sharpest edge case. It's lawful only in narrow circumstances — genuine suspicion of serious wrongdoing, where overt monitoring would defeat the purpose, and normally only after senior sign-off and a documented DPIA. A policy should state plainly that covert monitoring is the exception, not a default option, and set out the approval chain required before it's ever switched on.

Pulse Operations's own compliance approach reflects this distinction operationally: patrol checkpoints are completed by a mandatory watermarked photograph — officer, site, GPS, time — captured as part of a documented duty, not ambient surveillance layered on top of a workplace. The mechanism proves the checkpoint happened; it isn't designed to track staff beyond that purpose, which is the same proportionality test a CCTV policy has to pass.

What steps are required to respond to a Subject Access Request for footage?

A Subject Access Request (SAR) — an individual's legal right under UK GDPR to see personal data held about them — extends to CCTV footage showing their identifiable image. Organisations must respond within one calendar month of receipt, extendable by a further two months for complex requests.

A workable SAR process for CCTV should include:

1. Logging the date the request was received, since the clock starts immediately
2. Locating the relevant footage using the time, date and location supplied
3. Assessing whether other identifiable individuals appear in frame
4. Redacting or blurring third parties before disclosure, or seeking their consent
5. Providing the footage in a usable format, or a written explanation if it can't be located
6. Recording the request and response for the organisation's own audit trail

The redaction step is where most CCTV SARs go wrong. Footage showing a queue of customers or a shared corridor almost always captures bystanders, and disclosing their images unredacted is itself a data protection failure. Systems that log exactly which camera, checkpoint or patrol point generated an image — with a timestamp and location baked in — make locating and redacting the right clip dramatically faster than scrubbing through unlabelled DVR footage.

Comparing free and paid CCTV policy templates

Free templates are a reasonable starting point but rarely reflect sector-specific risk — a construction site's CCTV needs differ sharply from a shopping centre's or a residential block's. Whichever template a business starts from, it needs adapting to the organisation's actual camera estate, retention practice and access controls, not adopted verbatim.

Your CCTV policy checklist

• Confirm the lawful basis for every camera under UK GDPR before recording starts
• Register with the ICO and pay the correct data protection fee tier
• Complete a DPIA for any high-risk processing, including ANPR or facial recognition
• Set a documented retention period and confirm the system actually enforces it
• Fit clear signage at every entrance to a monitored area, naming the controller
• Name a single owner responsible for the policy, access logs and SAR handling
• Address staff monitoring and covert exceptions explicitly, with a sign-off chain
• Review the policy against current ICO guidance at least once a year

FAQ

What should a UK CCTV policy include?

A UK CCTV policy should state the lawful basis for recording, camera locations, retention periods, the named responsible person, signage arrangements, and the process for handling subject access requests. It should also reference any DPIA carried out for higher-risk processing such as ANPR.

Do I need to register CCTV with the ICO?

Most businesses using CCTV for security or crime prevention must register and pay the ICO's annual data protection fee. The fee is tiered by organisation size — £52, £78 or £3,763 a year — according to Goodwille's guide to ICO registration (2026).

Is CCTV covered by GDPR in the UK?

Yes. CCTV footage showing identifiable individuals is personal data under UK GDPR and the Data Protection Act 2018, meaning the standard data protection principles — lawfulness, purpose limitation, storage limitation — all apply directly to camera footage.

How long can a business keep CCTV footage under UK law?

There is no fixed retention period set in law. Businesses must set their own retention period based on what's necessary for their stated purpose, and be able to justify that period if questioned by the ICO.

Do employees need to be told about workplace CCTV?

Yes, in almost all cases. Transparency is a core UK GDPR principle, and covert monitoring of staff is lawful only in narrow, serious circumstances with documented justification and senior approval.

Is covert CCTV monitoring legal in the workplace UK?

Covert monitoring is legal only where there's genuine suspicion of serious wrongdoing and overt monitoring would defeat the purpose of the investigation. It should be time-limited, approved at a senior level, and supported by a documented DPIA.

What is the ICO Surveillance Camera Code of Practice?

The Surveillance Camera Code of Practice is a statutory code, issued under the Protection of Freedoms Act 2012, that governs surveillance camera use by police and local authorities. The updated version was laid before Parliament on 16 November 2021 and took effect on 12 January 2022, per GOV.UK (2022).

Proving CCTV and patrol compliance with Pulse Operations

Writing the policy is one job; proving day-to-day that cameras, checkpoints and patrols actually happened the way the document says they should is another. Security and FM operators drafting a CCTV policy alongside SIA licensing, BS 7858 screening and Martyn's Law readiness need one place that shows what was recorded, when, and by whom — not a policy binder and a separate DVR nobody cross-checks.

Pulse Operations was built around exactly that evidence gap inside Priority First, the founding team's own London security and FM operation, where a prestige central-London estate spanning 16 buildings needed proof that every building received its patrols every night rather than one vague "round complete" message. Since going live on Pulse in March 2026, that estate has logged over 4,100 patrols with 100% of checkpoint completions photo-verified — evidence the client sees directly in its own portal rather than by ringing the office.

If your CCTV policy needs an evidence trail that matches it — patrol checkpoints, incident logs, and a compliance runway covering SIA, DBS and statutory building compliance in one system — get in touch with Pulse Operations to talk through your sites, or take a look at how the platform works end to end.

Related Reading

• Body Worn Camera Policy Template UK (2026 Guide)
• Security Guard Handover Template UK | Free Guide 2026
• Security Guard Timesheet Template UK (2026 Guide)

★ Add pulse-operations.co.uk as a preferred source on Google