How Long Should a Business Keep CCTV Footage in the UK?

Business CCTV Footage In The UK

A UK business should keep CCTV footage only for as long as it is genuinely needed for the reason it was recorded. There is no single UK law that says every business must keep footage for 30 days, although 30 days is a common and practical setting for many sites.

CCTV retention matters because recorded images can count as personal data when people can be identified. Your storage period should be reasonable, written down and easy to explain if the ICO, police, an insurer, an employee or a customer asks about it.

iSecurity Solutions is a trusted UK provider of commercial and domestic security systems, helping homes and businesses stay protected around the clock. From CCTV and intruder alarms to fire safety, access control and construction site monitoring, the team designs reliable, tailored solutions backed by responsive service and modern, remotely monitored technology.

Quick Answer For CCTV Retention In 2026

In 2026, UK businesses should set a CCTV retention period based on purpose, risk and day to day need. For many shops, offices, pubs, restaurants, warehouses and car parks, 14 to 30 days is a sensible starting point, but it is not automatically right for every business.

If you are unsure whether 30 days is enough for your site, look at how quickly incidents are usually noticed. A lower risk office where problems are spotted quickly may justify a shorter period, while a warehouse with delayed stock checks may need longer, as long as the reason is recorded. The key point is not how much storage your recorder has, because 'we had space left' is not a strong data protection reason.

Routine footage should normally be overwritten automatically once the chosen period ends. Footage linked to an incident, police request, insurance claim or legal dispute can usually be kept longer, but only for that specific reason and only while it remains necessary.

The Legal Framework For CCTV Retention In The UK

UK CCTV retention is mainly shaped by the UK GDPR and the Data Protection Act 2018. These rules treat CCTV footage as personal data when someone can be identified from the image, either directly or by using it with other information.

The important principle is called storage limitation. In plain English, it means you should not keep identifiable personal data for longer than you need it. Keeping footage forever 'just in case' may sound convenient, but it is hard to defend if there is no clear purpose.

The ICO does not set a fixed minimum or maximum CCTV retention period for all businesses. Its guidance says organisations should decide how long footage is needed, explain the decision in a CCTV policy and securely delete footage once it is no longer required. You can check the regulator's own wording in the ICO CCTV guidance.

Is 30 Days A Legal Requirement?

No, 30 days is not a legal CCTV retention rule in the UK. It is simply a common business setting because many incidents are reported within a few days or weeks, especially where weekends, holidays, shift work or delayed stock checks are involved.

Thirty days may be sensible if your premises has public access, valuable goods, late night activity, regular delivery disputes or a history of theft or damage. It may also help where managers only review incidents after customer complaints, insurer contact or police enquiries.

However, 30 days may be too long for a small, lower risk premises where staff notice problems quickly and footage is rarely needed. The safest approach is to write down why your chosen period is necessary, then review it regularly to check whether real incidents still support it.

How To Choose The Right CCTV Retention Period

Start With The Purpose

Start by asking why the CCTV is there. Common reasons include crime prevention, staff safety, premises security, health and safety investigations, access monitoring, vehicle control and evidence after an incident.

When the purpose is clear, the retention period becomes much easier to justify. For example, a camera watching a cash desk may need a different retention period from a camera covering a quiet staff entrance that is checked daily.

Think About How Quickly Incidents Are Found

Some incidents are obvious straight away, such as a break in, a fight or visible property damage. Others are noticed later, such as missing stock, a customer complaint, a delivery shortage or a vehicle damage dispute.

If your business usually finds issues only after weekly audits, weekend trading or monthly checks, that may support a longer routine period. If everything is checked daily and problems are picked up quickly, a shorter period may be enough.

Assess Your Risk Level

Your risk level should reflect real conditions, not worst case thinking. A busy public venue, cash handling area, pharmacy, warehouse, car park or construction site may face a higher risk than a small private office with controlled access.

Where CCTV is part of a wider security setup, the installation should also be suitable for the risk. Modern commercial CCTV systems can include secure recording, remote viewing, user permissions and automatic overwrite features that make retention easier to manage.

For CCTV system quality, recording performance and image usefulness, BS EN 62676 can be a helpful reference during design and installation. For monitored CCTV linked with intruder detection, EN 50131 may also be relevant to the wider alarm design, with Grade 2 or Grade 3 depending on risk. If police response is required, an SSAIB and Insurance Approved provider is normally needed before a Police Response URN can be obtained.

Typical CCTV Retention Periods By Business Type

The examples below are planning starting points, not legal requirements. Each business still needs to document its own purpose based assessment, because the same type of premises can have very different risk levels.

• Retail shops: 14 to 30 days is common where shoplifting, refunds, customer complaints or till disputes may be reported after the event.
• Hospitality venues: 14 to 30 days may be reasonable where late night trading, alcohol, busy weekends or licensing concerns increase incident risk.
• Offices: 7 to 30 days may be suitable depending on building access, shared space, visitor numbers and how quickly incidents are reported.
• Warehouses: 30 days or longer may be justified where stock loss, delivery disputes, shift patterns or delayed checks mean problems are not discovered quickly.
• Car parks: 14 to 30 days is often used for vehicle damage, payment disputes, trespass, theft and public access issues.
• Low risk small premises: A shorter period may be suitable if incidents are rare, quickly identified and not normally disputed.

Warehouses often need a little extra thought because camera coverage, blind spots and recording quality can affect how useful footage is when stock goes missing. For a practical example of sector specific planning, see CCTV for warehouses.

Keeping CCTV Footage Longer After An Incident

Routine footage and evidence footage should be treated differently. Routine footage is recorded during normal operation and automatically deleted or overwritten after the approved retention period, while evidence footage is kept because it relates to a specific event.

If the police ask for footage, preserve only the relevant time window and camera view where possible. Record who made the request, when it was received, what was shared and why it was necessary, because a simple audit trail can save a lot of confusion later.

For insurance claims, export the relevant footage before the recorder overwrites it. Add the claim reference, restrict access and set a review date so the footage is not left in a folder long after the matter has ended.

For legal disputes or internal investigations, use a clear hold process that pauses deletion only for relevant material. That does not mean copying every camera for months without a clear reason, because that can create more risk than it solves.

CCTV DSARs And The Right Of Access

A DSAR is a data subject access request. In everyday terms, it means someone can ask for a copy of personal data you hold about them, and that can include CCTV footage where they are identifiable.

If someone asks for CCTV footage, confirm their identity and ask for helpful details such as the date, time, location and what they were wearing. You should then check whether the footage still exists under your normal retention policy.

If the footage has already been securely deleted before the request was received, you cannot provide what no longer exists. That is one reason a documented retention policy is so useful, because it shows deletion happened as part of a normal process rather than a one off decision.

Where footage includes other people, you may need to blur or mask third parties before disclosure. If you decide not to provide footage because an exemption applies, record the reason clearly and respond within the required timeframe.

Can Someone Request Deletion Of CCTV Footage?

Yes, someone can ask for CCTV footage to be deleted, but the right to erasure is not absolute. It may apply where the footage is no longer necessary, was unlawfully processed, or there is no stronger reason to keep it.

You may still be able to retain footage if it is needed for an active police investigation, insurance claim, legal dispute, safeguarding concern or another lawful purpose. The sensible approach is to assess the request, record your decision and explain the outcome in plain language.

Secure Storage And Automatic Deletion

Good CCTV compliance is not only about choosing a number of days. You also need to control who can view footage, how it is stored, how exports are protected and how deletion happens when the retention period ends.

Use unique user accounts rather than shared passwords, and limit access to people who genuinely need it. Viewing screens should not be visible to visitors or unauthorised staff, especially in reception areas, shops or open offices.

Automatic overwrite is usually the simplest way to manage routine deletion. Even so, it should be tested from time to time, because a recorder with the wrong clock, a failed storage drive or a badly set schedule can quietly cause problems.

If you use cloud storage or remote viewing, check that access is secure and that accounts are removed when staff leave. Strong passwords, updates, role based permissions and logs all help reduce the risk of footage being misused or exposed.

CCTV Signage, Privacy Notices And ICO Registration

People should know they are being recorded before they enter the camera's field of view where possible. Signs should be visible, readable and clear about who operates the CCTV, why it is used and how people can contact the organisation.

A privacy notice on your website is helpful, but it does not replace physical signage at the premises. Staff should also know what to do if someone asks why CCTV is being used or wants to request footage.

Many businesses using CCTV need to register with the ICO and pay the data protection fee unless an exemption applies. It is worth checking your position directly, especially if your system records customers, staff, visitors or members of the public.

CCTV Retention Policy Template

A short written policy is often enough for a small business, as long as it is accurate and followed in practice. It should explain your CCTV use in clear terms so staff know what to do and managers can show that the system is being handled properly.

• Purpose: Explain why CCTV is used, such as crime prevention, safety or incident investigation.
• Lawful basis: Record the data protection reason for processing the footage.
• Camera locations: List the areas covered and avoid private areas unless there is a very strong reason.
• Routine retention period: State the normal number of days before automatic overwrite.
• Justification: Explain why that period is necessary for your business.
• Evidence preservation: Set out when footage may be exported or locked after an incident.
• Access permissions: Name the roles allowed to view, export or share footage.
• DSAR process: Explain how access requests are handled and who is responsible.
• Deletion method: Confirm how routine and preserved footage will be securely deleted.
• Review date: Set a regular review, especially after incidents, complaints or system changes.

Here is a simple example for a shop: 'CCTV is retained for 30 days because theft, refund disputes and customer complaints may be reported after the event. Footage is automatically overwritten unless it is needed for an incident, insurance claim or police request.'

You do not need to be a legal expert to get this right. You need a clear reason, a written policy and a CCTV system that follows the policy without turning the whole process into a paperwork marathon.

Final Thoughts And Compliance Checklist

The safest answer to CCTV retention is simple: keep footage for the shortest time that properly serves your documented purpose. For some businesses that may be 7 days, for others 30 days, and for a smaller number it may be longer where the risk and evidence need can be clearly justified.

Before choosing a retention period, check the basics. Document your purpose, choose a lawful basis, display signage, restrict access, enable automatic overwrite, preserve incident footage properly, prepare for DSARs, review your ICO registration position and revisit the policy at least once a year.

If you are installing or upgrading business CCTV, getting the recording setup right at the start is much easier than untangling unclear footage, vague permissions and unknown retention settings later. A good system should protect your premises and your compliance position at the same time.

If you would like a friendly second pair of eyes on your CCTV setup, retention settings or compliance position, iSecurity Solutions can help you review what is in place and make it easier to manage.