CCTV footage is personal data under UK GDPR. For Somerset businesses operating surveillance systems, this means specific legal obligations apply to how footage is captured, stored, accessed, and deleted. Non-compliance can result in enforcement action from the Information Commissioner's Office (ICO).
Key GDPR Requirements for CCTV
Lawful Basis
You must have a lawful basis for processing CCTV footage. For most commercial premises, this is "legitimate interests" — the need to prevent crime, protect staff, or safeguard property. This must be documented in a Data Protection Impact Assessment (DPIA).
Signage
Clear and prominent signage must be displayed at all entry points to areas covered by CCTV. Signs must include the purpose of recording, the identity of the data controller, and contact details for access requests.
Data Retention
Footage should only be retained for as long as necessary. Most businesses retain footage for 30 days, though some sectors may require longer retention. A documented retention policy must be in place.
Subject Access Requests
Individuals have the right to request copies of CCTV footage that includes their image. You must respond within one calendar month and take care to redact or exclude images of other individuals.
Common Compliance Gaps
- No DPIA conducted before installing CCTV
- Missing or inadequate signage
- No documented retention policy
- Footage shared informally without proper authorisation
- System access not restricted to authorised personnel
Getting Compliant
We can advise Somerset businesses on CCTV compliance, including signage requirements, retention policies, and system configuration to support GDPR obligations.
Talk to a Local Engineer
If you would like honest advice, a clear written quote, or help with compliance paperwork,get in touch with our team. We are a small, experienced South West team, and we look after every customer properly — no pushy sales, no hidden extras, and documentation you can rely on.
