How Long Should You Keep CCTV Footage? UK Law, Insurance and Practical Advice

There is no single legally mandated retention period for CCTV footage in the UK. This surprises a lot of people, particularly those who have read that 'the law says 31 days' — a figure that appears widely online and is not quite right. What the law actually says is considerably more useful than a fixed number, once you understand the framework behind it.

What UK GDPR actually requires

CCTV footage is personal data under UK GDPR because individuals can be identified from it. That means it is subject to the same data protection principles as any other personal data your organisation processes. The relevant principle here is storage limitation: personal data should not be kept for longer than is necessary for the purpose for which it was collected.

The ICO's guidance on CCTV is clear on this point. It does not set a specific retention period — it requires you to set one yourself, based on your documented purpose for operating CCTV, and to be able to justify it. A retention period of 31 days is commonly used and is generally considered proportionate for most general security applications. But 31 days is a starting point for a risk assessment, not a legal requirement.

When 31 days is too long

For low-risk environments where CCTV is primarily there as a deterrent — a small retail unit, a car park, an office reception — 31 days may well be longer than necessary. If an incident occurs on site, it is usually identified within 24 to 72 hours. Footage that has not been flagged as relevant to an incident within a week is unlikely to ever be needed. Some ICO guidance suggests that 72 hours to seven days may be more proportionate for lower-risk settings.

Keeping footage for longer than is necessary is itself a data protection issue. If the ICO investigates a complaint about your CCTV and finds that you are retaining footage for 90 days when 30 days would have been adequate, that is a problem — even if the complaint was about something else entirely.

When 31 days is not long enough

There are settings where a longer retention period is clearly justified, and where the ICO would expect to see it. Schools are a good example. The nature of safeguarding investigations means that a concern may not surface until weeks after the relevant events. Allegations against staff, in particular, may be made some time after the incident in question. Many schools operate a 90-day retention period for this reason, and it is difficult to argue that this is disproportionate given the safeguarding context.

Premises with a known history of criminal activity, or a specific security risk that justifies longer retention, can similarly justify extended periods. Retail environments with ongoing shrinkage investigations, construction sites with equipment theft problems, and licensed premises with regular conflict incidents all have defensible reasons to retain footage beyond 31 days. The key word is defensible — you need to be able to articulate why the longer period is necessary.

What your insurer expects

Insurance is a separate consideration from data protection, and the two do not always point in the same direction. Some commercial insurers require policyholders to retain CCTV footage for a minimum period as a condition of their policy — typically 30 days, but sometimes longer. If a claim arises and you have already overwritten the relevant footage, your insurer may decline the claim or reduce the settlement.

Check your policy wording. If it specifies a retention period, that period becomes your minimum regardless of what data protection principles might otherwise suggest. In practice, most insurance requirements sit comfortably within a data-protection-compliant retention window — but it is worth confirming this rather than assuming.

What the police expect

Police will typically request footage within 24 to 48 hours of an incident being reported. In most cases, this is well within any reasonable retention window. Where police requests arrive later — in the context of an ongoing investigation, or when a crime is not reported immediately — the question of whether footage still exists becomes critical.

There is no legal obligation to retain footage indefinitely on the off-chance that the police might want it. But if you receive a request from the police and footage has already been deleted in line with your retention policy, you are not in legal difficulty provided your policy is documented and proportionate. If you deleted footage specifically to prevent police access, that is an entirely different matter.

Practical steps to get this right

Write a CCTV policy that states your retention period and the reason for it. This does not need to be a lengthy document — a page is sufficient — but it should be a real document that reflects your actual setup, not a template that someone downloaded and never amended. The ICO's self-assessment tool for CCTV is a useful starting point.

Configure your NVR or DVR to automatically overwrite footage after your retention period. Manual deletion is error-prone and creates the risk of footage being retained longer than intended — or not being deleted at all. Most modern NVR systems, including Synology Surveillance Station which we use on most of our commercial installations, allow automatic overwrite to be configured per camera and per schedule.

Display signage. UK GDPR requires that people in areas covered by CCTV are informed that cameras are in operation. Signage should be visible at the point of entry to a monitored area, legible, and should include the name of the data controller and a contact point for data subject access requests. This is a basic requirement that a surprising number of CCTV operators overlook.

Review the policy annually. If your use of the premises changes, if you add cameras to new areas, or if relevant ICO guidance is updated, your retention policy should be revisited. A policy written in 2019 for a site that has since been significantly reconfigured is not a policy — it is a piece of paper that will not protect you when you need it to.