SIA CCTV Data Protection (UK GDPR) 1 — Questions and Answers
Question 1: Under UK GDPR, CCTV footage of identifiable individuals is classified as what?
- Public information
- Personal data (Correct answer)
- Sensitive data only if audio is recorded
- Non-regulated information
Correct answer: Personal data
CCTV footage that shows identifiable individuals constitutes personal data under UK GDPR, as it relates to identified or identifiable living persons.
Question 2: What is the 'lawful basis' most commonly used by CCTV operators for processing personal data?
- Consent
- Legitimate interests (Correct answer)
- Legal obligation
- Vital interests
Correct answer: Legitimate interests
Most CCTV systems rely on 'legitimate interests' as their lawful basis — for example, the prevention and detection of crime or the protection of property.
Question 3: Under UK GDPR, who is the 'data controller' in relation to a CCTV system?
- The person who monitors the screens
- The organisation that determines the purposes and means of processing the footage (Correct answer)
- The company that installed the cameras
- The police
Correct answer: The organisation that determines the purposes and means of processing the footage
The data controller is the organisation or person who decides why and how personal data is processed. For CCTV, this is typically the organisation that decided to install and operate the system.
Question 4: What is the recommended maximum retention period for CCTV footage according to ICO guidance?
- 7 days
- 30 days
- There is no set period — it should be no longer than necessary (Correct answer)
- 1 year
Correct answer: There is no set period — it should be no longer than necessary
The ICO does not specify a fixed retention period. Instead, footage should be retained for no longer than is necessary for the purpose for which it was recorded. Typically 30 days is common, but it depends on the specific purpose.
Question 5: What must happen to CCTV footage once the retention period has expired?
- It must be archived permanently
- It must be securely deleted or overwritten (Correct answer)
- It must be sent to the police
- It can be kept indefinitely as a backup
Correct answer: It must be securely deleted or overwritten
Once the retention period has expired and the footage is no longer needed for its stated purpose, it must be securely deleted or overwritten to comply with data protection principles.
Question 6: Who has the right to request that their CCTV footage be erased under UK GDPR?
- Only the police
- Any data subject, though exemptions may apply (Correct answer)
- Only employees of the organisation
- Nobody — CCTV footage cannot be erased
Correct answer: Any data subject, though exemptions may apply
Under UK GDPR, data subjects have the 'right to erasure' (right to be forgotten). However, exemptions exist — for example, if the footage is needed for crime prevention or legal proceedings.
SIA CCTV Data Protection (UK GDPR) 1
Under UK GDPR, CCTV footage of identifiable individuals is classified as what?