How long can a business keep CCTV footage?

This is general guidance, not legal advice. The ICO says its CCTV guidance is under review following the Data (Use and Access) Act 2025, so check the ICO’s current guidance before relying on any detail.

There is no fixed legal period for keeping CCTV footage in the UK. UK GDPR and the Data Protection Act 2018 don’t set a minimum or a maximum. What they require is that you keep footage only as long as your purpose needs, and that you can explain the period you chose.

This guide covers how to set that period, when keeping clips longer is justified, and how to make sure the system actually deletes on time. For the wider picture (lawful basis, DPIAs, signs and access requests), see our guide to CCTV and GDPR for businesses.

What the ICO says

The Information Commissioner’s Office guidance on video surveillance makes five points about retention:

• Your purpose sets the period. The law doesn’t name a number, so the reason you run the cameras decides how long footage is useful.
• Use the shortest period that works. Footage kept longer than needed is, in the ICO’s words, unnecessary by definition, and you’re unlikely to have a lawful basis for holding it.
• Capacity and defaults aren’t reasons. “The recorder holds 60 days” or “that’s how it came” don’t justify a period. Nor does keeping footage just in case it’s useful one day.
• Delete it securely. Once footage is no longer needed, it should be permanently deleted.
• Write it down and check it. Record the retention period in a policy that operators understand, and check from time to time that the system sticks to it.

Choosing a period you can defend

Work back from what the footage is for. The question is how long it takes for an incident to come to light and be reviewed, and that varies by site.

Many businesses settle on around 30 days. It covers a month-end, most holidays and a normal review cycle, and it’s easy to explain. A shop or office that checks footage daily might choose less. A school that closes for six weeks in summer, or a yard only visited weekly, might need longer and should say why in its policy.

Whatever you choose, size the storage to the period, not the period to the storage. If the recorder can only hold 10 days at the quality you need, that’s a storage problem to fix, not a retention policy.

When to keep footage longer

Keep specific footage longer only when there’s a specific reason, and only the footage that’s relevant.

• A police request. If the police ask you to preserve footage for an investigation, export and keep it until they no longer need it. You can usually share footage to help prevent or detect crime.
• An insurance claim or legal dispute. Keep the clips that relate to it until the matter is closed.
• A subject access request. If someone asks for footage of themselves, keep it until you’ve responded. Deleting or altering data to stop it being disclosed after a request has arrived is a criminal offence.
• An internal investigation. Where footage is relevant to a disciplinary or safety investigation, keep the clip for the life of that process.

In every case, export the clip, log what you kept, why and for how long, and let the rest of the recording overwrite on its normal cycle. Where footage may be used as evidence, keep an audit trail of who handled it.

Making the recorder stick to it

A retention policy is only as good as the system’s settings. Most network video recorders (NVRs) and video management software can do this automatically, but they have to be set up.

1. Set the overwrite period. Configure the recorder to overwrite footage older than your chosen period, rather than leaving it to fill the drives and loop.
2. Check the storage covers it. Recording quality, frame rate, the number of cameras and motion-only recording all change how many days the drives hold. Check the real figure after installation.
3. Handle exports separately. Clips you export to a USB stick, a laptop or a cloud folder fall outside the recorder’s overwrite cycle. Keep them in one place and delete them when their purpose ends.
4. Limit who can export and delete. Use individual user accounts, so you can see who did what.
5. Check it periodically. Look at the oldest footage on the system every few months. It should match the policy.

When we install or upgrade a commercial CCTV system, you set the retention period against your own policy, and we size the storage for it. A maintenance contract keeps the system checked over time.

What to write in your policy

Your CCTV policy, or the retention section of your DPIA, should state:

• the purpose of the system
• the retention period, and why it’s that long
• who can view, export and delete footage
• how exported clips are logged, stored and deleted
• how often you check that the system keeps to the period

If you also run ANPR, give number plate data its own period, since its purpose may differ from general CCTV.

Not sure your recorder is overwriting when it should? We can inspect an existing system, or design a new one around your retention period. Talk to us about CCTV.