Legal Responsibilities for Reviewing and Managing CCTV Footage for Schools

With an estimated 4 to 6 million CCTV cameras in the UK, surveillance systems have become a key part of site security—and schools are no exception.

Key Legal Principles for Schools Using CCTV

Under data protection law, the following principles apply:

1. Transparency

• Pupils, parents, staff, and visitors must be informed that CCTV is in operation;

• Clear signage should be displayed around the site, including at entry points;

• Staff must be notified when cameras are live, and how recordings may be used; and

• Any individual captured on camera has the right to request access to footage that identifies them and, in some cases, can ask for it to be deleted.

2. Respect for Privacy

• CCTV should never intrude into private areas, such as toilets or changing rooms;

• Cameras must not record private conversations, unless in exceptional and justified circumstances; and

• If neighbouring properties or public areas could be recorded, this must be avoided where possible. Otherwise, inform those affected—typically by signage and positioning.

3. Security of Data

• A nominated individual, such as the school business manager, IT lead, or headteacher, must be responsible for managing the CCTV system and data. This person is your Data Controller, and must be registered with the ICO; and

• All footage must be:

  • Securely stored

  • Accessed only by authorised staff

  • Only shared externally (e.g. with police) when there is a lawful reason to do so

From deterring vandalism and bullying to safeguarding pupils and staff, CCTV systems in education settings can provide peace of mind and vital footage when incidents occur. Cameras may also be used to monitor site access and ensure compliance with safeguarding and health and safety policies.

However, schools must operate their CCTV systems in accordance with two key pieces of legislation:

• The Data Protection Act (DPA); and

• The UK General Data Protection Regulation (UK GDPR.)

These laws exist to protect the privacy of individuals, including pupils, staff, parents, and visitors, and to ensure any personal data collected (such as video footage) is handled securely, transparently, and legally.

This guide outlines your key obligations. While every effort has been made to reflect current guidance, schools should check for updates from the Information Commissioner’s Office (ICO) or seek legal advice for specific cases.

You Must Have a Clear and Lawful Purpose

Before installing CCTV, schools must have a specific and legitimate reason for doing so—security and safeguarding are the most common justifications.

However, you must:

• Clearly document how CCTV supports this purpose;

• Show that it is necessary and proportionate; and

• Regularly review your justification for continuing to use CCTV.

For example, if cameras are installed to prevent unauthorised access or protect against anti-social behaviour, your policy should reflect how footage is used for that purpose and why other measures would not be sufficient.

How Long Can Schools Keep CCTV Footage?

Retention periods must reflect the purpose of the footage:

• Standard retention: Up to 30 or 31 days;

• Extended retention: If footage relates to an incident under investigation or needed for the police, it can be kept longer (e.g. up to 14 additional days or until the case is resolved)

• Maximum retention: Schools should not keep footage; and longer than 6 months, unless legally necessary

Your CCTV policy should clearly outline:

• The standard retention period;

• The reasons for any extension; and

• Who is responsible for monitoring, reviewing, and deleting stored footage.

The Data Controller must also ensure that footage is not uploaded to public platforms, and that access is strictly controlled to prevent data breaches

To learn more about Data Protection, consult the Handsam Quick Guides by using the Topic Tag DATA PROTECTION. Handsam also offers a range of Data Protection policies, and you can reach out to us at 03332 07037 or email info@handsam.co.uk for further details or pricing.