GDPR compliance for CCTV operators is the set of legal obligations that any organisation operating video surveillance in the UK or EU must meet to lawfully capture, process, and store footage of identifiable individuals. It covers lawful basis, transparency, retention limits, data subject rights, impact assessments, and data processor agreements. Getting it right is not optional — fines for non-compliance can reach €20 million or 4% of global annual turnover.
This page provides general guidance for informational purposes only. It is not legal advice. GDPR obligations vary by organisation type, location, and use case. Always consult your Data Protection Officer or legal counsel for advice specific to your situation.
Every organisation operating CCTV must identify a lawful basis under GDPR for processing personal data through surveillance. Most organisations rely on "legitimate interests" (Article 6(1)(f)) — the argument that surveillance is necessary for the security of people, property, or assets. This requires a documented Legitimate Interests Assessment (LIA) that explains why surveillance is necessary, what alternatives were considered, and how the organisation balances its interests against the privacy rights of individuals captured on camera.
GDPR requires that individuals are informed that CCTV is in operation before they enter a surveilled area. Visible signs must state: that CCTV is in operation, the identity of the data controller (who operates it), the purpose of the surveillance, and contact details for making inquiries. The UK Information Commissioner's Office (ICO) provides a template for compliant CCTV signage.
Footage must not be kept longer than necessary for the purpose for which it was collected. This is the data minimisation principle in practice. Most Data Protection Officers recommend 30 to 31 days as a defensible default for standard commercial CCTV. Longer retention — 60, 90, or 365 days — is permissible if the organisation can document a legitimate reason (e.g. sector regulation, high-risk environment, or ongoing investigation).
Individuals have the right to request a copy of any footage in which they appear — a Subject Access Request (SAR). Organisations must respond within one calendar month. If the footage includes third parties, their faces and identifying features must be redacted before the footage is shared. Organisations should have a documented SAR process before an incident occurs, not after.
A DPIA is required when deploying surveillance technology that is likely to result in a high risk to individuals' rights. AI video analytics — particularly systems that analyse behaviour, detect individuals, or monitor at scale — almost always trigger the DPIA requirement. The DPIA must identify risks, assess their severity, and document the measures taken to mitigate them.
If any third party processes footage on the organisation's behalf — a cloud analytics platform, a managed security service provider, or a cloud storage provider — a Data Processing Agreement (DPA) must be in place. The DPA defines what the processor can and cannot do with the data, the security measures they must apply, and the obligations for data breach notification.
AI video analytics introduces additional GDPR complexity beyond standard CCTV. Three areas require particular attention.
Biometric data: If the analytics system uses facial recognition, gait analysis, or any technique that processes biometric characteristics, the resulting data may qualify as special category data under GDPR Article 9. Processing special category data requires explicit consent or another specific lawful basis — legitimate interests alone is insufficient.
Automated decision-making: If AI-generated alerts automatically trigger access control decisions — for example, locking a door when a detected person is not recognised — this may engage Article 22 rights, which give individuals the right not to be subject to decisions made solely by automated processing that significantly affect them.
DPIA requirements: AI video analytics at any meaningful scale almost certainly requires a Data Protection Impact Assessment. The more the system analyses behaviour, classifies individuals, or operates in public spaces, the stronger the requirement.
UK GDPR — the retained version of the EU regulation — is largely equivalent to EU GDPR in substance. The UK Information Commissioner's Office (ICO) is the UK supervisory authority, while EU member states have their own Data Protection Authorities. Organisations operating in both the UK and EU must comply with both frameworks. In practice, a deployment that meets EU GDPR requirements will also meet UK GDPR requirements.
SafetyScope supports GDPR-compliant deployments through configurable retention policies, comprehensive audit logs that track all access to footage and metadata, and Data Processing Agreement availability for cloud-processed footage. The platform's retention controls enforce automatic deletion at the configured period, and retention hold functionality allows footage to be preserved for specific investigations without extending the default retention policy across all cameras.
Published: 2026-02-25 · Updated: 2026-04-02