Guide
How long is CCTV footage kept? What the law says, and what to set
Updated
The most repeated answer online is thirty days. There is no rule that says thirty days, and getting this right is both a compliance decision and a storage bill.
The actual position
The ICO's video surveillance guidance says it plainly: "The UK GDPR and the DPA 2018 do not prescribe any specific minimum or maximum retention periods which apply to surveillance systems or the information you may process. Rather, it is the purpose of your processing that should determine your necessary retention period" (ICO). So there is no legal minimum you are failing to meet, and no legal maximum you are breaching. There is a decision you have to make and be able to justify.
How to choose a period you can defend
- Write down why the system exists: shrinkage, vandalism, staff safety, insurance requirement, vehicle damage claims.
- Ask how long it typically takes for one of those incidents to come to light. Overnight damage is noticed the next morning; stock discrepancies may take a stock count.
- Set the retention period to the shortest that reliably covers that gap, and write down the reasoning.
- Check whether an insurer or a contract obliges you to hold footage for a set period, which is a separate requirement from data protection law.
- Have a process for putting a specific clip aside when an incident happens, so it survives the automatic deletion.
The ICO's own retention checklist asks whether you have decided on the shortest period you need based on your purposes, documented that in a retention policy that is readily available and understood by whoever operates the system, put secure permanent deletion in place, and check systematically that the period is actually being adhered to.
What retention costs you
Storage is days multiplied by cameras multiplied by resolution and frame rate. Going from fourteen days to thirty roughly doubles the disk, and on a large system that is a real number in the quote. The practical compromise most sites land on is a shorter continuous retention with a reliable way to export and keep specific incidents for as long as they are needed. That way the routine data disappears on schedule and the evidence you care about survives.
Keeping a clip after an incident
Exporting a clip because there has been an incident is a different piece of processing from routine recording, with its own justification and its own retention. Keep it in a controlled place, note why it was kept and who has access, and delete it when the matter is closed. Do not leave incident exports sitting on a manager's desktop indefinitely: that is where most CCTV data protection problems actually live.
Automatic deletion is a feature to check at purchase. Ask the installer to confirm the recorder overwrites on schedule and to show you the setting at handover.