Short answer: Choose the shortest retention period that reasonably meets the documented purpose of your CCTV, and check that the system actually follows it. A recorder’s default setting, its storage capacity or an assumed 30-day rule is not a complete justification.
Retention is both an operational and an information-management decision. A facilities team needs enough time to identify and deal with a relevant event, while avoiding routine storage that has no continuing purpose.
Start with the purpose and the discovery process
Write down why each part of the system records. Protecting a loading area, investigating reported damage and managing a different security concern may involve different practical needs. Avoid a vague justification that all footage might eventually be useful.
Ask how an incident is normally brought to the responsible manager’s attention. Include the organisation’s working pattern and reporting process, but do not use slow internal administration as an excuse for indefinite storage. Improving reporting may be more appropriate than keeping more footage.
The ICO’s surveillance guidance on data-protection principles says there is no universal minimum or maximum retention period. The purpose should determine the period, rather than the system’s capacity.
Check what is stored beyond the recorder
An automatic overwrite setting may cover only the main recorder. Ask about cloud copies, downloaded clips, removable media, backups and files held by a monitoring or maintenance supplier. A retention policy that ignores exports is incomplete.
Create a simple inventory of the locations where recordings may be held, who controls them and how deletion is managed. You do not need to circulate technical access details to achieve this; keep the inventory in the responsible team’s restricted records.
- What is the routine retention period and its justification?
- Who may preserve a recording for a specific matter?
- Where can exported or backed-up copies exist?
- Who checks deletion and records any exception?
- What event triggers the next review?
Keep an incident hold separate from routine retention
A specific investigation or request may require relevant material to be preserved beyond the normal period. Identify the necessary cameras and time range, record the reason and approval, restrict access and give the retained material a review point.
Preserving one relevant clip should not silently change the policy for every recording. Equally, routine deletion should not proceed unchecked once the responsible team has identified material that needs a properly authorised hold.
For the separate decision about releasing footage, use our commercial CCTV footage-request checklist. Keeping a recording and sharing it are different decisions.
Test deletion rather than assuming it
Ask an authorised operator or maintainer to check the actual settings and demonstrate the expected behaviour using a controlled test. Confirm the effect of recording modes, storage changes and any cloud service. Record the result without putting footage or administrator credentials in an unrestricted report.
A longer storage upgrade should prompt a policy check. More available space does not itself mean the organisation needs to retain recordings for longer. If the equipment cannot implement the intended policy, identify the gap and agree a suitable remedy.
Review the period when circumstances change
Revisit the decision when premises use changes, cameras are added, a supplier changes or the system gains new features. Check that privacy information describes the current arrangement and that staff know how to raise a preservation request promptly.
The ICO notes that parts of its guidance are under review following the Data (Use and Access) Act. Use the current guidance when making an individual compliance decision, and obtain advice where the purpose or obligations are unclear.
To discuss CCTV within a commercial security plan, see ZimCos Security’s services and enquire with the site location and scope. This is general guidance, not approval of a specific retention period.
Featured image: an illustrative wall-mounted CCTV camera.