CCTV retention, evidence and police requests

An officer rings on a Tuesday afternoon. There was an assault outside a unit on the estate on Saturday night, they think around half eleven, and they would like the footage.

What happens in the next twenty minutes decides whether that recording is any use. Most of it was decided long before the call, by how the scheme was set up.

What this is, and is not. General information about how evidence handling works for district camera schemes. It is not legal advice. It describes the law of England and Wales — Scotland and Northern Ireland differ on police powers, witness statements and disclosure, and the Surveillance Camera Code does not apply in either.

How long should CCTV be kept?

There is no legally required retention period for CCTV or ANPR in the UK. The rule is that you keep footage for the shortest period that serves the purpose you recorded it for, and write down your reasoning. In practice most district and town-centre schemes land between 28 and 31 days, because that is roughly how long police need to identify and collect footage — but that is an operational convention, not a legal minimum, and it is not an ICO rule.

The rest of this page is what follows from that: what to do when the police ask, what makes footage usable, why it so often is not, and who controls it on a site with many occupiers.

What actually makes the disclosure lawful

Start here, because a lot of published guidance gets it backwards, including a good deal written by camera companies.

You will often be told that Schedule 2, paragraph 2 of the Data Protection Act 2018 is what lets you hand footage to the police. It is not. That paragraph is an exemption, and what it exempts you from is the duty to tell the person in the footage that you disclosed it, and to answer their subject access request about it — and then only "to the extent that" complying would prejudice the investigation. The ICO is explicit that it is not a blanket exemption: if you can comply without causing prejudice, you must.

Three separate questions are being run together. Kept apart, they are simple:

On that Schedule 1 paragraph 10 condition, three things have to hold together: the processing is necessary for preventing, investigating or detecting an unlawful act; it must be done without the person's consent so as not to prejudice that purpose; and it is necessary for reasons of substantial public interest. There is a useful carve-out — where the disclosure is to a competent authority such as the police, you do not need to have written an appropriate policy document first. Retaining and analysing that footage yourself is a different matter, and there the policy document requirement does apply.

Disclosure is your decision, not the officer's. The ICO:

"As the operator of the surveillance system, any decisions about disclosure are your responsibility. You have discretion to refuse any request unless there is an overriding legal obligation. For example, a court order."

The Surveillance Camera Code of Practice says the same. But the ICO's clear default is that you should disclose where your scheme exists to prevent and detect crime, and it warns that failing to do so "could prejudice an ongoing investigation." Discretion is not an invitation to be difficult. It exists so the decision is recorded, considered, and made by someone with authority to make it.

What to require before you release anything

Get the request in writing, on the force's own form. The instrument is usually called a Schedule 2 Para 2 request form — the successor to the old "section 29(3) form" under the 1998 Act. There is no single national template; forces and councils publish their own, and they are broadly consistent.

A properly completed request gives you:

• The force, and the named officer with rank and collar number, plus force contact details
• The occurrence or incident number and the nature of the offence
• Which purpose is relied on — prevention and detection of crime, or apprehension and prosecution of offenders — and why disclosure is necessary
• A bounded request: specific cameras, a specific date, a time to within an hour

That last one protects you as much as it helps them. "Everything from Saturday" is not a proportionate request and not one you should fulfil. The published forms have a camera-number field and a one-hour time field precisely because a bounded request is the defensible one.

Officers sign declarations that they are authorised to make the request and that the footage will only be used for the stated purpose. That declaration is part of what makes your disclosure reasonable.

Why this must not be left to whoever is in the room

Section 170 of the Data Protection Act 2018 makes it an offence to disclose personal data knowingly or recklessly without the consent of the controller. The controller is the organisation, not the person at the desk. A member of control-room staff who hands over footage without authority is personally exposed. There is a defence for crime prevention, but it has to be argued.

The practical answer is a written disclosure policy naming who may authorise a release, so nobody has to make that judgement alone at four o'clock on a Tuesday.

If you say no

Two different routes exist and which one applies depends on the material.

• Where the footage is ordinary material, the police can apply to a magistrate for a search warrant under section 8 of the Police and Criminal Evidence Act 1984.
• Where it is excluded or special procedure material — broadly, material held in confidence or under a statutory restriction — section 8 does not apply, and the route is a production order under section 9 and Schedule 1, which is made by a circuit judge.

Whether estate CCTV falls into the second category is fact-specific and often arguable. A production order normally requires production within seven days. The practical point for an operator is that refusing does not end the matter, and that the decision to refuse should be recorded with reasons.

It is not only the police who can compel you

Operators are caught out by this more often than they expect. Footage can also be compelled by:

• Civil disclosure — pre-action or non-party disclosure under the Civil Procedure Rules, commonly where there has been an accident on the estate
• A Norwich Pharmacal order, where someone needs to identify a wrongdoer
• A witness summons in criminal proceedings
• A coroner's notice requiring evidence for an inquest

Each has its own process, and none of them is a reason to hand footage over on a phone call. Ask for the order.

What to write down

Every disclosure, recorded: the date, who received it — the person's name and the organisation they represent — and why they needed it. That record is the ICO's expectation, and it is the thing that answers a complaint eighteen months later.

What makes footage usable

This is where district schemes lose cases they did not know they were in.

The master copy

UK police procedure is built around one idea: there is a definitive copy of the data, documented, sealed and stored, which a court can examine to confirm the evidence is authentic. The Home Office's Digital Imaging and Multimedia Procedure sets out what that master must be — labelled, preserved in a form that can still be viewed in future, stored so it cannot be altered or accidentally erased, kept under exhibit protocol, and:

"not used, except to make further copies… or by order of the court to verify authenticity."

You work from a working copy. You do not work from the master.

There is a trap in modern systems worth knowing about, because it is invisible:

"Where a DEM or DAM system compresses or transcodes files on ingest, this would preclude its use for Master storage."

Some evidence-management systems quietly re-encode everything that arrives. If yours does, it cannot hold your master.

And the point that matters most for a private operator. The same procedure says that for third-party images, "the audit trail should begin at, and detail, the point of transfer." Your records are that audit trail. Without them, continuity begins in the officer's hand and everything before it is a gap for the defence to point at.

Export in the native format — and export the player with it

Here is where most camera-company advice is precisely wrong. It is common to read that you should avoid proprietary formats and export to something standard. UK police guidance says the opposite. The College of Policing:

"Every effort should be made to obtain the footage in proprietary or native format, rather than more standardised or familiar file formats that may be available. These are usually conversions of the original proprietary format and can result in loss in quality or information during the conversion process. Conversion also reduces the opportunity for further forensic analysis if needed."

The Home Office's UK police requirements for CCTV systems puts it as a flat requirement: "Video should be exported in the native file format at the same quality as stored on the system."

So what is the actual problem with proprietary formats? The missing player. Home Office retrieval guidance:

"Is the data format proprietary? If so, it is necessary to retrieve a copy of the correct version of replay software alongside the data. Some CCTV systems provide this facility, but others do not… It should be established that the facility exists to replay the data before leaving the scene."

The police's own national risk register lists "replay software is not downloaded from the system alongside evidence" with the consequence stated as "evidence lost". Native format without a player is the worst of both worlds.

Four things to require of any system you buy, all from the Home Office checklist: export in native format at the stored quality; the export includes whatever software is needed to replay it; the export can be replayed with no loss of quality; and an operator can protect identified footage from being overwritten.

The clock

Four separate official sources treat a wrong time stamp as a known evidential failure. The College of Policing requires:

"Compare the time displayed by the CCTV system with that given by a reliable and accurate time source. Any discrepancy should be recorded in the audit record and supporting statement."

The reason it matters more than it sounds: section 129 of the Criminal Justice Act 2003 preserves the common-law presumption that a mechanical device was properly set and working. That presumption is rebuttable, and a demonstrated clock error is how it gets rebutted — which can undermine every recording from that system, not just the clip in question. Check it, record the check, and pay attention when the clocks change.

The witness statement

Footage does not walk into court by itself. Someone produces it as an exhibit, in a written statement under section 9 of the Criminal Justice Act 1967, containing the declaration that it is true to the best of their knowledge and that they know they are liable to prosecution if they wilfully state anything false.

There is a free, standardised template for exactly this. The National Business Crime Centre, working with the CPS and police forces, publishes a standardised video witness statement for businesses submitting CCTV. It carries the section 9 declaration and prompts for the things that otherwise get missed: which system the footage came from, the exact date and time range, how many cameras exist and how many are working, the system's overwrite period in days, a comparison of the system clock against an independent time source on a stated date, and a statement that the witness has not edited the footage and does not believe anyone else has.

The exhibit reference is the witness's initials plus a sequential number. Which means the person making the statement is a named individual — your control-room operator — not "the BID". Someone has to be able and willing to do it, and they should know that in advance.

Why CCTV evidence fails

There is a well-worn claim that 80% of CCTV footage given to police is useless. It is worth knowing where it came from, because it does not say that.

The source is the Home Office and ACPO National CCTV Strategy of October 2007, which says "anecdotal evidence suggests that over 80% of the CCTV footage supplied to the police is far from ideal." Three things about that sentence: the government called it anecdotal in the sentence itself; the words are "far from ideal", not worthless; and it is now nineteen years old. The punchier version, and a widely repeated "only 3% of crimes solved by CCTV", trace to newspaper coverage in May 2008 of a Metropolitan Police report that has never been published.

The real numbers are better and more interesting. The largest study is Ashby (2017), peer-reviewed and open access, covering 251,195 crimes recorded by British Transport Police between 2011 and 2015. The percentages below are of the 246,427 of those for which the study had data on whether CCTV proved useful.

Source: Ashby, M.P.J. (2017), The Value of CCTV Surveillance Cameras as an Investigative Tool: An Empirical Analysis, European Journal on Criminal Policy and Research 23(3), 441–459.

Read the top of that table, not the bottom. Image quality is the failure everyone worries about, and it accounts for 4.9% of all recorded crimes — around one in nine of the cases where footage existed at all. The two big losses are cameras not covering where the incident happened and footage nobody ever asked for. Both are scheme-design and scheme-promotion problems rather than camera problems, and neither costs money to fix.

One caveat the author states plainly, and so will we: the railway has near-saturation camera coverage, so these are best-case figures rather than a street-level norm.

The line that should worry a district manager most

The police's own national framework for video evidence carries a risk register. One entry:

"Owner of system carries out their own download and provides it to police" — consequence: "Any number of the above risks can occur, and the police will not know."

That is the police saying, in a national document, that footage supplied by a private operator is essentially unverifiable. It is the strongest argument there is for a scheme with trained operators, a documented retrieval process and a real audit trail — and against a system anyone can pull a clip off with a USB stick.

Setting your retention period

Two pressures point in opposite directions, and both are legitimate.

The ICO wants it deleted. There is no statutory period:

"The UK GDPR and the DPA 2018 do not prescribe any specific minimum or maximum retention periods which apply to surveillance systems… your retention period should be the shortest period for that purpose."

And pointedly:

"You should also not determine your retention period simply by the storage capacity of any surveillance system, or just in case you think the data may be useful in the future."

The police want it kept. The National CCTV Strategy records that 28 to 31 days was long accepted, that some operators moved to periods as short as 14 days, and that this "resulted in significant resource implications for police, as they struggle to collect the digital CCTV before the footage is overwritten." Ashby's data puts a number on it: 2.9% of all recorded crimes lost their footage to overwriting.

Two things you will be told are rules, and are not.

The ICO has never published a 31-day requirement. The phrase appears nowhere in its video surveillance guidance or its DPIA guidance. Where the number actually comes from is the Home Office — the 2007 strategy above discusses a 28-to-31-day norm, and the Home Office's UK police requirements for CCTV systems says only that "retention beyond 31 days may be useful in some circumstances." Note what that is: a permissive statement from the police about a floor they would like, not a ceiling imposed by the regulator.

And the 12-month ANPR retention figure belongs to the police national standard, which states in terms that it "does not cover the use of Automatic Number Plate Recognition for any purpose that is not law enforcement."

So how do you decide? Work from your purpose, not from your disk. Around a month is where most district schemes reasonably land, given how long it takes for an incident to be reported and a request to reach you — but land there because you reasoned it and wrote the reasoning down, and pair it with a mechanism to ring-fence specific footage the moment somebody asks.

For ANPR there is a design point worth taking seriously: the case for keeping reads of vehicles of interest is much stronger than for keeping every read of every vehicle that passed. Tiered retention is easier to defend and cheaper to store. We work through that, and the rest of the data protection position, in the DPIA guide for district CCTV and ANPR.

Who controls the footage when the site has many occupiers

This is the hardest genuine question in place-wide CCTV, and we should say at the outset: there is no published ICO, Home Office or College of Policing guidance addressing BID or multi-tenant estate schemes specifically. What follows applies the general controller test. Anything unusual about your scheme is a question for your own adviser.

Funding is not control

The controller is whoever "decides what is to be recorded, how it should be used and to whom it may be disclosed". So if the BID or estate company sets the purpose, the camera positions, the retention period and the disclosure policy, the BID is the controller — even though member businesses pay the levy that bought the cameras.

Joint controllership arises where decisions are genuinely shared: a members' committee that sets camera positions and approves disclosures, or a scheme run jointly with the council. Where it does, Article 26 of the UK GDPR requires a documented arrangement, and every joint controller stays liable regardless of what the arrangement says.

A monitoring contractor running the control room to your instructions is a processor, and needs a written contract under Article 28.

And note that once you disclose to the police, they hold it under Part 3 of the Data Protection Act 2018 — the law enforcement regime — while you remain under the UK GDPR. Different rules apply to their copy than to yours.

Can you give footage straight to the member business that was the victim?

There is no prohibition. But this is a third-party disclosure, and none of the law-enforcement gateways apply to it — a shop is not a competent authority. The ICO:

"you should approach any other requests for information with care, as wider disclosure may be unfair on the individuals concerned"

There is also a European Court of Human Rights case directly on this. In Peck v United Kingdom (2003), a council disclosed CCTV of a man in a distressed state and it was published widely. The Court found a violation of his right to private life. The lesson is not that disclosure is unlawful — it is that an operator who releases footage without thinking about what happens to it afterwards carries the consequences.

Five things that go wrong:

1. You lose control at handover. Once you disclose, the recipient becomes the controller of their copy. If it ends up in a shopwatch group chat or on social media, that is their breach — but it is your footage, your signage, your disclosure decision and your standing in the district.
2. Other people are in the frame. Passers-by, other tenants' staff, customers. Redaction may be needed, and most district control rooms have no way to do it.
3. Purpose mismatch. If your published purpose is preventing and detecting crime in the district, releasing footage for a civil claim, an insurance dispute, a tenancy argument or a staff disciplinary sits outside it — and your signage never told anyone it would be used that way.
4. The chain gets muddier. If the member later reports it to police, the police are receiving the footage third-hand.
5. Your staff are personally exposed under section 170 if they release it without authority.

What defensible practice looks like: where a crime is alleged, route the member to the police and let the disclosure happen through the proper route. Where you do disclose direct, have a written policy, record the decision and who made it, check the purpose is one your privacy notice covers, redact identifiable third parties, and log what went to whom and why.

The exposure nobody budgets for

Anyone captured on your cameras can make a subject access request to you. You have a month, extendable for complex requests, and you only have to conduct a reasonable and proportionate search. You must give them information about themselves without adversely affecting other people's rights — which in practice means redacting everyone else in frame.

A district running dozens of cameras with no redaction capability has an unmanaged liability. And a member business you gave a copy to may find itself receiving requests it has no idea how to answer.

The regulation that does not cover you, and why that is not reassuring

A common assumption is that handing footage to the police brings you inside the forensic regulation regime, and that somebody official is therefore checking the quality of what you supply.

Neither is true. The statutory Forensic Science Regulator Code expressly excludes "receiving CCTV/VSS files from a third party (e.g. owner of CCTV system)" from its scope. It regulates the forensic units the police use. It does not regulate the operators who supply them, and it imposes no accreditation duty on a district scheme or on the software it runs.

The practical consequence runs the other way from comfort. Nothing formally regulates the quality of what you hand over — but the procedures the police apply to it afterwards will decide whether it survives challenge, and their own national framework already records that operator-supplied downloads are essentially unverifiable. There is no certificate available that fixes this. The only thing that does is running the scheme so the answers to the questions on this page are written down before anybody asks them.

Common questions

How long should CCTV be kept in the UK? There is no legally required period. The rule is the shortest period that serves the purpose you recorded for, written down with your reasoning. Most district schemes land between 28 and 31 days, which reflects how long police typically need to identify and collect footage — but that is an operational convention, not a legal minimum and not an ICO rule.

Do we have to give CCTV footage to the police? Not automatically. Disclosure is your decision unless there is a court order. The ICO's position is that you generally should, where your scheme exists to prevent and detect crime, and that refusing could prejudice an investigation — but the decision is yours and should be recorded.

What is a Schedule 2 Para 2 request? The written form forces use to request footage. It is named after the Data Protection Act 2018 exemption that relieves you of telling the data subject about the disclosure. It is not what makes the disclosure lawful — your Article 6 basis does that.

Can we give footage to the business that was the victim? You can, but it is a third-party disclosure with none of the protections that apply to police disclosure, and it carries real risks. Where a crime is alleged, the safer route is to point the member at the police.

What format should CCTV evidence be exported in? Native format, at the quality stored on the system, with the replay software exported alongside it. Converting to a "standard" format loses quality and metadata, and native format without a player is unusable.

Who signs the witness statement for CCTV evidence? A named individual who retrieved or can speak to the footage — in practice your control-room operator, not the organisation. The National Business Crime Centre publishes a free standardised template.

How long do we have to answer a subject access request for footage? One month, running from the latest of the request, any identity information you reasonably required, and any fee. You can extend by two months for complex requests if you tell the person within the first month. Preserve the footage as soon as the request arrives, or your retention policy may delete it while you work.

Where this fits

• The privacy and legal groundwork — DPIAs for district CCTV and ANPR
• How a scheme gets paid for — Funding an estate CCTV scheme

If you want to talk through how your scheme handles this, book a 30-minute call.

Written 10 September 2026. Standards, guidance and case law change; the linked sources are the authority, not this page.