SIA CCTV Data Protection (UK GDPR) 2

Question 1

What is a 'data breach' in the context of CCTV operations?

Accepted Answer

When personal data is accidentally or unlawfully accessed, disclosed, altered, or destroyed

Answer

A data breach is a security incident where personal data is accessed, disclosed, altered or destroyed without authorisation. For CCTV, this could include footage being viewed by unauthorised people or leaked online.

Question 2

How quickly must a data breach involving CCTV footage be reported to the ICO if it poses a risk to individuals?

Accepted Answer

72 hours

Answer

Under UK GDPR, data breaches that pose a risk to individuals must be reported to the ICO within 72 hours of the organisation becoming aware of the breach.

Question 3

What is the purpose of a 'privacy impact assessment' for a CCTV system?

Accepted Answer

To identify and minimise the privacy risks associated with the CCTV system

Answer

A privacy impact assessment (also called DPIA) helps identify and minimise privacy risks before the system is deployed, ensuring it is necessary, proportionate, and compliant with data protection law.

Question 4

If CCTV footage is to be shared with the police, what must the operator ensure?

Accepted Answer

There is a lawful basis for the disclosure and it is documented

Answer

Any disclosure of CCTV footage must have a lawful basis and be documented. Operators should record what was shared, with whom, when, and the reason for the disclosure.

Question 5

What principle of UK GDPR requires that CCTV footage be kept accurate and up to date?

Accepted Answer

Accuracy

Answer

The accuracy principle requires that personal data be accurate and, where necessary, kept up to date. For CCTV, this means ensuring cameras have correct time stamps and dates.

SIA CCTV Operator Practice Test

SIA CCTV Operator Practice Test

SIA CCTV Data Protection (UK GDPR) 2