SIA CCTV Data Protection (UK GDPR)

Question 1

Under UK GDPR, CCTV footage of identifiable individuals is classified as what?

Accepted Answer

Personal data

Answer

Public information

Answer

Sensitive data only if audio is recorded

Answer

Non-regulated information

Question 2

What is the 'lawful basis' most commonly used by CCTV operators for processing personal data?

Accepted Answer

Legitimate interests

Answer

Consent

Answer

Legal obligation

Answer

Vital interests

Question 3

Under UK GDPR, who is the 'data controller' in relation to a CCTV system?

Accepted Answer

The organisation that determines the purposes and means of processing the footage

Answer

The person who monitors the screens

Answer

The company that installed the cameras

Answer

The police

Question 4

What is the recommended maximum retention period for CCTV footage according to ICO guidance?

Accepted Answer

There is no set period — it should be no longer than necessary

Answer

7 days

Answer

30 days

Answer

1 year

Question 5

What must happen to CCTV footage once the retention period has expired?

Accepted Answer

It must be securely deleted or overwritten

Answer

It must be archived permanently

Answer

It must be sent to the police

Answer

It can be kept indefinitely as a backup

Question 6

Who has the right to request that their CCTV footage be erased under UK GDPR?

Accepted Answer

Any data subject, though exemptions may apply

Answer

Only the police

Answer

Only employees of the organisation

Answer

Nobody — CCTV footage cannot be erased