SIA CCTV Data Protection (UK GDPR)

Question 1

Under UK GDPR, CCTV footage of identifiable individuals is classified as what?

Accepted Answer

Personal data

Answer

CCTV footage that shows identifiable individuals constitutes personal data under UK GDPR, as it relates to identified or identifiable living persons.

Question 2

What is the 'lawful basis' most commonly used by CCTV operators for processing personal data?

Accepted Answer

Legitimate interests

Answer

Most CCTV systems rely on 'legitimate interests' as their lawful basis — for example, the prevention and detection of crime or the protection of property.

Question 3

Under UK GDPR, who is the 'data controller' in relation to a CCTV system?

Accepted Answer

The organisation that determines the purposes and means of processing the footage

Answer

The data controller is the organisation or person who decides why and how personal data is processed. For CCTV, this is typically the organisation that decided to install and operate the system.

Question 4

What is the recommended maximum retention period for CCTV footage according to ICO guidance?

Accepted Answer

There is no set period — it should be no longer than necessary

Answer

The ICO does not specify a fixed retention period. Instead, footage should be retained for no longer than is necessary for the purpose for which it was recorded. Typically 30 days is common, but it depends on the specific purpose.

Question 5

What must happen to CCTV footage once the retention period has expired?

Accepted Answer

It must be securely deleted or overwritten

Answer

Once the retention period has expired and the footage is no longer needed for its stated purpose, it must be securely deleted or overwritten to comply with data protection principles.

SIA CCTV Operator Practice Test

SIA CCTV Operator Practice Test

SIA CCTV Data Protection (UK GDPR)