SIA CCTV Operator Exam — Questions and Answers

Question 1: What is the maximum penalty the ICO can issue for serious breaches of data protection law relating to CCTV?

£10 million
£500,000
£17.5 million or 4% of annual turnover (Correct answer)
£1 million

Correct answer: £17.5 million or 4% of annual turnover

Under the UK GDPR, the ICO can impose fines of up to £17.5 million or 4% of annual worldwide turnover (whichever is higher) for the most serious breaches.

Question 2: Which of the following best describes the correct procedure when an operator suspects they may have witnessed a colleague misusing the CCTV system (e.g. monitoring personal acquaintances)?

Document the observations and report the concern through the formal whistleblowing or safeguarding procedure (Correct answer)
Ignore it as it is not the operator's responsibility to monitor colleagues
Inform the subject of the surveillance that they were being watched
Confront the colleague privately and give them an opportunity to explain

Correct answer: Document the observations and report the concern through the formal whistleblowing or safeguarding procedure

Suspected misuse of CCTV equipment must be reported through formal channels. This protects the individual raising the concern, ensures proper investigation, and safeguards the organisation's legal compliance.

Question 3: When is a Data Protection Impact Assessment (DPIA) mandatory before deploying a new CCTV system?

When the processing is likely to result in a high risk to the rights and freedoms of individuals (Correct answer)
Whenever the system will be operated by a licensed SIA operator
Only when more than 50 cameras are being installed
For every CCTV installation regardless of size or purpose

Correct answer: When the processing is likely to result in a high risk to the rights and freedoms of individuals

Under Article 35 of the UK GDPR, a DPIA is required when processing is likely to result in a high risk to individuals' rights and freedoms. The ICO's list of high-risk processing types includes systematic monitoring of public areas.

Question 4: How does the UK GDPR define 'personal data' in relation to CCTV footage?

Only footage that has been viewed by an operator and flagged as relevant
Footage stored on a company server for more than 30 days
Only footage that includes audio recordings of named individuals
Any information relating to an identified or identifiable natural person, including images from which a person can be identified (Correct answer)

Correct answer: Any information relating to an identified or identifiable natural person, including images from which a person can be identified

Article 4(1) UK GDPR defines personal data as any information relating to an identified or identifiable natural person. CCTV images are personal data because they can, directly or indirectly, identify living individuals.

Question 5: What is the purpose of a video wall in a CCTV control room?

To display multiple camera feeds simultaneously for monitoring (Correct answer)
To record footage
To block light from entering the room
To store backed-up footage

Correct answer: To display multiple camera feeds simultaneously for monitoring

A video wall consists of multiple screens arranged together to display many camera feeds simultaneously, allowing operators to monitor a large number of cameras at once.

Question 6: Under what circumstances can a CCTV operator lawfully share footage with the police?

Only with the specific written consent of every person shown in the footage
Only if the footage is more than 7 days old
Where there is a legal obligation to do so (e.g., court order), for crime prevention/detection (a lawful basis under UK GDPR), or where the data subject has consented (Correct answer)
At any time, as sharing with police is always lawful

Correct answer: Where there is a legal obligation to do so (e.g., court order), for crime prevention/detection (a lawful basis under UK GDPR), or where the data subject has consented

Sharing CCTV footage with police is lawful where a legal obligation requires it (e.g., a court order or Production Order under PACE 1984), or under UK GDPR Schedule 2 DPA 2018 exemptions (law enforcement/crime prevention), or where the controller has a legitimate interest in crime prevention that justifies the disclosure.

Question 7: What is the correct priority order when a CCTV operator identifies a serious incident in progress on camera?

Zoom in to obtain the best possible image before taking any other action
Complete the incident log entry first to ensure accurate records are maintained
Immediately alert the emergency services (999), then notify on-site security, then continue monitoring and recording (Correct answer)
Record the incident, then inform security staff, then call the emergency services

Correct answer: Immediately alert the emergency services (999), then notify on-site security, then continue monitoring and recording

Life safety is always the first priority. Alerting emergency services immediately ensures the fastest professional response. Notifying on-site security allows an immediate local response, while the operator continues monitoring and recording to support responders.

Question 8: What does 'depth of field' mean in the context of CCTV camera operation?

The resolution of the image measured in pixels per metre
The horizontal angle of view captured by the lens
The range of distances from the camera within which objects appear in sharp focus (Correct answer)
The maximum range at which the camera can detect motion

Correct answer: The range of distances from the camera within which objects appear in sharp focus

Depth of field refers to the zone of acceptable sharpness in front of and behind the point of focus. A deep depth of field keeps both near and far objects in focus; a shallow depth of field blurs objects outside the focused distance.

Question 9: What does PTZ stand for in relation to CCTV cameras?

Programmable Tracking Zone
Preset Tracking Zoom
Pan Tilt Zoom (Correct answer)
Point Track Zoom

Correct answer: Pan Tilt Zoom

PTZ stands for Pan Tilt Zoom. These cameras can rotate horizontally (pan), vertically (tilt), and adjust the lens to magnify images (zoom).

Question 10: What is the recommended maximum retention period for CCTV footage according to ICO guidance?

There is no set period — it should be no longer than necessary (Correct answer)
7 days
30 days
1 year

Correct answer: There is no set period — it should be no longer than necessary

The ICO does not specify a fixed retention period. Instead, footage should be retained for no longer than is necessary for the purpose for which it was recorded. Typically 30 days is common, but it depends on the specific purpose.

Question 11: Under UK GDPR, CCTV footage of identifiable individuals is classified as what?

Public information
Sensitive data only if audio is recorded
Non-regulated information
Personal data (Correct answer)

Correct answer: Personal data

CCTV footage that shows identifiable individuals constitutes personal data under UK GDPR, as it relates to identified or identifiable living persons.

Question 12: What does it mean for a CCTV operator to act as a 'responsible professional' under the SIA's standards?

To prioritise the interests of their employer above all other considerations
To maintain CCTV equipment to manufacturer specifications at all times
To act with integrity, within the law, in accordance with the SIA Code of Conduct, treating people fairly and without discrimination, and maintaining the high standards expected of a licensed professional (Correct answer)
To follow only the instructions of on-site security management

Correct answer: To act with integrity, within the law, in accordance with the SIA Code of Conduct, treating people fairly and without discrimination, and maintaining the high standards expected of a licensed professional

A responsible SIA-licensed professional acts with integrity and within the law, complies with data protection and human rights requirements, avoids discrimination, maintains professional standards, and upholds public confidence in the security industry — even when pressured to act otherwise.

Question 13: How quickly must a data breach involving CCTV footage be reported to the ICO if it poses a risk to individuals?

72 hours (Correct answer)
7 days
24 hours
30 days

Correct answer: 72 hours

Under UK GDPR, data breaches that pose a risk to individuals must be reported to the ICO within 72 hours of the organisation becoming aware of the breach.

Question 14: What is the purpose of a camera housing?

To hide the camera from public view
To improve the camera's recording quality
To protect the camera from weather, vandalism and environmental damage (Correct answer)
To amplify the camera's signal

Correct answer: To protect the camera from weather, vandalism and environmental damage

Camera housings protect the camera unit from environmental factors such as rain, dust, extreme temperatures, and potential vandalism or tampering.

Question 15: Who has the right to request that their CCTV footage be erased under UK GDPR?

Only employees of the organisation
Nobody — CCTV footage cannot be erased
Any data subject, though exemptions may apply (Correct answer)
Only the police

Correct answer: Any data subject, though exemptions may apply

Under UK GDPR, data subjects have the 'right to erasure' (right to be forgotten). However, exemptions exist — for example, if the footage is needed for crime prevention or legal proceedings.

Question 16: What is 'dwell time' in CCTV operations?

The time footage is stored before deletion
The length of time a camera remains on a particular view during an automatic tour (Correct answer)
The time taken for a camera to power on
The time between motion detection alerts

Correct answer: The length of time a camera remains on a particular view during an automatic tour

Dwell time is the length of time a camera stays on a particular preset position before moving to the next position during an automatic patrol or tour sequence.

Question 17: What is the recommended frequency for cleaning CCTV camera domes and lenses in an outdoor environment?

Annually, during the scheduled system review
Bi-annually, aligned with British Summer Time clock changes
Only when image quality complaints are received
As required based on inspection, typically at least quarterly or more often in dusty or coastal environments (Correct answer)

Correct answer: As required based on inspection, typically at least quarterly or more often in dusty or coastal environments

Outdoor lenses and domes accumulate dirt, bird droppings, algae, and condensation. Regular inspection and cleaning, at least quarterly and more frequently in harsh environments, is essential to maintain image quality.

Question 18: What does the UK GDPR 'accountability' principle require of organisations operating CCTV systems?

That each camera is registered individually with the Information Commissioner's Office
That all CCTV footage is reviewed daily by a senior manager
That organisations can demonstrate their CCTV use complies with data protection law through documentation and policies (Correct answer)
That operators pass an annual data protection examination

Correct answer: That organisations can demonstrate their CCTV use complies with data protection law through documentation and policies

The accountability principle (Article 5(2) UK GDPR) requires organisations not only to comply with data protection law but to be able to demonstrate their compliance through written policies, procedures, Data Protection Impact Assessments, and training records.

Question 19: What document provides authoritative guidance on the lawful and responsible use of surveillance camera systems in public places in England and Wales?

The ICO Employment Practices Code
The British Security Industry Association Guidelines
The Surveillance Camera Code of Practice (issued under the Protection of Freedoms Act 2012) (Correct answer)
The SIA CCTV Operator Licence Guide

Correct answer: The Surveillance Camera Code of Practice (issued under the Protection of Freedoms Act 2012)

The Surveillance Camera Code of Practice, issued by the Home Office under the Protection of Freedoms Act 2012, provides authoritative guidance on the responsible and effective use of surveillance camera systems by relevant authorities in England and Wales.

Question 20: What must be included on a CCTV signage notice to comply with the Information Commissioner's Office (ICO) requirements under UK data protection law?

The camera serial numbers and exact recording times
The name of every individual who has access to the footage
The name of the data controller, the purpose of surveillance, and contact details for further information (Correct answer)
The full text of the relevant legislation authorising the surveillance

Correct answer: The name of the data controller, the purpose of surveillance, and contact details for further information

ICO guidance requires CCTV signs to inform people that they are being recorded, identify who is responsible (the data controller), state why the cameras are in use, and provide contact details or a website for more information.

Question 21: Under the UK GDPR, what is meant by the principle of 'data minimisation' in the context of CCTV?

Only collecting the personal data (images) that are adequate, relevant, and limited to what is necessary for the purpose (Correct answer)
Deleting all footage after 24 hours regardless of incidents
Storing footage at the lowest possible resolution to save space
Restricting CCTV access to a minimum number of staff members

Correct answer: Only collecting the personal data (images) that are adequate, relevant, and limited to what is necessary for the purpose

Data minimisation requires that personal data collected, including CCTV images, must be adequate (sufficient for the purpose), relevant, and not excessive. Cameras should not capture more than necessary for the stated purpose.

Question 22: What principle of UK GDPR requires that CCTV footage be kept accurate and up to date?

Purpose limitation
Storage limitation
Accuracy (Correct answer)
Data minimisation

Correct answer: Accuracy

The accuracy principle requires that personal data be accurate and, where necessary, kept up to date. For CCTV, this means ensuring cameras have correct time stamps and dates.

Question 23: What is a 'tour' or 'patrol' function on a PTZ camera?

An automated sequence where the camera moves through preset positions (Correct answer)
A manual sweep of the area by the operator
A diagnostic check of camera functions
A function that follows a specific person

Correct answer: An automated sequence where the camera moves through preset positions

A tour or patrol is an automated sequence programmed into the PTZ camera where it cycles through a series of preset positions with defined dwell times at each point.

Question 24: Which camera placement provides the best identification-quality image of a person entering a building?

A camera mounted high on the ceiling looking straight down
A camera placed at head height facing the direction of approach (Correct answer)
A camera positioned behind the subject as they enter
A camera mounted externally at roof level angled down

Correct answer: A camera placed at head height facing the direction of approach

A camera at head height facing the direction of approach captures a full frontal facial image, providing the best chance of identifying an individual, meeting the CCTV industry standard for identification-level coverage.

Question 25: Under UK law, what must an organisation do before installing a CCTV system in a public area?

Get permission from every local resident
Register with the local council
Conduct a Data Protection Impact Assessment (DPIA) (Correct answer)
Obtain a warrant from a magistrate

Correct answer: Conduct a Data Protection Impact Assessment (DPIA)

Under UK GDPR and the Data Protection Act 2018, organisations must conduct a Data Protection Impact Assessment before deploying CCTV, to assess the necessity and proportionality of the surveillance.

Question 26: The Protection of Freedoms Act 2012 introduced the Surveillance Camera Code of Practice. Who is appointed to oversee compliance with this code?

The Chief Constable of the relevant police force
The Home Secretary
The Information Commissioner
The Surveillance Camera Commissioner (Correct answer)

Correct answer: The Surveillance Camera Commissioner

The Protection of Freedoms Act 2012 created the role of Surveillance Camera Commissioner (now incorporated into the Biometrics and Surveillance Camera Commissioner role) to encourage compliance with the Surveillance Camera Code of Practice among relevant authorities.

Question 27: What must happen to CCTV footage once the retention period has expired?

It must be securely deleted or overwritten (Correct answer)
It must be sent to the police
It must be archived permanently
It can be kept indefinitely as a backup

Correct answer: It must be securely deleted or overwritten

Once the retention period has expired and the footage is no longer needed for its stated purpose, it must be securely deleted or overwritten to comply with data protection principles.

Question 28: What is 'multiplexing' in a CCTV system?

Encrypting CCTV footage for security
Combining signals from multiple cameras onto one screen or recording device (Correct answer)
Transmitting footage to police automatically
Recording from one camera only

Correct answer: Combining signals from multiple cameras onto one screen or recording device

Multiplexing is the process of combining video signals from multiple cameras so they can be displayed on a single monitor (split screen) or recorded on a single device.

Question 29: What is the 'lawful basis' most commonly used by CCTV operators for processing personal data?

Legitimate interests (Correct answer)
Legal obligation
Consent
Vital interests

Correct answer: Legitimate interests

Most CCTV systems rely on 'legitimate interests' as their lawful basis — for example, the prevention and detection of crime or the protection of property.

Question 30: What should a CCTV operator do when they first take over a shift?

Turn off all monitors and restart the system
Check all cameras are operational, read the incident log, and note any ongoing issues (Correct answer)
Change all camera positions
Immediately start reviewing recorded footage

Correct answer: Check all cameras are operational, read the incident log, and note any ongoing issues

At the start of a shift, operators should check that all cameras and equipment are functioning, review the incident log from the previous shift, and note any ongoing situations or issues.

Question 31: In the event of a major incident (e.g., a terrorist attack in the monitored area), what is the CCTV operator's immediate priority?

Leave the control room to assist victims directly
Continue routine monitoring and report the incident at shift end
Immediately export all footage from the last 24 hours
Follow the organisation's major incident procedure: alert emergency services with precise location information, maintain camera coverage of the incident, support the command structure, and preserve footage (Correct answer)

Correct answer: Follow the organisation's major incident procedure: alert emergency services with precise location information, maintain camera coverage of the incident, support the command structure, and preserve footage

During a major incident, the CCTV operator's role is to support the emergency response through the command structure: alerting emergency services with exact location and incident details, maintaining camera coverage to guide responders, and preserving footage. Operators should not leave the control room to respond directly.

Question 32: Who is responsible for arranging a DSE (Display Screen Equipment) workstation assessment for a CCTV operator?

The Health and Safety Executive (HSE)
The employee, who must self-assess their own workstation
The local authority environmental health officer
The employer or a competent person appointed by them (Correct answer)

Correct answer: The employer or a competent person appointed by them

The employer has a legal duty under the DSE Regulations 1992 to ensure workstation assessments are carried out by a competent person.

Question 33: What is the role of the Surveillance Camera Commissioner in the UK?

To prosecute individuals caught on CCTV
To install CCTV cameras across the country
To encourage compliance with the Surveillance Camera Code of Practice (Correct answer)
To sell CCTV equipment to businesses

Correct answer: To encourage compliance with the Surveillance Camera Code of Practice

The Surveillance Camera Commissioner's role is to encourage compliance with the Surveillance Camera Code of Practice and review how it is being applied.

Question 34: Under the Regulation of Investigatory Powers Act 2000 (RIPA), what type of surveillance is covert CCTV classified as?

Intrusive surveillance only
Directed surveillance (Correct answer)
Always requires a warrant
Neither directed nor intrusive

Correct answer: Directed surveillance

Under RIPA, covert CCTV used as part of a specific investigation is typically classified as directed surveillance, which requires authorisation from a designated person.

Question 35: What is a 'watch list' in CCTV operations and what care must be taken when using one?

A list of camera locations to be checked at the start of each shift
A scheduling document showing when each camera performs automated recording
A list of individuals flagged for attention by security or police, used to direct surveillance, but which must be used lawfully and without discrimination (Correct answer)
A log of all incidents observed during a shift

Correct answer: A list of individuals flagged for attention by security or police, used to direct surveillance, but which must be used lawfully and without discrimination

A watch list identifies individuals whose presence should be reported. It must be managed lawfully under UK GDPR and used without unlawful discrimination based on protected characteristics.

Question 36: Which piece of legislation specifically governs the interception of communications, and why might it be relevant to CCTV operators who also monitor audio?

The Regulation of Investigatory Powers Act 2000 (RIPA) (Correct answer)
The Official Secrets Act 1989
The Computer Misuse Act 1990
The Freedom of Information Act 2000

Correct answer: The Regulation of Investigatory Powers Act 2000 (RIPA)

RIPA 2000 regulates the lawful interception of communications in the UK. CCTV systems that incorporate audio recording may be capturing conversations, which could constitute interception if not authorised appropriately.

Question 37: A member of the public requests to see CCTV footage of themselves. Under UK GDPR, this is known as what?

A subject access request (SAR) (Correct answer)
A disclosure notice
A freedom of information request
A court order

Correct answer: A subject access request (SAR)

Under UK GDPR, individuals have the right to make a Subject Access Request (SAR) to see any personal data held about them, including CCTV footage.

Question 38: What type of CCTV camera is best suited for monitoring a wide, open area such as a car park?

A dome camera with a fisheye lens
A PTZ camera with good optical zoom (Correct answer)
A covert pinhole camera
A fixed camera with a narrow lens

Correct answer: A PTZ camera with good optical zoom

A PTZ camera is ideal for large, open areas like car parks because it can pan across the wide space, tilt to different angles, and zoom in on specific areas of interest.

Question 39: What signage requirement applies to most CCTV systems in the UK?

No signage is required
Signs must be clearly visible, showing who operates the system and contact details (Correct answer)
Signs need only show a camera symbol
Signs must be placed only at entry points

Correct answer: Signs must be clearly visible, showing who operates the system and contact details

The ICO requires that CCTV signs be clearly visible, include the identity of the organisation operating the system, and provide contact details for enquiries.

Question 40: What is the purpose of conducting a 'health check' on a CCTV recording system's storage capacity?

To test that the recorder can withstand a power surge
To confirm that the monitor calibration matches the recorded footage
To ensure that the system has sufficient remaining capacity to record continuously for the required retention period (Correct answer)
To verify that the hard drives are encrypted to the required standard

Correct answer: To ensure that the system has sufficient remaining capacity to record continuously for the required retention period

Storage health checks verify that enough capacity exists to maintain the required retention period (typically 31 days for public space CCTV). If storage is filling faster than expected, the retention period may be shortened, creating gaps in evidential coverage.

Question 41: Under the Equality Act 2010, a CCTV operator must ensure that surveillance activities do not:

Store footage for longer than 14 days without senior authorisation
Record footage at more than 25 frames per second
Use PTZ cameras to track individuals across public spaces
Disproportionately target individuals based on protected characteristics such as race or religion (Correct answer)

Correct answer: Disproportionately target individuals based on protected characteristics such as race or religion

The Equality Act 2010 prohibits discrimination based on protected characteristics including race, religion, sex, age, and disability. CCTV operators must not engage in discriminatory surveillance, such as disproportionately focusing on individuals of a particular ethnicity.

Question 42: An operator monitoring a town centre camera observes a person who appears to be in severe mental health distress, behaving erratically and standing near a busy road. What is the appropriate response?

Observe only - mental health matters are outside the scope of CCTV operations
Use the public address system to ask the person to move away from the road
Immediately alert the police and/or ambulance service, maintain camera coverage, and direct any nearby security or street wardens to provide support from a safe distance (Correct answer)
Contact the person's family using information from the local authority database

Correct answer: Immediately alert the police and/or ambulance service, maintain camera coverage, and direct any nearby security or street wardens to provide support from a safe distance

A person in mental health crisis near a hazard (traffic) is a potential life risk. The operator must immediately alert emergency services, who are trained to respond to mental health crises, and maintain camera coverage to guide their response.

Question 43: What is the main advantage of digital zoom over optical zoom?

Digital zoom has no real advantage — optical zoom maintains image quality (Correct answer)
Digital zoom works better at night
Digital zoom allows wider coverage
Digital zoom produces higher quality images

Correct answer: Digital zoom has no real advantage — optical zoom maintains image quality

Digital zoom simply enlarges the pixels of the existing image, resulting in reduced quality. Optical zoom uses the camera lens to magnify the image while maintaining full resolution.

Question 44: Under the Human Rights Act 1998, which Article is most relevant to CCTV surveillance in public places?

Article 10 - Freedom of Expression
Article 2 - Right to Life
Article 14 - Prohibition of Discrimination
Article 8 - Right to Respect for Private and Family Life (Correct answer)

Correct answer: Article 8 - Right to Respect for Private and Family Life

Article 8 of the Human Rights Act 1998 protects the right to respect for private and family life, home, and correspondence. CCTV surveillance must be proportionate and necessary to avoid infringing this right.

SIA CCTV Operator Exam

The SIA CCTV Operator Exam is required to obtain an SIA licence for CCTV operators in the UK, covering CCTV legislation, camera operations, UK GDPR and data protection, and evidence handling procedures.

Questions

75 min

Time Limit

74%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds