When it comes to CCTV, many businesses focus on installing the right cameras and ensuring everything’s recording. But one question often gets overlooked: How long can a business keep CCTV footage?

The answer isn’t always straightforward, but it’s very important — especially when it comes to staying compliant with UK data protection laws.

Let’s break it down simply.

So, How Long Can a Business Keep CCTV Footage?

The general rule is:

You should only keep CCTV footage for as long as it’s needed for the reason you collected it.

There’s no fixed number of days written into law — but for most businesses, that’s usually between 30 and 31 days.

After that, if there’s no reason to keep the footage (like an ongoing investigation or legal matter), it should be deleted.

What Does the Law Say?

Under the UK GDPR and Data Protection Act 2018, CCTV recordings are considered personal data — because people can be identified from the footage.

This means:

  • You must have a clear reason for recording and storing it
  • You must only keep it as long as necessary
  • You must delete it securely once it’s no longer needed

If you keep footage longer than needed without a valid reason, you could be in breach of data protection laws.

When Might You Keep Footage Longer?

There are situations where it’s perfectly valid to keep CCTV footage for longer than 30 days:

  • A crime or incident has occurred on your premises
  • There’s an ongoing internal investigation
  • You’ve received a Subject Access Request or police request
  • You’re required to hold it longer for insurance or legal purposes

In these cases, you should keep the footage only for as long as necessary — and document why you’re doing so.

How Should CCTV Footage Be Stored and Deleted?

To stay compliant, make sure your business:

  • Stores footage securely (e.g., password-protected systems, encrypted drives)
  • Restricts access to authorised staff only
  • Deletes old footage regularly and in a way that it can’t be recovered
  • Keeps a clear policy on how long footage is kept and why

This protects your business and ensures you’re handling personal data responsibly.

What If Someone Asks to See the Footage?

Anyone who appears in your footage can legally request to see it. This is called a Subject Access Request (SAR).

You’ll need to:

  • Provide the footage within one month
  • Blur out or remove others who appear in the footage
  • Explain how long you keep recordings and why, if asked

Having a retention policy in place makes this process much easier.