The Data (Use and Access) Act 2025 amended, rather than replaced, the UK GDPR and Data Protection Act 2018. Most remaining data protection provisions came into force on 5 February 2026, followed by the new complaints-handling duty on 19 June 2026. The client will usually be the controller because it decides why and how footage is used. However, an installer that hosts, remotely monitors or otherwise processes footage may also have processor duties. Good design still determines how easily the client can comply, whichever IP CCTV cameras you specify.

The core principles remain: cameras must serve a defined purpose, coverage must be necessary and proportionate, access must be controlled, and footage must not be kept longer than needed. The Surveillance Camera Code of Practice also remains in force for relevant authorities in England and Wales, which matters when working with councils or police, as this guide to high street surveillance for local authorities explains.

What changed in 2026

Subject access requests now expressly require reasonable and proportionate searches. A controller normally has one month to respond. The period does not begin until reasonably requested identity information is received, while a justified request for clarification about the information sought can pause the clock. The ICO’s right of access guidance explains how to calculate and document these timings.

The complaints process must be accessible, complaints must be acknowledged within 30 days, and the controller must investigate and respond without undue delay. The Information Commission has not yet taken over the ICO’s responsibilities, with the transition expected later in 2026.

Where installers make the difference

Camera placement is a data protection decision as well as a technical one. Avoid recording neighbouring property, public space or staff areas beyond what the stated purpose requires. Resolution should also match the operational need. Capturing unnecessary detail can conflict with data minimisation, so use this guide to choosing between 6MP, 8MP and 12MP cameras as a practical check.

There is no universal statutory retention period for CCTV. The controller must choose and document a period that is necessary for its purpose. Size surveillance hard drives around that policy rather than allowing footage to accumulate. Reliable IP CCTV NVRs should provide restricted user access, accurate timestamps and straightforward export. The risks of unsupported equipment are covered in outdated DVRs risk UK GDPR enforcement, while upgrading from analogue to IP can be planned in stages.

Signs should be prominent before people enter the monitored area and identify the operator, the purpose and how to obtain further information. See CCTV signage and privacy for UK sites.

Where a client wants ANPR or advanced analytics, assess the risks before deployment. A data protection impact assessment is mandatory where processing is likely to create a high risk, including large-scale monitoring of publicly accessible places or workplace monitoring. See AI and smart analytics in UK surveillance and the ANPR camera placement guide.

Frequently asked questions

Do businesses using CCTV need to register with the ICO?

Usually. A controller capturing identifiable people for business purposes will generally need to register and pay the data protection fee unless an exemption applies. Purely household use is treated differently, although data protection law can apply when domestic cameras capture areas beyond the property boundary.

How long can CCTV footage be kept?

There is no fixed legal period. Keep footage only for as long as the stated purpose requires, with incident footage preserved separately where necessary.

Can someone request CCTV footage of themselves?

Yes. A person may make a subject access request. Other identifiable people should normally be masked or otherwise protected where disclosure would adversely affect their rights.

Specify compliance into the system

Compliance is easier when built into the design. For proportionate coverage, controlled retention and rapid retrieval, speak to us as your trade CCTV supplier and choose the CCTV accessories needed to complete the installation properly. Call the team or book an intro call.