Reviewed, sourced guidance
CCTV retention and storage planning in the UK
Direct answer
The ICO states that UK GDPR and the Data Protection Act 2018 do not set one minimum or maximum surveillance retention period. It says the purpose should determine the necessary period and footage should not be kept longer than needed. The ICO marks its surveillance guidance as under review, so check its current pages.
Storage capacity is a technical result, not a reason to keep personal data for longer. Decide and document a purpose before choosing the retention input.
Key takeaways
- Do not choose a retention period just because a recorder permits it.
- Document the purpose and review whether footage is still needed.
- Calculate storage only after selecting a justified input period.
- Recheck current ICO guidance before relying on it.
Purpose comes before disk size
The ICO guidance says the purpose of processing should determine the necessary retention period. It warns against keeping footage longer merely because the system can store it.
Choose the retention input outside this calculator. The storage result must not be treated as a reason to extend retention.
Sources for this section: ICO, storage limitation and retention for surveillance systems (observed 2026-09-25; guidance under review)
Document and review the decision
The ICO storage-limitation guidance describes setting and reviewing retention periods, then erasing or anonymising data that is no longer needed.
The ICO marks its CCTV guidance as under review following the Data (Use and Access) Act. Confirm the current official guidance and obtain appropriate advice for a specific system.
Sources for this section: ICO, storage limitation principle (observed 2026-09-25; guidance under review)ICO, storage limitation and retention for surveillance systems (observed 2026-09-25; guidance under review)
Next steps
- Document why the footage is collected and how long it is needed.
- Review the current ICO guidance and the organisation’s own policy.