CCTV footage should only be kept for as long as it serves a clear and lawful purpose. Anything longer risks breaching data protection law. Anything shorter may leave you without vital evidence when you need it most.

Retention periods are not fixed in UK law. Instead, they must be justified. What is appropriate for a domestic driveway system will differ from a retail shop, office, warehouse or similar commercial setting. This guide explains how long CCTV footage should typically be stored, what the law requires and how to determine a retention period that is both compliant and practical.

THE LEGAL POSITION – THERE IS NO FIXED TIME LIMIT

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, CCTV footage must not be kept for longer than necessary for the purpose it was collected.

This is known as the storage limitation principle.

The information Commissioner’s Office (ICO) does not prescribe a specific number of days. Instead, organisations must:

• Define the purpose of the CCTV system
• Set a retention period based on that purpose
• Document the decision
• Review it periodically

If footage is kept indefinitely without justification, the system is unlikely to be compliant.

The key question is always – how long do you realistically need access to footage in order to detect and respond to incidents?

TYPICAL CCTV RETENTION PERIODS IN THE UK

Although there is no statutory timeframe, industry norms have developed based on operational practice.

DOMESTIC CCTV SYSTEMS

For most homeowners, footage is typically retained for 7 to 30 days.

Domestic systems are usually installed for deterrence and short-term evidence following incidents such as theft or vandalism. In most cases, incidents are discovered quickly.

Longer retention is rarely necessary unless the property is high risk or rarely attended.

SMALL BUSINESSES

For small businesses and their premises, 14 to 31 days is common practice.

Thirty days is widely adopted because it allows sufficient time for:

• Internal stock discrepancies to be identified
• Customer complaints to arise
• Police requests to be made

For many insurers, a 30-days retention period is considered reasonable.

HIGHER-RISK COMMERCIAL PREMISES

Some commercial sites with sensitive or high-value stock or equipment, and so might be vulnerable to organised theft, may choose to retain there CCTV footage for longer periods of around 31 to 90 days (depending on risk assessments).

This is permissible but must be justified. Simply having large storage capacity is not a lawful reason to keep footage indefinitely.

Retention should always align with the identified security risk.

FACTORS THAT INFLUENCE HOW LONG CCTV SHOULD BE STORED

Retention should be based on context, not habit. Several practical factors influence the appropriate timeframe.

1. TYPE OF PREMISES

A suburban home has different exposure compared with a 24-hour convenience store or industrial unit. The greater the footfall and asset value, the more time may be needed to identify incidents.

2. INCIDENT DISCOVERY TIME

Consider how quickly incidents are normally identified.

• Retail theft may be discovered during end-of-day reconciliation
• Employee misconduct may take weeks to uncover
• Vandalism at a residential property is usually noticed immediately

Retention should allow a realistic window for detection.

3. INSURANCE REQUIREMENTS

Some insurers specify minimum retention periods for commercial CCTV systems. Always check policy terms.

4. POLICE REQUESTS

Police investigations may not begin immediately. A retention period of at least 28 to 31 days often provides a practical buffer.

5. STORAGE CAPACITY AND SYSTEM DESIGN

Higher resolution cameras and continuous recording consume more storage. Systems must be configured correctly to avoid overwriting footage too quickly.

Modern Network Video Recorders (NVRs) calculate storage based on:

• Number of cameras
• Resolution such as 1080p or 4K
• Frame rate
• Compression settings
• Recording mode, continuous or motion-based

Retention should be engineered, not estimated.

CONTINUOUS RECORDING VS MOTION RECORDING

The recording method significantly affects storage duration.

CONTINUOUS RECORDING

• Captures footage 24 hours a day
• Provides complete coverage
• Requires larger storage capacity

MOTION-ACTIVATED RECORDING

• Records only when movement is detected
• Extends retention time
• May miss contextual footage if sensitivity is poorly configured

For commercial environments, continuous recording is often preferred for evidential reliability. Motion recording may be suitable for domestic or low-traffic areas.

The correct configuration depends on risk and operational need.

DOMESTIC CCTV AND DATA PROTECTION RESPONSIBILITIES

Homeowners are usually exempt from data protection law if cameras only capture their own property.

However, if domestic CCTV captures public areas or neighbouring property, the homeowner becomes a data controller under UK GDPR.

In these cases, footage must be retained as long as necessary and securely stored so that it can be accessed and provided in response to legitimate subject access requests.

Thirty days is generally viewed as reasonable for domestic systems that cover shared or public space. Keeping footage indefinitely without purpose could be challenged.

WHEN SHOULD FOOTAGE BE KEPT LONGER?

Footage can be retained beyond the standard period if it relates to a specific incident. For example:

• A theft investigation
• An accident claim
• A disciplinary process
• A police enquiry

In these cases, the relevant footage should be securely isolated and retained until the matter is resolved.

Routine footage, however, should continue to overwrite automatically once the standard retention period expires.

Retention should be selective, not blanket.

CONCLUSION

CCTV retention is a balance between evidential value and legal compliance. For most properties:

• Domestic systems – 7 to 30 days
• Small commercial premises – 14 to 31 days
• Higher-risk sites – Up to 90 days where justified

The correct answer depends on documented purpose, operational reality and risk profile. A properly designed CCTV system calculates storage needs in advance, aligns with UK data protection law and includes a clear deletion process.

If you are reviewing your existing CCTV system or planning a new installation, our team at Securitec Systems can assess your premises, advise on compliant retention periods and configure storage to match your operational needs. Contact our team to discuss your domestic or commercial CCTV requirements.