A camera never blinks, but your hard-drive space and legal patience certainly do. Keep recordings too briefly and you may lose vital evidence; keep them forever and you risk breaching UK GDPR—plus paying for a mountain of disks you rarely need. Striking the sweet spot means writing a clear retention policy and sticking to it.
This guide skips the legal waffle and digs into what most facilities, IT and compliance teams really want to know:
- How long should we keep footage?
- Where and how do we store it?
- Who can see it, and when?
- What must we document to satisfy auditors or the ICO?
By the end you’ll have a practical framework you can adopt today—no law degree required.
Why Retention Policies Matter
Footage is personal data. That means it falls squarely under the UK GDPR and the Data Protection Act 2018. Regulators expect proof that you:
- Have a lawful reason to record.
- Limit retention to what is “necessary and proportionate.”
- Secure the footage against loss or unauthorised access.
A written retention policy is your evidence that you meet those duties. It also saves headaches when HR, insurers or the police request clips: you know exactly where to look and whether the data still exists.
For the legal basics, see our plain-English GDPR & CCTV compliance checklist.
Choosing the Right Retention Period
There is no one-size-fits-all figure in law, but most UK organisations settle on:
Environment | Typical Retention |
General office | 30 days |
Retail with high shrinkage | 60 – 90 days |
Remote/unmanned sites | 90 days (longer discovery window) |
Regulated sectors (e.g. gambling) | Up to 180 days as licence dictates |
Ask two questions:
- How long do incidents take to surface? If thefts are spotted within a week, 30 days covers you comfortably.
- Do external bodies set rules? Some regulators demand specific periods—always check.
Once the period is agreed, configure your recorder or cloud platform to purge files automatically. Manual deletion routines inevitably slip.
