Legislation and Standards

Home / electronc security

CCTV - Data Protection Act (DPA)

Chubb offer a range of products and services to ensure your CCTV system complies with the Data Protection Act.

CCTV systems that focus on the activities of individuals must comply with the DPA.

The Data Protection Act was introduced to promote high standards in the handling of personal information, and so to protect the individual’s right to privacy. This applies particularly to CCTV systems as they process personal data in the form of video images.

CLICK HERE TO OPEN OUR 'CCTV DATA PROTECTION ACT LEAFLET' (2,861KB)

how the data protection act could affect you

The 8 Data Protection Principles

Most businesses with CCTV installations will have to comply with the requirements of the Act by complying with the 8 data protection principles of good information handling.

Personal information must be:

Fairly and lawfully processed
Processed for specified purposes
Adequate, relevant and not excessive
Accurate, and where necessary, kept up to date
Not kept for longer than is necessary
Processed in line with the rights of the individual
Kept secure
Not transferred to countries outside the European Economic Area unless there is adequate protection of the information

What happens if I do not comply?

Your business’s reputation and finances could be affected
The Information Commissioner could also take enforceable action against you to bring your processing into compliance with the 8 principles
A failure to notify or renew a notification that your business has a CCTV system in operation is a criminal offence punishable by a fine, unless you are exempt from notifying
An individual may seek compensation through the courts for any damage suffered

What is a Subject Access Request?

Individuals have limited rights under the Act to request a copy of the information held about them. This is known as the right of subject access.

Such requests must be documented and reasonable, and you can charge an administration fee of up to £10 to produce the information. You must deal with such requests promptly and in any case within 40 days.

How do I become compliant?

Firstly, you should ensure that your system complies with the 8 Data Protection Principles.

If you have not done so already, you should register your CCTV system (commercial or public) with the Information Commissioner. This can be done at www.informationcommissioner.gov.uk, or by telephone on 01625 545740. The notification period is one year and the fee is £35. If you have already registered your CCTV system the Information Commissioner will write to you before the expiry date of your register entry, and the renewal cost is £35.

You should display warning signs to show that CCTV cameras are recording, and stating the purpose of the system and details of who manages the system and how to contact them.

Is it easy to comply if I have an analogue (VCR) CCTV system?

CCTV Systems incorporating an analogue Video Cassette Recorder (VCR)

The main issues with analogue CCTV systems, in terms of complying with the Data Protection Act, is with subject access requests and releasing personal information to an individual if requested, and ensuring that personal information (video images) is kept as long as necessary.

All your recordings must be logged and tracked to show who changes tapes and when, and when a tape has been released to a third party or removed from use
All your recorded tapes and video cassette recorders must be kept secure

Is it easy to comply if I have a digital (DVR) CCTV system?

CCTV Systems incorporating a Digital Video Recorder (DVR)

The main issue with a digital CCTV system, in terms of complying with the Data Protection Act, is with securing the recordings and digital recording devices.

All your recordings must be logged and tracked to show how long images are stored and when images have been released to a third party
All your recorded images and digital recording devices must be kept secure