CCTV policy
A policy on how the school runs its CCTV: who is responsible and who can view or disclose footage. Schools that use CCTV must have one, plus an appropriate policy document where it is used to prevent crime or footage goes to the police.
Check this on my websiteWho it applies to
- Published on
- The school's own website
- School type
- Academies and maintained schools
- School stage
- All stages, from early years to sixth form
- Only applies to
- Schools that use CCTV
- Does not apply to
- No school types are excluded
When is it due?
- Renewal
- No fixed date
The official sources set no renewal date. Keep it accurate whenever it changes.
What's needed
Publish the CCTV or surveillance policy (the appropriate policy document) on the data protection or policies page where CCTV is used.
What it must contain
3 parts- Gives the restrictions on who can view or disclose the imagesShould
- Names who is responsible for making sure the procedures are followedShould
- Says the appropriate policy document is in place when CCTV is used to prevent crime or shared with policeMust
What the official sources say
Set out in 2 official sources:
Video surveillance guidance: how can we comply with the data protection principles when using surveillance systems
You always need to ensure that those under surveillance are clearly aware that they are being recorded. You should provide individuals with appropriate information about how they can exercise their rights, and that appropriate restrictions on viewing and disclosing images are in place for those using the system.
Should§ Fairness
– ensure that you make people other than workers, such as visitors or customers, who may inadvertently be caught by monitoring, aware of its operation and why you are carrying it out;
Must§ Surveillance in the workplace
Show 1 more from this source
It may be useful to use websites or social media to inform individuals that certain types of surveillance systems are in operation at a specific time and in a specific area. It is important to note however that publishing information on a website, by itself, is not enough to comply. You have to draw the individuals’ attention to the information. Therefore, you could use physical signage with linked information, so that individuals can find out more if they are interested. This would essentially function as a layered privacy notice.
Good practice§ Transparency — Example
Video surveillance guidance: what are our responsibilities in terms of accountability
The UK GDPR and DPA 2018 also outline the legal requirement for an appropriate policy document to be in place when processing special category and criminal offence data under certain specified conditions.
Must§ What about documentation?
– Has responsibility for ensuring that procedures are followed been allocated to a data protection officer (DPO) or to an appropriate named individual? They should ensure that standards are set, procedures are put in place to meet these standards, and that the system complies with this guidance and other legal obligations.
Expected§ How do we ensure effective control of our surveillance systems?
Questions schools ask
Does every school have to publish the CCTV policy?
The official sources we check set no requirement for academies. The official sources we check set no requirement for maintained schools. It only applies to schools that use CCTV.
When does the CCTV policy need to be published?
Renewal: No fixed date. The official sources set no renewal date. Keep it accurate whenever it changes.
What must the CCTV policy include?
Gives the restrictions on who can view or disclose the images; Names who is responsible for making sure the procedures are followed; Says the appropriate policy document is in place when CCTV is used to prevent crime or shared with police.
Where does the requirement for the CCTV policy come from?
It is set out in Video surveillance guidance: how can we comply with the data protection principles when using surveillance systems and Video surveillance guidance: what are our responsibilities in terms of accountability.
Changes to the official sources
The sources for this item do not publish dated change notes. Their current versions are listed above.
We last checked these sources on 21 September 2026.
Is this on your school's website?
We check your site the way an inspector or a parent would find it: page by page, against the official wording of each requirement. If it's there, you get the page and the words we found. If it isn't, you get every place we looked.
Check this one requirement free, or scan your whole site against every requirement.
Official wording that does not apply to schools (2)
In practice, it is often difficult to obtain genuine consent from individuals for processing their personal data in public spaces. Therefore, it is likely the appropriate lawful basis will be either legitimate interests, or a reliance on public task (if you are carrying out your tasks as a public authority in the public interest or under official authority).
A business responsible for managing a public multi-storey car park wishes to use CCTV cameras around the premises and in the elevators, to ensure the safety and security of individuals using them.
Official sources last checked 21 September 2026 · register version 1.0.4