CCTV policy: what to publish on your school website
If your school uses CCTV, your CCTV policy says who is responsible for it and who can view or share the footage.
Check this on my websiteWho it applies to
- Published on
- The school's own website
- School type
- Academies and maintained schools
- School stage
- All stages, from early years to sixth form
- Only applies to
- Schools that use CCTV
- Does not apply to
- No school types are excluded
When it's due
Keep it up to date
There's no fixed date. Update it whenever something changes.
What's needed
Publish your CCTV policy on the data protection or policies page on your website, naming who is responsible and who can view or share footage.
What it must contain
3 parts- Gives the restrictions on who can view or disclose the imagesShould: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.
- Names who is responsible for making sure the procedures are followedShould: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.
- Says the appropriate policy document is in place when CCTV is used to prevent crime or shared with policeMust: Required by law, statutory guidance or the academy's funding agreement.
What the official sources say
Set out in 2 official sources:
Video surveillance guidance: how can we comply with the data protection principles when using surveillance systems
You always need to ensure that those under surveillance are clearly aware that they are being recorded. You should provide individuals with appropriate information about how they can exercise their rights, and that appropriate restrictions on viewing and disclosing images are in place for those using the system.
Should: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.§ Fairness
– ensure that you make people other than workers, such as visitors or customers, who may inadvertently be caught by monitoring, aware of its operation and why you are carrying it out;
Must: Required by law, statutory guidance or the academy's funding agreement.§ Surveillance in the workplace
Show 1 more from this source
It may be useful to use websites or social media to inform individuals that certain types of surveillance systems are in operation at a specific time and in a specific area. It is important to note however that publishing information on a website, by itself, is not enough to comply. You have to draw the individuals’ attention to the information. Therefore, you could use physical signage with linked information, so that individuals can find out more if they are interested. This would essentially function as a layered privacy notice.
Good practice: Recommended as good practice. Not required.§ Transparency — Example
Video surveillance guidance: what are our responsibilities in terms of accountability
The UK GDPR and DPA 2018 also outline the legal requirement for an appropriate policy document to be in place when processing special category and criminal offence data under certain specified conditions.
Must: Required by law, statutory guidance or the academy's funding agreement.§ What about documentation?
– Has responsibility for ensuring that procedures are followed been allocated to a data protection officer (DPO) or to an appropriate named individual? They should ensure that standards are set, procedures are put in place to meet these standards, and that the system complies with this guidance and other legal obligations.
Expected: Inspectors expect to see it, though it isn't a legal requirement.§ How do we ensure effective control of our surveillance systems?
Questions schools ask
Do schools have to publish a CCTV policy?
Academies and maintained schools must. It only applies to schools that use CCTV.
What does a school CCTV policy need to include?
Restrictions on who can view or disclose the images; Names who is responsible for making sure the procedures are followed; Says the appropriate policy document is in place when CCTV is used to prevent crime or shared with police.
When do we need to update our CCTV policy?
Keep it up to date. There's no fixed date. Update it whenever something changes.
Where does the requirement for the CCTV policy come from?
It is set out in Video surveillance guidance: how can we comply with the data protection principles when using surveillance systems and Video surveillance guidance: what are our responsibilities in terms of accountability.
Recent changes to the official guidance
The official sources for this requirement don't publish dated change notes. We check them for changes ourselves.
We last checked these sources on 21 September 2026.
Is this on your school's website?
Enter your school email address and we'll check your website for this requirement.
It's free, and the result arrives by email.
Official wording that does not apply to schools (2)
In practice, it is often difficult to obtain genuine consent from individuals for processing their personal data in public spaces. Therefore, it is likely the appropriate lawful basis will be either legitimate interests, or a reliance on public task (if you are carrying out your tasks as a public authority in the public interest or under official authority).
A business responsible for managing a public multi-storey car park wishes to use CCTV cameras around the premises and in the elevators, to ensure the safety and security of individuals using them.
Official sources last checked 21 September 2026 · register version 1.0.4