“The recorder keeps thirty days” describes a setting. It does not explain why the business needs that period or what happens to the copies someone exports.
The idea in view · Planning diagram
Follow the record beyond the recorder
- Purpose
- Information category
- Approved period
- System behavior
- Incident hold or export
- Deletion or review check
Start with the purpose
Ask the responsible privacy owner when incidents are normally discovered and what information is needed to investigate them. Do not choose a period just because the recorder can hold it. Record who approves the policy and where the decision is reviewed.
Separate routine footage and preservation
An identified incident may require a specific preservation decision. Keep that exception traceable rather than silently extending all footage. Check exports and backups as well as the recorder; deleting the source does not necessarily remove copies.
Verify implementation
Have the authorized team inspect overwrite or deletion settings and test retrieval near the agreed boundary. Record configuration exceptions. Check current ICO guidance when approving the policy; its surveillance guidance is under review following legislative changes.
Put the purpose beside the period
Ask the privacy owner how the site discovers incidents and what information it needs for the stated purpose. Document the reasoning rather than adopting the recorder’s default. The ICO says UK surveillance does not have a single prescribed minimum or maximum retention period under the UK GDPR and DPA 2018; its current guidance should be checked when making the decision.
Test what the policy means in practice. Can an authorized user retrieve relevant footage near the permitted boundary? Do exports or backups remain after source deletion? Who releases an incident-preservation hold when its purpose ends? Keep these questions in the operational procedure so the approved policy survives beyond the document.
Start with purpose, not a default number
A retention decision explains why a particular category of recording or record needs to remain available and when it should be deleted or reviewed. A recorder's default setting describes configuration, not a complete justification. The appropriate decision depends on the actual use, organizations, location and applicable requirements. This planning guide does not set a universal legal retention period.
Separate routine footage, event clips, exported incident material and service records. They may serve different purposes and live in different systems. Keeping the recorder for a defined period does not automatically control a copy in an incident platform or an export folder. Identify those copies and their owners before deciding that the organization's retention practice matches the setting on the recorder.
Reference context: ICO: surveillance data protection principles
Connect policy to actual system behavior
Confirm how each system deletes, overwrites or retains material. The technical owner should explain the supported configuration and how the intended result can be checked. A disk-capacity estimate is relevant to availability, but it does not establish that deletion occurs when intended. Nor does an automatic overwrite guarantee that an authorized incident hold will survive.
Record who can place a hold or authorize an exception, the reason, scope and review condition. Avoid an indefinite keep-everything rule simply because a clip might become useful. Equally, do not remove material that is subject to a valid preservation requirement without the responsible decision. Where obligations are uncertain, obtain advice for the actual context rather than treating a generic worksheet as legal approval.
Check copies and document changes
Use the data-flow map to locate exports, thumbnails, incident attachments and other retained records. Ask who can retrieve them, what deletion mechanism applies and who verifies the result. Keep the review at the level necessary to understand responsibility without distributing footage or private links in a general spreadsheet.
When the purpose, service or system changes, review the retention decision and implementation. A new provider may create another copy or offer a different deletion mechanism. A camera upgrade may shorten actual recorder history without changing the written requirement. Both are governance and operational issues. The review should show whether the decision, configuration and observed result still agree, with any mismatch assigned to an owner.
A fictional incident clip outside routine overwrite
A business configures routine recorder overwrite according to its approved decision. During an incident, an authorized employee exports a clip for follow-up. Weeks later, the original recording is gone but the exported copy remains on a shared drive. The recorder setting has not controlled that separate copy.
The business identifies the export's purpose, authorized owner, access and review or deletion condition through its actual procedure. The retention record references the controlled location without placing the footage in the worksheet. If the incident requires preservation, the relevant hold is documented; if the purpose has ended, the approved deletion process applies. The lesson is to account for the material's lifecycle rather than assume one recorder setting governs every downstream record.
Make the call
Which retention decision is this?
| Situation | Decision to make | What to ask for |
|---|---|---|
| Routine footage reaches its approved age | Whether deletion works as intended | A verified overwrite or deletion process |
| An identified incident needs preservation | Which limited records require an exception | An authorized preservation reference |
| A clip was exported to another store | Who controls that copy’s access and deletion | A copy owner and retained-purpose record |
Before you move on
- Assign a privacy owner and stated recording purpose.
- Document the retention rationale and preservation process.
- Verify deletion settings and review copies.
A worksheet you can actually use
Start with the blank sheet. Add one row per item, assign an owner and mark anything unresolved as pending. The completed example shows the level of detail to aim for.
Keep completed security plans private. Use aliases; keep passwords, access codes, personal contacts and footage links in your approved systems.
How to fill the worksheet
- Record class
- Separate routine recordings, event material, exports and service records because they may have different purposes and storage systems.
- Purpose
- State why this category is needed, using the organization's actual assessment rather than a generic keep-everything preference.
- Period to approve
- Record the proposed or approved period clearly and do not substitute available disk capacity for a justified retention decision.
- Rationale
- Reference the purpose-based review and applicable advice, preserving uncertainty rather than treating this worksheet as legal approval.
- Deletion owner
- Assign responsibility for implementing and checking the relevant deletion or overwrite behavior, including downstream copies.
- Preservation reference
- Use a controlled reference for an authorized hold or exception, with scope and review conditions under the actual procedure.
A worked example
Fictional policy review: a site discovers incidents only after weekend closure. Its privacy owner assesses that need and records a justified period without treating this example as a prescribed number of days.
| Record class | Purpose | Period to approve | Rationale | Deletion owner | Preservation reference |
|---|---|---|---|---|---|
| Routine gate footage | Site security | Privacy owner decision | Document necessity | IT | Separate authorized process |
Questions readers bring to this task
What else should you know?
Does an incident mean we should keep every camera recording?
Have the authorized owner define the relevant records, period and reason for preservation. A specific incident does not automatically justify extending routine retention across an entire estate. Obtain qualified advice where investigation or disclosure duties affect the decision.
Link to this answer ↗Is thirty days the correct CCTV retention period?
There is no universal period established by this guide. Determine the purpose and applicable requirements for the actual organization and location, then configure and verify the relevant systems. A commonly offered setting or a large disk does not itself justify the period.
Link to this answer ↗Do incident exports follow the recorder's deletion schedule?
Not automatically. An export can become a separate controlled record with its own purpose, owner and retention decision. Identify where it is held and which approved process governs it. Routine recorder overwrite does not prove that every copy has been deleted.
Link to this answer ↗Should retention be checked after changing providers?
Yes, because access, copies, storage locations and deletion mechanisms may change. Review the data flow and responsibilities before assuming the previous decision remains correctly implemented. Include records held by the departing service in the exit process where applicable.
Link to this answer ↗Notes & sources
UK scope only. This planning aid is not legal advice; other countries and specific preservation duties may differ.
Reviewed October 27, 2026. The examples and worksheets are planning aids, not customer results or a statement of contracted service.
- ICO: surveillance data protection principles
UK surveillance guidance on purpose, retention, secure access and transparency. Guidance is under review; check it when making a decision.