CCTV in Schools UK 2026: Legal Rules and Camera Guidance

Yes, CCTV is lawful in UK schools, but only if the school has a documented purpose and a lawful basis, and handles the footage under data protection law. GOV.UK treats identifiable images as personal data, so the school is responsible for who can see them and how they are used. Entrances, perimeters and corridors are the easier cases to justify. Cameras inside classrooms are much harder to defend, because they need a specific, documented reason that less intrusive measures can't meet. Before you fit anything, agree the purpose, the impact assessment and the viewing rules with the school's data protection officer (DPO).

Is CCTV allowed in schools, and what about classrooms?

Yes, CCTV is lawful in UK schools when there is a documented purpose, a lawful basis, and footage handled under data protection law. GOV.UK's schools guidance treats identifiable images as personal data, so the school, as data controller, carries the duties for recording, storing and sharing them.

The usual purposes are site safety, deterring vandalism and theft, and providing evidence when an incident has to be reviewed. A CCTV school policy should name those aims, ideally camera by camera, so every lens has a reason on paper.

What about classrooms?

Classroom CCTV is not banned outright, but it is the hardest placement to justify. The same data protection rules apply, and the intrusion is greater than at a gate or car park because pupils and staff spend their whole day in front of the lens. This is general guidance, not legal advice.

So if you are asking whether you can have CCTV in classrooms, the answer is yes, but only with a specific, documented reason and after consulting staff and pupils. Some schools do install them, but each camera needs its own justification. Where that reason is weak, cover entrances, corridors and the perimeter instead.

What do UK GDPR and the ICO CCTV guidance require from a school?

A school must run CCTV as a documented data-processing activity: a recorded lawful basis, a DPIA, clear notices, and defined retention and access rules. The ICO's video surveillance guidance is the benchmark for all of it.

• Framework: UK GDPR and the Data Protection Act 2018 apply because cameras capture identifiable people. The Department for Education's data protection in schools guidance has a section on CCTV.
• Lawful basis: choose one and record it in writing, along with the purpose.
• DPIA: complete it before installation or any major change, such as adding cameras or moving coverage.
• Privacy notices: tell pupils, parents, staff and visitors what is recorded and why.

Signage, retention and audio

Signs should say who operates the system, why it records, and who to contact. This guide doesn't prescribe wording or sizes.

No statutory retention period exists. Keep footage only as long as the stated purpose needs, then set and document the period in your CCTV policy.

Leave audio off by default. Sound recording is more intrusive than video and needs its own, strong justification.

Subject access requests

Treat a request for footage as a formal data request and log it on receipt. Ask the requester for a date, time window and location so you can find the clip. Check whether other pupils or adults appear, and mask or redact them before release. Respond within the UK GDPR time limit, and keep a record of what you disclosed.

Who can view CCTV footage in a school?

Only a short list of named, trained roles should view school CCTV footage, each with a logged reason. Footage should not be open to all staff, governors or parents.

In practice, the data controller (the school or trust) names the roles, and each person gets a personal login on the recorder rather than a shared admin password. The access log then shows who looked, when and why. The GOV.UK guidance on CCTV in schools is the starting point for the data protection duties behind this.

Police and other agencies. Treat each request on its merits. Log who asked, what they wanted and the school's decision, whether that is to disclose or to refuse. Export only the relevant clip, not the whole day.

Parents and pupils. A request to see footage of a child is a subject access request. Other people in the frame are third parties, so the footage may need redacting or blurring before release. A parent cannot simply be invited to watch the screen.

Staff monitoring. Cameras installed for safety should not be repurposed for routine performance monitoring. Check your policy against the NEU model policy and checklist, published 20/03/2026, which is the union's benchmark for a school CCTV policy. The extract I could check does not support describing its individual clauses, so read the document itself.

Where should school CCTV cameras go, zone by zone?

Start with entrances, vehicle routes and the perimeter, then add internal cameras only where a documented risk justifies them. The table below is practitioner guidance driven by purpose, not a specification, and the right answer for any site comes from its own risk assessment and DPIA.

Zone	What the camera is for	Placement logic	Privacy cautions
Main entrance and reception	Identifying who enters, supporting visitor control, evidence after an incident	Cover the door and its approach, with the camera facing people as they come in	Reception staff are in view all day, so frame to the purpose; signage at the approach
Vehicle gates and car park	Recording vehicle and pedestrian access, theft and damage	Aim along the gate line and at the bays and exit routes; treat pedestrian gates separately	Avoid capturing public pavement or road beyond what the purpose needs
Perimeter and fence lines	Deterring and recording out-of-hours intrusion	Cover corners, weak points and approaches, with overlapping views so there are no gaps	Neighbouring homes and gardens: use privacy masking
Playgrounds and fields	Vandalism, trespass and misuse outside school hours	View across the open space from a building elevation	Children at play: weigh out-of-hours-only recording
Corridors and stairwells	Reviewing incidents on circulation routes	Junctions, corridor ends and stairwell landings	Everyone passes through daily, so tie coverage to a recorded incident pattern
Cycle stores, plant and bin areas	Theft, tampering and misuse of isolated assets	Aim at the door and access path	Usually low risk, but check the edges of the frame
Internal blind spots	Places where incidents happen out of staff sight	Only where a documented pattern exists; classrooms are not covered by default	Each camera needs its own written justification

The no-go list

• Toilets
• Changing rooms
• Staff rooms

Medical and welfare rooms need special justification before any camera goes in. Classrooms follow the same logic: the question of whether CCTV is allowed in classrooms is answered case by case, never by default. For the wider legal framework, see the GOV.UK guidance on CCTV in schools.

Practical privacy options

Where a camera's view reaches neighbouring homes, privacy masking blocks those areas from the image. For playgrounds, recording only out of hours is another way to narrow the footprint. Weigh both in the DPIA and record why you did or didn't adopt them.

Camera type follows purpose

Camera type is the last decision, not the first. Fix each zone's purpose, whether identifying a face at the door or simply observing an open field, and choose the camera that meets it. That is why a school CCTV package built from a zone list suits the site better than one bought by channel count.

What should a school CCTV policy and compliance checklist include?

A school CCTV policy should cover ten points: purpose, lawful basis, DPIA, camera register, signage, privacy notice, retention, access, requests and annual review. The list below can be copied straight into your policy file.

1. Purpose statement: name the specific problems the system addresses, such as site security or pupil and staff safety, and do not use vague wording like "general monitoring".
2. Lawful basis: record which UK GDPR basis you rely on and why. This depends on the type of school, so confirm it with your data protection officer.
3. DPIA completed: finish it before any kit is ordered, with particular scrutiny of cameras near classrooms, toilets and changing areas.
4. Camera location register: list every camera with its position, field of view, purpose and whether it records audio.
5. Signage in place: put it at entrances and wherever cameras cover, stating who operates the system and how to contact them.
6. Privacy notice updated: cover pupils, parents, staff and visitors.
7. Retention period set: state the period, give the reason for it, and make sure the recorder is configured to match.
8. Named access roles and a viewing log: say who may view live and recorded footage, and log each viewing.
9. SAR and police-request procedure: set out who receives a subject access request or police request, how identities are checked, and who approves disclosure.
10. Annual review: diarise a check of whether each camera still serves its stated purpose.

The policy should be adopted by the governors or trustees, not left as an unsigned site-manager document, and carry a review date. For staff-side expectations, cross-check it against the NEU's CCTV model policy and checklist. The GOV.UK guidance on CCTV in schools is the data-controller reference to keep beside it.

A note on "school CCTV package" searches

A fixed school CCTV package puts the purchase before the decisions that determine what you need. Specify the kit after the DPIA and zone map, then have the school's own electrician or installer fit it, working from each product's datasheet or installation guide.

Even cable is a school-specific choice. LSZH (low smoke, zero halogen) sheathing, which reduces smoke and toxic gas in a fire, is described in product copy as suitable for public buildings such as schools. Ask your installer what the building's fire arrangements require.

Hardware choices sit outside this checklist. The guides on NVR choice, hard drive sizing, PoE switches and bracket fitting cover them.