There is no fixed legal CCTV retention period in the UK. The GOV.UK guidance for commercial premises says to keep images only as long as your business needs them, and the GOV.UK page on requesting CCTV footage notes that most footage is deleted 30 days after recording. In practice, 30 days is the usual upper limit, and you should only hold footage longer for a specific, documented reason, such as a police request or an active investigation. Whatever period you choose, write down why, because that record is what you will point to if anyone questions it.
What is the CCTV retention period in the UK?
No UK law sets a fixed CCTV retention period. About 30 days is the usual practice, and anything longer needs a reason you can state.
UK GDPR and the ICO give no number. GOV.UK's guidance says to keep images only as long as your business needs them, and its page on requesting CCTV footage says most footage is deleted 30 days after it is recorded.
A worked example, with limits
A government retention of CCTV footage annex advises against holding footage beyond 30 calendar days. It adds that the period can vary by purpose and that deletion should be recorded. It was written for prison establishments, so treat it as a model for a CCTV retention policy, not as a rule for your site. Its prison-specific litigation periods do not carry over to a shop, office or home.
A longer hold needs a specific trigger:
- a preservation request from law enforcement
- an active investigation
- litigation
Export and secure only the relevant clips, then return to your normal overwrite cycle for everything else.
The caveat
Because the ICO sets no number, the period is yours to decide, justify and document. If a regulator or a subject access request asks why you kept footage, "the recorder had space" is not an answer. Work out the period from your purpose first, then size the storage to match.
How long should a home, shop, landlord or sole trader keep recordings?
There is no single UK retention period for CCTV: choose one that matches why you record, and treat 30 days as a common starting point rather than a ceiling. These are our practical suggestions, not statute, because data protection law generally expects you to keep footage no longer than your purpose needs. GOV.UK notes that most CCTV footage is deleted 30 days after it's recorded. A longer period can be justified only where your documented purpose requires it.
Home
A purely domestic camera covering your own property is generally treated differently from one that also captures neighbours' homes or public space. If yours reaches beyond your boundary, read the ICO's domestic CCTV page before settling on a retention period. A household that checks footage promptly often needs only a few weeks, and a shorter period is easier to defend.
Shop or sole trader
A business recording customers, staff or passers-by falls under the ICO's small-organisation CCTV guidance. You will generally need to pay the data protection fee unless an exemption applies. The amount depends on your organisation, so check the ICO's own criteria and current fee tiers rather than assuming.
Write the retention period down as part of your CCTV retention policy, along with why you chose it.
Landlord or HMO communal areas
Hallways, stairwells and bin stores capture tenants and visitors who have no say in being filmed. Treat these like a business system, not a domestic one. Set the period by how quickly complaints or incidents are normally reported, use 30 days as a starting point, and record your reasons if you keep footage for longer. Have a named person responsible for reviewing and deleting it.
How does a retention period translate into NVR storage?
Retention in days is the recorder's usable disk capacity divided by the footage all your cameras write each day.
days of retention = usable capacity ÷ (daily write per camera × number of cameras)
Daily write per camera comes from the stream bitrate on the camera's datasheet and your recorder settings (codec, resolution, frame rate), multiplied by the hours actually recorded. Our hard-drive sizing guide works through the full sums; the logic is all you need here.
The disk should not set your policy
Most recorders overwrite the oldest footage once the disk fills. An oversized drive therefore keeps footage for longer than your documented period, without telling you. GOV.UK notes that most CCTV footage is deleted 30 days after it is recorded, which describes common practice rather than a fixed limit.
Choose the period first, justify it against your purpose, then size the disk to meet it. A large drive such as the Western Digital WD180EMFZ 18TB gives a small system a lot of headroom. Its listing says it is not a dedicated surveillance drive, so check it suits your recorder's workload.
Settings that change the arithmetic
- Motion-only recording: quiet hours write little, so days of retention stretch. If a trigger fires late or misses, you lose the lead-up to an incident unless the recorder's pre-record buffer is enabled.
- Lower frame rate: files shrink, but you may miss the exact frame showing a face, a hand or a number plate.
- Recording the sub-stream: this saves the most space, but its lower resolution weakens identification value if the footage is ever needed as evidence.
How do you set retention on the recorder and write the policy down?
Write the purpose down first, pick a period you can justify against it, set the recorder to match, then document access and deletions. This is general guidance, so adapt it to your site.
- State the purpose in one sentence, for example "deter and investigate theft and criminal damage at the premises".
- Choose the period and justify it against that purpose. If you can't say why you need 28 days rather than 14, the number is a guess.
- Configure the recorder. Check its manual for an overwrite or maximum-retention option. Names and availability differ by brand, so there are no menu paths here. Without a cap, a large disk will quietly keep footage well past the period you stated.
- Confirm the disk can hold it. Put your real bitrate and camera count through the storage formula. A drive such as the Western Digital WD180EMFZ 18TB is a 5400RPM 3.5" SATA unit that is not a dedicated surveillance drive, so it suits small to medium systems. Check your NVR's supported drive capacity in its manual.
- Record who may view and export footage, and how long exports are kept.
- Log deletions, as the government retention annex advises.
What the written policy should contain
- Purpose and lawful basis. The ICO's CCTV guidance says to document the basis, and legitimate interests is the likely one for most private operators.
- The retention period and the reasoning behind it.
- Who has access.
- How requests are handled. GOV.UK says owners must usually supply a person's own footage free of charge within 1 calendar month.
- A review date.
Secure the relevant footage first, then supply it: police requests should generally be met, and a person asking for footage of themselves usually gets a reply within 1 calendar month.
Police requests
GOV.UK's advice is to share images with authorities such as the police if they ask. In practice:
- Stop the overwrite for that time window, so the recorder cannot loop over it.
- Export a copy to removable media.
- Log who asked, when, and exactly what you supplied.
- Keep the original recording until the matter is resolved.
Subject access requests
Under GOV.UK's guidance, a person can ask for footage of themselves in writing or verbally. You must usually provide it free of charge within 1 calendar month, and the requester should give a date, time and ID.
Other people in the frame may need editing out. If your system cannot do that, you may not be able to release the clip, though a viewing is an option if the requester agrees.
When the request lands after the overwrite
GOV.UK notes that most footage is deleted 30 days after recording, so a late request may meet an empty disk. You cannot supply what no longer exists, so say so plainly and record the reply. If the footage is still there, lock it as soon as the request arrives.
