cctv

Schools and Education Settings CCTV - legal-compliance (2026)

Published on

Schools and Education Settings CCTV - UK legal requirements and GDPR compliance 2026

Operating CCTV in schools and educational settings is highly regulated and requires careful adherence to UK law, primarily the Data Protection Act 2018 and GDPR. Before installing any system, you must conduct a thorough Data Protection Impact Assessment (DPIA) to ensure proportionality and necessity. The fundamental principle is that CCTV must only be used for legitimate purposes, such as deterring crime or safeguarding students, and never for general surveillance.

GDPR

The General Data Protection Regulation (GDPR) dictates that any processing of personal data, including video footage, must have a lawful basis. In a school setting, this often falls under "legitimate interests" or "public task." You must be able to demonstrate that the surveillance is strictly necessary and that less intrusive measures would not suffice. Data subjects (students, parents, staff) must be informed of the collection, use, and storage of their personal data.

ICO rules

The Information Commissioner's Office (ICO) provides explicit guidance for educational institutions regarding CCTV usage. They emphasize that the use of CCTV must be proportionate to the risk being mitigated. Footage must never be used for disciplinary action or general monitoring of behaviour, unless strictly necessary and recorded according to policy. Organisations must register and understand their obligations under the UK's data protection framework to avoid major penalties.

Signage

Clear and visible signage is a mandatory requirement across all monitored areas. The signage must inform individuals that CCTV is in operation, state the purpose of the surveillance, and identify the organisation responsible for the system. Furthermore, the signage must detail who the data controller is and how individuals can exercise their data subject rights. Poor or absent signage is often cited by the ICO as a breach of compliance.

Data retention

The law requires that video footage is not kept indefinitely. You must establish and adhere to a strict, documented data retention policy. Generally, footage should only be retained for the minimum period necessary to fulfill the stated purpose, often ranging from 24 to 72 hours, unless specific incident investigation requires a longer period. Once the retention period expires, the data must be securely and permanently deleted.

Employee privacy

Staff privacy rights must be given the same consideration as student privacy. While the focus is often on safeguarding students, CCTV monitoring must respect staff working areas and private conversations. Monitoring should be limited to common areas and entry points, and staff members must be explicitly included in the CCTV policy and training. Employees must be fully aware of what is being recorded and why.

Penalties for non-compliance

Failure to comply with UK data protection laws, including GDPR and ICO guidelines, can result in severe financial penalties. The ICO has the power to issue fines that can reach up to £17.5 million or 4% of global annual turnover, whichever is higher. Beyond financial penalties, non-compliance can lead to reputational damage, civil lawsuits, and mandatory operational changes imposed by the ICO.

For compliant installation and expert advice on mitigating risk, please contact us: Phone: 07830 638 337

Resources and further reading: Pillar Guide: https://cctvsystems.notion.site/35f5b433f5b5819cb393f393f9ebc371

Developer Resources: GitHub: https://github.com/gazpearce/gary-ai-assistant

Gary Pearce | 07830 638 337 | https://github.com/gazpearce/gary-ai-assistant