If a communal CCTV system records identifiable people, the organisation that decides why it is used and how it works is the controller under UK GDPR, and is legally responsible for compliance. In a block of flats that is usually the freeholder, the residents' management company or the right to manage company, sometimes acting jointly with the managing agent. The controller needs a documented lawful basis, a data protection impact assessment (DPIA) in most cases, clear signs, a retention period based on purpose, restricted access to footage, and a process for police requests and subject access requests.
The ICO says that a controller processing images of identifiable people must register with it and pay the data protection fee unless exempt. If the cameras came with the building, check who registered, if anyone, and whose name is on the signs.
Who is the controller, and who is the processor
The ICO describes the controller as the organisation that decides what is recorded, how it is used and to whom it may be disclosed. Where two organisations make those decisions together they are joint controllers. An installer or maintenance contractor that only acts on instructions is normally a processor, and the ICO expects a written contract setting out its responsibilities. Write down who holds which role before anyone needs to answer a request for footage.
Start with a DPIA and a lawful basis
The ICO says a DPIA is a legal requirement for processing likely to result in a high risk to individuals, and that this applies in most cases involving video surveillance. It should be done before cameras are installed or changed, describe the purpose, test whether the cameras are necessary and proportionate, and record the risks and how they are reduced. If you decide a DPIA is not needed, record why.
For most private operators, the ICO expects the lawful basis to be legitimate interests, supported by a legitimate interests assessment. It notes that genuine consent is hard to obtain from people walking through a monitored area, so consent is rarely the right basis. The ICO also asks controllers to consider whether a less intrusive option, such as better lighting or a door entry upgrade, would achieve the same result.
Seven checks for an existing system
- Camera views: each camera covers only what the purpose needs. The ICO gives the example of a camera that could see into a nearby flat being adjusted to avoid the intrusion, and asks operators to avoid capturing private land or people not visiting the premises.
- Live streaming: in an ICO example about a block of flats, streaming live footage of corridors and entrances was found to be unjustified and outside residents' reasonable expectations. Treat resident-facing live feeds with real caution.
- Audio: the ICO says audio recording is difficult to justify and should be switched off by default. If a camera has a sound facility you do not need, disable it.
- Signs: clearly visible signs before people enter the camera's view, stating that CCTV is in operation, why, who operates it and how to contact them. A notice on a website alone is not enough.
- Retention: the law sets no fixed period. Keep footage for the shortest time your purpose needs, and do not keep it for months simply because the recorder allows it. Hold specific footage longer only when, for example, police ask you to preserve it.
- Security: access to footage limited to named people, viewing in a private area, copying restricted, passwords managed, footage encrypted where necessary and security updates applied to the recorder and cameras.
- Review: the ICO expects a periodic review of whether the system still achieves its purpose, and processing to stop until the system is changed if it does not.
Requests for footage
Police requests
The ICO says disclosure to law enforcement is usually appropriate where the system exists to help prevent and detect crime, but unless a court order applies it is normally voluntary and the decision rests with the operator. Record the date, what was disclosed and to whom, and send it securely. Once disclosed, the recipient becomes the controller of its copy. Posting footage online to identify someone is unlikely to be appropriate.
Subject access requests
Anyone recorded can ask for a copy of footage of themselves. The ICO says you must respond promptly and within one month, extendable by two further months if the request is complex or one of several from the same person. In most cases you cannot charge a fee. Other people in the footage will usually need to be blurred or edited out, and you should document your decision where that is not possible. Because many recorders overwrite automatically, find and save the footage as soon as a request arrives.
What about the Surveillance Camera Code?
The Surveillance Camera Code of Practice, with its 12 guiding principles, applies to relevant authorities such as councils and the police in England and Wales. Other operators are encouraged to adopt it voluntarily, and the code describes doing so as best practice. For a residential block, UK GDPR and the Data Protection Act 2018 set the legal duties; the code is a useful standard to work towards. The ICO notes that its CCTV guidance is under review following the Data (Use and Access) Act 2025, so check the current version before relying on any detail.
How Apex helps
We survey existing CCTV, door entry and access control systems, check camera views, audio settings, retention and user accounts on the recorder, and fix what needs fixing, including the network the system runs on. Ongoing maintenance and access records sit under security and access control, and the recorder and remote access can be kept patched as part of cybersecurity and compliance. We do not give legal advice: the controller remains responsible for its DPIA and policies, and specialist data protection advice is worth taking for complex sites.
Sources
- ICO, CCTV for your organisation: things you need to do
- ICO, How can we comply with the data protection principles when using surveillance systems?
- ICO, What are our responsibilities in terms of accountability?
- ICO, Governance (post-deployment)
- ICO, Subject access request advice
- GOV.UK, Amended Surveillance Camera Code of Practice