Short answer: there is no universal 30-day rule for commercial CCTV. The organisation responsible for the system should define why it records, choose the shortest routine retention period that meets that purpose, document the decision, configure the system to apply it and review whether the period still works. Footage preserved for a particular incident should be handled separately, with a named owner and a review or deletion date.
A warehouse, office, construction site or vacant property may have several cameras and different operational needs. That does not mean every recording should be kept for the same period or for as long as the recorder allows. A clear retention process helps facilities, security and privacy teams avoid both premature overwriting and unnecessary storage.
Start with the purpose, not the storage capacity
The Information Commissioner’s Office guidance on surveillance systems says that UK data-protection law does not prescribe a particular minimum or maximum retention period. The purpose of the processing should determine how long the information is needed. The period should not be chosen simply because a recorder has enough capacity or a manufacturer supplied a default setting.
Write down the specific purpose of each system or camera group. Examples might include investigating reported unauthorised access, supporting the management of vehicle movements or protecting an unoccupied building. Avoid a vague “just in case” reason. If a purpose cannot be explained clearly, it is difficult to justify a retention period for it.
The government’s commercial CCTV guidance likewise says businesses should keep images only as long as they need them. The amended Surveillance Camera Code of Practice explains that periods will vary with purpose and should be reviewed rather than based on rare exceptional cases.
Ask operational questions before choosing the period
A useful review brings together the system owner, facilities or property management, security operations and the organisation’s privacy lead. Consider:
- How quickly are incidents normally reported or discovered?
- Are some areas visited only periodically, such as parts of a vacant property?
- Who checks alarms, access-control events or delivery disputes that may point to relevant footage?
- Are there contractual, insurance or sector-specific requirements that have been confirmed for this site?
- Can the system reliably find, preserve and export a defined clip before routine footage is overwritten?
- Do different cameras have genuinely different purposes that justify separate settings?
These questions do not produce a standard answer for every premises. They help the responsible organisation select a proportionate period and record why it is suitable. If a requirement is said to come from a contract, insurer or regulator, verify the actual wording rather than repeating a customary number.
Separate routine recording from incident preservation
Routine footage and footage retained for a known incident are different records. When an incident is reported, an authorised person may need to preserve the relevant period before the routine cycle overwrites it. The preserved material should have a documented reason, restricted access, an owner and a review point. Retaining one relevant clip does not justify extending the routine period for every camera.
Preservation should follow the supported system process. Do not change recorder clocks, disconnect storage or make informal phone recordings of a playback screen. Our guide to CCTV footage requests after an incident separates preservation, retrieval and disclosure so that one action is not mistaken for authority to perform another.
Record enough information to locate the material without circulating unnecessary operational detail: the incident reference, approximate time range, authorised operator, cameras selected, preservation date and next review. If law enforcement or another authorised recipient requests footage, follow the organisation’s disclosure process and verify the request through an established channel.
Make the recorder follow the written policy
A policy is ineffective if the equipment does something different. During commissioning and periodic review, confirm the actual overwrite behaviour, available storage, image quality, clock accuracy and whether a fault could silently shorten the usable period. Test the retrieval process with authorised sample material rather than waiting for a serious incident.
Changes to resolution, frame rate, camera count or analytics can alter storage use. A site expansion or recorder replacement should therefore trigger a retention check. Our commercial CCTV handover checklist covers ownership, time settings, recording, exports, access and maintenance before a system is accepted.
Where the system cannot reliably apply the chosen period, record the gap and arrange competent technical support. Do not compensate by giving more people administrator access or by creating uncontrolled copies.
Control viewing, exporting and deletion
Retention is part of wider information governance. Limit access to people who need it for an agreed role, use individual accounts where the system supports them and review permissions when staff or contractors change duties. Keep exports in an approved location rather than on personal devices or informal messaging services.
Deletion should be secure and consistent with the documented schedule. Include exported clips, local downloads and temporary working copies in the process; deleting only the recorder’s routine footage may leave uncontrolled duplicates elsewhere. If a legal hold, investigation or other valid reason requires longer retention, record the scope and revisit it when that reason ends.
Put responsibilities into the security brief
Before guarding or monitoring begins, state who owns the CCTV system and who may view, preserve, export or disclose recordings. A security officer who notices an incident may be responsible only for reporting it. Access to a monitor or login does not by itself create authority to change retention settings or release footage.
The brief should also name the route for out-of-hours decisions, system faults and urgent preservation requests. Keep technical credentials and camera coverage details in controlled records, not in a general shift log or public-facing instruction.
A practical retention review checklist
- Define and document the purpose for each system or camera group.
- Choose the shortest routine period that meets the evidenced operational need.
- Verify that recorder settings and storage behaviour match the decision.
- Separate incident preservation from routine footage.
- Restrict access and record authorised exports and disclosures.
- Set review dates for the policy, preserved clips and user permissions.
- Reassess after equipment, layout, operating-hours or risk changes.
- Securely delete footage and copies when their purpose has ended.
Retention decisions are site-specific and should be reviewed with the organisation responsible for the recordings and its privacy adviser. This article is general operational guidance, not legal advice.
If you are reviewing CCTV alongside guarding, K9 security or access control, see our security services and send the site postcode, required duties and operating context. Enquiries are considered individually according to the site, scope and feasibility; do not send footage, passwords or sensitive access information in an initial enquiry.
Featured image: an illustrative surveillance-camera photograph from the site’s media library. It does not depict a K9 Security Services installation, client premises or incident footage.