CCTV laws for schools
Cameras in a school are a data-protection decision before they are a security one. Here is what is actually required.
There is no CCTV law. There is data protection law.
That distinction explains most of the confusion.
Schools sometimes look for “the CCTV regulations”. There are none as such. Cameras in a school are governed by UK GDPR and the Data Protection Act 2018, because footage of identifiable people is personal data. The ICO’s video surveillance guidance is the practical reference.
Public authorities in England and Wales also have regard to the Surveillance Camera Code of Practice, and many schools treat it as the standard whether or not it strictly binds them.
None of this makes school CCTV difficult. It makes it something you have to decide deliberately and write down, which most schools have not done for a system installed years ago.
In practice
If you have these, you are in a defensible position. If you do not, that is the gap.
- A lawful basis, written down. For a school this is normally public task or legitimate interests, and the reasoning should be recorded.
- A DPIA. The ICO expects one for surveillance of this kind, and a school system will almost always meet the threshold.
- Signage at every entrance and in monitored areas, saying who is recording, why, and how to contact you.
- A retention period, decided and actually applied rather than left at whatever the recorder defaults to.
- A list of who can access footage, at what level, reviewed periodically.
- A subject access process, including how you redact other people before disclosing.
The absolute lines
These are not judgement calls.
Toilets
No. Not the cubicles, not the wash area in a way that identifies who entered. Use an environmental sensor instead.
Changing rooms
No, in any configuration.
Boarding accommodation
External doors and entrances only. Never living space.
Overlooking neighbours
Capturing a neighbour's garden or windows brings their rights into scope and is the most common complaint we see.
Six of them, answered
Can we use CCTV for staff performance?
Not without being extremely careful. Covert or performance monitoring of staff is a different purpose from security, and using a security system for it undermines the basis you set out.
Can parents see footage of their child?
They can make a subject access request. You must respond, and you must protect other children in what you disclose — usually by redaction.
Can we share footage with the police?
Yes, on a proper request and with a record of what was shared and why. A logged link is better than a memory stick.
Do we need to tell pupils?
Yes. Transparency applies to children, and age-appropriate information is expected.
What about audio?
Recording conversations is considerably more intrusive than video and rarely justified in a school. We would default to audio off.
Can we point a camera at a gate on the public highway?
Capturing beyond your boundary is possible but must be justified and minimised, and it belongs in the DPIA.
A short catch-up exercise
Most schools we survey have the system and not the paperwork.
- 1
List what you have
Cameras, positions, what each one is for.
- 2
Remove or repoint the indefensible ones
Anything covering a toilet entrance in a way that identifies individuals, anything overlooking a neighbour.
- 3
Write the DPIA
Short and specific beats long and generic.
- 4
Set the retention period
And check the system is actually applying it.
- 5
Fix the signage
It is the cheapest item on this list and the most commonly missing.
- 6
Review access
Who has a login, at what level, and whether any of them have left.
Three placements, and how each one reads in a DPIA
Questions this raises
Is a DPIA legally required?
How long can we keep footage?
Sources
Everything on this page is taken from these. Checked 25 September 2026.
Start with a survey, not a quotation.
We walk the site, look at what you already have, and tell you what would genuinely help — including where the answer is that you do not need anything.
Book a free site survey Call 01727 822 833