DPIAs and retention
Two questions every school gets asked eventually, and the two most schools cannot answer.
The honest way to decide
There is no legal number, which is why everyone wants one.
UK GDPR says keep personal data no longer than is necessary for the purpose. For school CCTV that means: how long does it typically take for an incident to come to light?
In practice, most schools find that incidents surface within a few days — a theft noticed the next morning, a fight reported that afternoon, a car park bump reported at pick-up. A small number surface later, typically safeguarding matters and insurance claims.
That leads most schools to around 30 days as a default, with a documented process for exporting and separately retaining footage relating to a specific incident. Thirty days is defensible; a year of everything is not, and it also costs more in storage.
A framework you can put in a DPIA
| Consideration | What to write down |
|---|---|
| Purpose | Why you have cameras at all — specific, not 'security' |
| Typical discovery time | How long incidents actually take to come to light at your school |
| Exceptions | Safeguarding and insurance matters, and how those are exported and held separately |
| Storage reality | What the retention period means on the models installed, at the quality set |
| Deletion | That it happens automatically, and how you know it does |
| Review | When you will revisit the decision |
What a school one should cover
It does not need to be long. It needs to be specific to your site.
What you collect and where
A camera schedule with a purpose against each position — not 'the site'.
Who it affects
Pupils, staff, visitors, contractors, neighbours. Children get particular weight.
Necessity and proportionality
Why a camera rather than something less intrusive, position by position.
Risks and mitigations
Access control, retention, signage, staff training, and what happens on a subject access request.
Who should be able to look, and at what
The part that is usually wrong.
- Named accounts only. A shared login destroys the audit trail that protects you.
- Separate viewing from exporting — many staff may need to look, very few need to take a copy.
- Live view and historic review are different permissions, and should be.
- The DPO or a senior leader should be able to see the audit log of who viewed what.
- Review the access list termly, and remove leavers on the day.
- Record the reason for any export, not just the fact of it.
What the DPIA is actually describing
Sources
Everything on this page is taken from these. Checked 25 September 2026.
Start with a survey, not a quotation.
We walk the site, look at what you already have, and tell you what would genuinely help — including where the answer is that you do not need anything.
Book a free site survey Call 01727 822 833