A policy will help you use your video surveillance (or CCTV) system consistently. The policy should set out the purposes for which you are using video surveillance and how the information collected will be handled, including guidance on its disclosure and recording. It is good practice to assign operational responsibility for the video surveillance system to qualified staff. This staff should ensure that your company sets standards, has procedures in place, and that the system complies with regulatory requirements including data subjects' access rights.

You must be aware that data subjects have the right to request a copy of their own image and be prepared to handle such requests. This right applies to both staff and customers.

Draw up a clear policy to help you manage requests effectively. Requests can be made verbally or in writing, so your policy should include procedures for accommodating any requests received verbally.

You must provide the information without delay and at the latest within one month of receiving the request.

A data subject should not have more difficulty requesting their data when it comes to an image than a paper document or digital file. Providing information in a timely manner is important, particularly if you have established a retention period whose duration conflicts with the response period set out in the legislation. In such circumstances it is good practice to suspend the deletion of the information.

When handling data subjects' personal data requests, you should carefully consider third-party data, just as you would if they were mentioned in a paper document or digital file subject to a request.

Keeping an accurate record of the access requests you receive and how you handle them will help you manage them better and deal with any challenges to how you handled them.

You should not provide images to third parties other than law enforcement agencies to assist them in detecting or preventing a crime. You should have a procedure in place to allow you to do this as quickly as possible.

Inform all relevant staff of existing policies and procedures regarding the video surveillance system and train them where necessary. For example:

• all staff authorized to access the cameras must be familiar with the system and the procedures for reviewing and extracting footage if necessary.
• all staff should be familiar with the procedures for collecting and handling personal data requests.
• all staff should know the disciplinary actions for misuse of cameras.
• where a staff member's role explicitly includes monitoring CCTV, for example a security guard, ensure you meet and document appropriate training standards.

You should retain data for the minimum time necessary for its purpose and dispose of it appropriately when it is no longer needed. The retention period should not be based solely on the storage capacity of the system, but reflect how long the data is actually needed.

You may need to retain information for a longer period if a law enforcement agency is investigating a crime and asks you to keep it, to give investigators the opportunity to view the information as part of an ongoing investigation.

You should delete data when it is no longer necessary to keep it, for example if you do not achieve the purpose for which you are collecting and storing it.

You must implement checks including:

• documenting your information retention policy for data collected by the video surveillance system and ensuring it is understood by those who manage the system.
• putting measures in place to ensure data is permanently deleted using secure methods at the end of the retention period.
• performing systematic checks to ensure you are actually complying with the retention period. Furthermore, very long retention periods can affect the quality of footage captured with modern cameras that record images onto hard drives.

You should choose a system that produces clear, high-quality images that law enforcement can use for investigations.

One way to achieve this is to place CCTV cameras in the best possible location. For example, pay attention to the growth of trees and plants or other obstacles that could interfere with the cameras' line of sight.

You should also perform regular checks to ensure the system continues to produce high-quality images. Ensure that system settings do not compromise quality. For example, on a digital system, make sure the overwrite cycle is not too long, as the system will automatically change the resolution, degrading footage quality to guarantee compliance with the set recording time.

You must sufficiently protect all information to ensure it does not fall into the wrong hands.

Poor security can lead to camera footage being viewed by criminals or controlled remotely by them for use in botnets (a network of computers or other devices infected with malicious software and controlled externally as a whole without the legitimate owners' knowledge).

Security precautions should include technical, organisational, and physical security. You should:

• protect wireless transmission systems from interception.
• limit the ability to view or make copies of data to authorized personnel only.
• locate and allocate a secure place to store footage.
• train staff on security procedures and inform them of the penalties for misuse of the video surveillance system.
• establish appropriate controls if the system is connected to or made available over a computer network. Internet Protocol (IP) network cameras must be protected by firewalls and routers and default passwords must be changed.
• promptly apply any software updates, particularly security updates, published by the equipment manufacturer. Manufacturers of IP network cameras publish security advisories and fixes to security problems, and users should always keep them up to date by applying patches similarly to their other IT equipment.
• protect footage recorded by CCTV cameras, whether magnetic tapes or hard drives, from access by any unauthorized person, regardless of whether it is an unauthorized staff member or an outsider to the company.
• store all collected data securely, for example by using encryption or another appropriate method to restrict access to the information.

You should display notices indicating that the video surveillance (CCTV) system is in operation. Where it is not obvious who is responsible for the system, you must ensure that contact details are displayed on the signs.

You should place signs of the right size and position so that anyone is aware they are being watched and receives as much warning as possible. Such transparency can also have a deterrent effect in itself.

You should provide a brief description of the use of the CCTV system and its purposes on your website, where applicable.