A school CCTV system records children, staff, parents and visitors every day. That makes it one of the most privacy-sensitive systems a school runs, and one of the easiest to get wrong. This guide covers where cameras should and should not go, what to do about audio and classrooms, how long to keep footage, and how to handle the requests that schools actually receive, from parents asking to see an incident to the police asking for a copy.
Every organisation that records identifiable people is processing personal data under UK GDPR. Schools carry three extra layers of responsibility on top of that.
None of this makes CCTV in schools unusual or hard to justify. It means the decisions behind the system need to be deliberate and written down.
A common mistake is to copy a commercial CCTV policy that relies on "legitimate interests". Under UK GDPR, a public authority cannot rely on legitimate interests for processing it carries out in performing its tasks. For maintained schools and academies, the usual basis for security CCTV is public task: keeping pupils, staff and premises safe is part of what the school is there to do.
Independent schools are not public authorities, so legitimate interests is normally the right basis for them, supported by a written legitimate interests assessment. Either way, the lawful basis belongs in your CCTV policy and your privacy notice, and it should match.
A Data Protection Impact Assessment is the document that shows you thought about privacy before switching cameras on. A school CCTV system systematically monitors children and staff, which is exactly the kind of processing the ICO expects to see assessed. Treat a DPIA as required, not optional, and revisit it whenever you add cameras, change what they cover or add features such as analytics.
A good school DPIA answers four questions plainly: what problem each camera is solving, why a less intrusive measure would not work, what the risks to pupils and staff are, and what you have done to reduce them. Your Data Protection Officer should sign it off.
Some places carry such a strong expectation of privacy that cameras are almost never justifiable:
Shared washbasin areas outside toilet cubicles are the grey zone. Some schools have cameras there because of vandalism, vaping or bullying. If you are considering it, the case needs to be strong and specific, the DPIA needs to cover it in detail, cameras must never be able to see into cubicles, and you should consult parents and staff first. In many cases a better answer is a camera on the corridor outside, recording who goes in and out.
Classroom cameras are highly intrusive. They record children for most of their day and monitor teachers continuously while they work. Specialist areas such as science labs or workshops with valuable equipment can sometimes be justified out of hours, but routine recording of lessons is very difficult to defend and is opposed by the teaching unions.
Audio recording is more intrusive again. The ICO's position is that recording conversations needs particular justification, and for general school security it is very hard to provide. Many modern cameras ship with microphones enabled. Check that audio is switched off at the recorder, and record that check in your commissioning documents.
Staff must be told about the system, where cameras are and what footage may be used for. The ICO's guidance on monitoring workers expects monitoring to be necessary, proportionate and transparent. In practice that means:
Hidden cameras are only justifiable in exceptional circumstances, such as a specific suspected crime that open measures have failed to address. Covert recording should be authorised at senior level, limited in time and location, supported by a DPIA, and never used in private areas. It is not a tool for general behaviour management. If you think you need it, speak to your DPO first, and consider whether the police should be involved instead.
The ICO does not set a fixed retention period. Footage should be kept no longer than you need it for the purpose you recorded it for, and deleted automatically when that period ends. Many schools settle on around 30 days, which is reasonable for most incidents.
School holidays expose a weakness in that approach. If a break-in happens in the first week of the summer break and nobody notices until staff return six weeks later, a 30-day system has already overwritten the evidence. Two sensible options are a longer retention period over long holidays, documented in your policy, or a simple routine of checking key cameras during the break. Either way, decide in advance rather than discovering the gap after an incident.
When footage is needed beyond the normal period, for a safeguarding concern, a police investigation or an insurance claim, export and preserve the specific clips, record why and on whose authority, and set a review date.
Schools receive four kinds of request. Each needs a different response.
Signs should be visible before people enter a monitored area, name the school as the operator, and tell people where to find more information. Your CCTV policy should be published on the school website and cover the purpose, the lawful basis, which areas are covered, retention, who can view footage and how to request it.
For the wider data protection framework that applies to any CCTV operator, see our guide to CCTV and UK GDPR. Our free CCTV policy generator will produce a draft policy you can adapt.
This guide is general information, not legal advice. Your Data Protection Officer should review decisions about your own system.
We design school CCTV systems with privacy built in: camera positions justified in writing, audio disabled, retention set automatically and access logged. We also review existing systems and tell you plainly what needs to change.
Request a Free Survey →