CCTV recording, storage and access: plan beyond the live picture
A clear live picture does not tell you whether footage is being saved, how long it remains or who can retrieve it. Make recording and access part of the specification before choosing storage capacity. Begin with the reason you need footage and how quickly an incident would normally come to light. Then ask the proposed system to demonstrate that workflow, including deletion and account recovery rather than only successful playback.
Set a retention need before sizing storage
There is no sensible universal retention period for every home or business. Consider the purpose, when you would discover an incident and how promptly you could review it. The ICO's organisation guidance says footage must not be kept longer than needed; its home CCTV guidance also requires regular deletion where data protection law applies. Both pages are currently marked under review following legislative changes.
Do not copy a period from a product advert or another property's policy. Document your reason and review it when circumstances change. If a particular incident requires a clip to be preserved separately, record why, restrict access and decide when to review that copy. Exporting a clip should not mean keeping it indefinitely.
Distinguish capacity from a recording promise
A drive's capacity alone cannot establish the number of days available. Camera quantity, recording quality, frame rate, compression and recording mode affect the storage required. Event-based recording also depends on activity and the device's trigger behaviour. Ask which assumptions underpin an estimate and how the actual history will be checked after commissioning.
Confirm what happens when storage fills. Does the system overwrite older recordings, stop saving or produce an alert? Ask whether reserved clips change available capacity and whether a failed drive or disconnected camera is reported. Recheck the estimate after adding cameras or changing quality settings instead of assuming the original retention estimate still applies.
Map every place a copy can exist
Identify the recorder, any camera memory cards, cloud service and exported clips. An app may display footage from local storage without making a cloud recording; conversely, a cloud feature may require a paid plan. Ask what your chosen package actually stores and what changes after a trial expires or a subscription ends.
For cloud services, review the provider's current privacy information and service terms, including storage locations, access arrangements and deletion. For local recording, consider physical access to the recorder and drives. Test which functions remain during broadband failure. Neither storage location is automatically private or continuously available simply because of its label.
Keep account control understandable
Make sure the owner controls the main account and recovery details. Where supported, give other users their own accounts and only the permissions needed for their role. Agree whether installer access is temporary, how it can be removed and who approves future support sessions. Avoid relying on a shared login whose users cannot be distinguished.
The NCSC recommends changing default passwords where present, enabling two-step verification where available and keeping devices updated. Check the manufacturer's support period and disable remote access if it is unnecessary. These measures reduce some risks but do not guarantee cybersecurity; follow the model-specific instructions and review access when someone leaves the household or business.
Practise retrieval, deletion and recovery
At handover, find a recent recording, check its date and time, play it back and export a short sample using an authorised person's footage. Confirm the exported file opens on the intended device. Learn how to remove unnecessary exports, check automatic deletion and identify recording faults. A working live preview is not an adequate substitute for these checks.
Ask how account recovery works if a phone is lost and what happens when equipment is replaced or sold. Keep recovery instructions somewhere accessible to the owner without exposing credentials. Set a routine review for playback, storage health, permissions and deletion, with checks after significant changes. If someone requests footage about themselves, use the current ICO process rather than sharing an entire unreviewed recording.
Sources and further reading
- ICO: Home CCTV systems — deletion, access and information rights
- ICO: CCTV for your organisation — retention and footage handling
- NCSC: Smart devices — accounts, updates, remote access and disposal
- GOV.UK: Guidance on the use of domestic CCTV — storage and operation
Editorial review: 6 November 2026. This guide is general preparation information, not a technical assessment or confirmed service offer.