CCTV and Surveillance Camera Policy

How CAT LAB uses CCTV and similar surveillance technology, and how that data is managed.

CCTV and Surveillance Camera Policy

Policy statement

The University of Westminster's Creative and Advanced Technologies Lab (CAT LAB) is located at 35 Marylebone Road, London NW1 5LS.

CAT LAB is committed to ensuring that Closed-Circuit Television (CCTV) and similar surveillance technology is used appropriately in the Lab to promote safety and to prevent and detect crime, and is managed in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Negligent or malicious non-compliance with this policy may be dealt with through the disciplinary process.

Related documents

The ICO CCTV Code of Practice is the University's legislative guide for our use of these systems. We also have regard to the Surveillance Camera Code of Practice issued under the Protection of Freedoms Act 2012, which, while binding only on English and Welsh police forces and local authorities, provides useful principles for all users of CCTV.

Responsibilities

  • The University Senior Information Risk Owner (SIRO) has overall responsibility for ensuring compliance with this policy. This role is currently undertaken by the University Secretary and COO.
  • The CAT LAB CCTV System Owner has management oversight of CAT LAB's use of CCTV and similar surveillance technology in that location.
  • The CAT LAB Director has day-to-day responsibility for ensuring compliance with this policy, and for advising the University on the operation of the CCTV system.
  • The Information Compliance Manager has responsibility for advising the University on data protection matters and meeting data subjects' rights.
  • All colleagues are responsible for understanding and complying with relevant policies and procedures for securing the University's information assets, and for immediately reporting any event or breach affecting those assets.

Purposes of our CCTV

CAT LAB uses CCTV on its premises for the purposes of:

  • The health and safety of staff, students and visitors in all areas of CAT LAB
  • The prevention and detection of crime
  • Formal cases of alleged misconduct
  • The settlement of insurance claims

CCTV will not be used for the ongoing monitoring of staff performance and timeliness. The CCTV system will not be used for covert surveillance.

Governance

Any new use, or substantial extension of the use, of CCTV or camera-based surveillance technology will be subject to a Data Protection Impact Assessment, in particular considering the necessity and proportionality of its use.

Siting and coverage of surveillance cameras is kept under review to ensure the system is effective while minimising intrusion and impact on the privacy of staff and visitors.

Operation of the CCTV systems is documented in a procedures manual detailing appropriate use and management, and the CAT LAB Director and all staff with direct access to the system receive appropriate training.

Operation of the CCTV systems is subject to daily routine checks by the CAT LAB Director or their deputy to ensure correct operation and appropriate image quality. All CCTV systems are subject to annual review by the CAT LAB CCTV System Owner and the Information Compliance Manager to assure the University that they remain necessary, proportionate and fit for purpose.

Any external suppliers providing CCTV services are subject to a written UK GDPR-compliant contract, with the Information Compliance Manager providing guidance on data protection.

Appropriate and visible signage is displayed in CAT LAB on the use of surveillance cameras, with the contact details for the CAT LAB Security Manager clearly visible.

Our use of CCTV and surveillance technologies is included in our Records of Data Processing Activity (under Article 30 of the UK GDPR) and in our data protection Privacy Notices.

Retention of CCTV images

CCTV footage is securely deleted after 28 days. Where CCTV footage has been captured for use in investigating or reporting an incident, the extracted footage is retained securely as part of the relevant record for the appropriate period.

Access to surveillance images

All operational requests from within the University to access CCTV images are forwarded to the CAT LAB Director for consideration, in liaison with the Information Compliance Manager, and all decisions are documented.

Police requests for access are dealt with by the Information Compliance Manager, with the assistance of the CAT LAB Director, and are considered on receipt of an appropriate written request. Contact dpa@westminster.ac.uk.

Subject access requests, and other rights requests from individuals for their own CCTV images, are forwarded immediately to the Information Compliance Manager to be dealt with under the Data Protection Policy. Contact dpa@westminster.ac.uk.

All other third-party access requests (from insurance companies, lawyers and others) are forwarded to the CAT LAB Director for consideration, and decisions are documented.

Security

Access to CCTV controls and monitors, and to the servers and media containing surveillance images, is appropriately secured through encryption of devices and media, firewall protection of the servers, user-account access controls, and physical security for the control area. The system is secured against hardware attack and backed up appropriately.

Contact

If you have any questions about this policy, please contact:

CAT LAB Director Dr David Scott, CAT LAB, University of Westminster 35 Marylebone Road, London NW1 5LS d.scott@westminster.ac.uk

Last reviewed: July 2026.