CCTV footage retention: how long you can keep recordings

The rule all three countries share

The UK, Italy and Spain start from the same principle: footage is kept only for as long as the purpose it was recorded for requires. Whoever runs the system has to be able to explain why that period was chosen.

Where they part ways is the numbers.

Country	Period set in law	Who decides
United Kingdom	None	The controller, based on purpose
Italy	None in general. Seven days for municipalities, for urban security	The controller, with a justification
Spain	One month at most from recording	The controller, within the legal limit

No number in UK law

The ICO is direct about it. Its video surveillance guidance says the UK GDPR and the Data Protection Act 2018 do not prescribe any minimum or maximum retention period, and that the purpose of the system should determine how long footage is kept.

The guidance gives two warnings that matter on site.

• Storage capacity is not a reason. The retention period should not be set by how much the recorder can hold.
• Neither is “just in case”. The ICO’s own example is footage kept for six months only because the manufacturer’s settings allow it.

Its checklist asks controllers to choose the shortest period they need, write the retention policy down, and check that it is being followed. Footage can be kept longer for a specific purpose, for example when a law enforcement agency investigating a crime asks for it to be preserved.

One caution. The ICO has marked this guidance as under review following the Data (Use and Access) Act. Check the live page before quoting it in a client document.

The 31 days is not a legal rule

The figure of 31 days is often quoted in the UK trade as if the law required it. As a general rule it does not. The exception is a premises licence that writes it in as a condition, covered below.

The figure appears in government guidance on police requirements for CCTV systems, which says only that retention beyond 31 days may be useful in some circumstances. That is operational advice about what helps an investigation. It is not a legal retention period. Nor does it replace the controller’s own decision.

The Surveillance Camera Code of Practice does not help either. Under its sixth principle, the code says it is not possible to be prescriptive about maximum or minimum periods. Relevant authorities in England and Wales, such as local authorities and police forces, must have regard to the code. Other operators are encouraged to adopt it voluntarily.

One deadline does exist. It runs the other way. If someone asks for footage of themselves, a business must usually provide it within one calendar month.

Retention by setting: what the sources say

Only one UK setting comes with a number attached, and it binds only through a licence condition. The other rows give a rule for choosing the period, never the period itself.

Setting	Period in the source	What the source says	Primary source
Councils and public space (England and Wales)	None	Store no more than the purpose strictly requires, and reset the initial period in the light of experience	Surveillance Camera Code, principle 6
Shops and other businesses	None	The shortest period the purpose needs, not one set by recorder capacity or kept just in case	ICO video surveillance guidance
Pubs and licensed premises	31 days in two councils’ model conditions, binding only if written into the licence	Recordings kept for a minimum of 31 days (City of London); images retained for 31 days (Bristol)	City of London model conditions, Bristol pool of conditions
Workplaces	None	A period based on business need, written into a retention schedule the employer can justify (the ICO has marked this guidance as under review)	ICO guidance on monitoring workers
Homes	None	No longer than needed to protect the property, with recordings deleted regularly	Domestic CCTV guidance

The pub row is the one with teeth. A model condition binds only once it is written into a premises licence, and the City of London describes its pool as a source of example conditions, not a standard set. Once the condition is on the licence, ignoring it can be an offence: section 136 of the Licensing Act 2003 makes it an offence to carry on a licensable activity otherwise than in accordance with the licence. Other councils may use a different period, or no CCTV condition at all. Read the licence before you touch the recorder settings in a bar.

For homes, data protection law applies as soon as the cameras capture people outside the property boundary.

Sizing the recorder. Decide the number of days first, then size the disk to match. Our CCTV storage calculator works out the terabytes from the number of cameras, bitrate, recording hours and retention days.

In Italy the controller decides, and 72 hours is a threshold

Italy’s data protection authority gives no single number. The controller sets the period according to context and purpose, and footage should normally be deleted after a few days, preferably automatically.

Two figures are often misread. Both come from the European guidelines on video surveillance, which the Italian authority follows. Seventy-two hours is not a limit. The longer the period, especially beyond 72 hours, the stronger the justification has to be. Twenty-four hours is an example given for a small shop.

Some cases do have a number. Municipalities have seven days by law for urban security, and for blocks of flats the authority considers a period of up to seven days reasonable. In workplaces, cameras need a union agreement or authorisation from the labour inspectorate, and a period written into that authorisation is binding. In February 2026 a restaurant was fined 2,000 euros for, among other breaches, keeping footage for ten days instead of the authorised 24 hours.

Spain writes one month into law

Spain is the exception. Article 22 of its data protection law requires footage to be deleted within one month of recording.

Footage needed to prove acts against people, property or installations is treated differently. It must be made available to the authorities within 72 hours of learning that the recording exists. That is a handover deadline. Not a retention period.

In one enforcement case the Spanish regulator found a company keeping recordings for a year. It was fined 500 euros for the retention breach and 1,500 euros in total.

What to take to site

• Ask the client what the system is for before talking about days.
• For a pub, club or late-night venue, check the premises licence for a CCTV condition first.
• Write the retention period, and the reason for it, into the handover documents.
• Set automatic deletion and check it at commissioning. Factory defaults are not a decision.
• If you set 31 days, be ready to say why that suits this site.
• Agree who can view and export footage, and how a request for footage will be handled within the month.
• For clients with sites abroad, configure each site to its local rule: one month at most in Spain.