CCTV Retention for Licensed Premises: What the Law Actually Requires
Thirty-one days, thirty days, or your licence condition plus one. The real CCTV retention rule for UK venues, plus the common traps.
Most UK licensed premises have a 31-day CCTV retention condition on their premises licence. Most operators do not know whether their system actually hits that number, whether the right cameras are covered, or what happens when someone asks for the footage.
This is a field where small mistakes become large fines. The fix is not expensive. It is specific.
What the 31 days actually covers
The typical licensing condition reads something like: "CCTV of sufficient quality to identify a person shall be operated at all times the premises is open to the public. Recordings shall be retained for a minimum of 31 days and made available to Police and Licensing Authority on request."
That one paragraph creates five separate obligations:
- Cameras cover the right areas
- Image quality is good enough to identify a face
- The system records whenever the venue is open
- Recordings are kept for at least 31 days
- Footage can be produced on request
Hit four out of five and you are still in breach.
Why 31 and not 30
It is not arbitrary. 31 days ensures a full month of footage is always available, regardless of month length. A system configured to "30 days" can drop a day of relevant footage simply because February is short.
Check the date your footage actually starts. Systems set to "30 days retention" often end up holding 27 or 28 days of genuinely accessible recording, because the oldest day is already being overwritten.
The GDPR layer
CCTV is personal data. Keeping it is lawful under UK GDPR only where you have a proper basis. For licensed premises that basis is usually a combination of:
- Legitimate interests (crime prevention, public safety)
- Legal obligation (a specific licensing condition)
What that means in practice:
- You need signage. "CCTV in operation. Recording. Operated by [company]. Data controller contact [email]." Clear, visible, at every entrance.
- You need a policy. Who can access footage, under what circumstances, who logs each viewing.
- You need a retention schedule. 31 days by default. Longer only if you have a specific legitimate reason (active incident, police request, civil matter).
- You need a route for subject access requests. A customer can ask for a copy of footage of themselves.
The common traps
Camera coverage
Licence conditions usually specify "entrance, bar areas, dance floor". Some venues install cameras that technically cover those areas but are mounted too high, lit badly, or have the wrong lens. Image quality has to be good enough to identify a face.
Walk your premises with the licensing officer's eyes. Would a reasonable person looking at the footage be able to identify someone at the bar, at the entrance, on the dance floor?
Opening hours coverage
"Whenever the premises is open" includes bank holidays, private functions, and the 30 minutes before doors when staff are setting up. If your system shuts down on Mondays because you are closed, confirm that Monday is actually your non-open day.
Footage on request
A police officer asks for CCTV of a named individual on a specific night. How long does it take you to pull that footage?
If the answer is "we call our installer and they come on Tuesday", you have a problem. Someone on site needs to know how to export footage within 24 hours of a reasonable request.
The subject access request
A customer writes in asking for CCTV of themselves from a specific night. You have one month to respond. You must:
- Produce the footage if you still have it
- Blur or redact anyone else visible (this is the expensive bit)
- Provide it in a portable format
If your system cannot export a clip with redaction, you will end up paying a third-party firm by the hour.
A short compliance check
- Footage goes back 31 days. Check the actual oldest file, not the config setting.
- All required areas are covered. Print your licence. Walk the cameras. Tick each area.
- A named person can pull footage within 24 hours. Named, trained, and with current credentials.
- Signage is at every public entrance. Not in the toilets. Not behind a plant.
- A written CCTV policy exists. It names the data controller, the retention period, and the request route.
- Subject access requests have a route. An email address on the signage that reaches someone who responds.
Holocron tracks your CCTV compliance alongside your licence conditions. The 31-day retention check is a scheduled task. Subject access requests have a workflow. Every police or licensing request is logged against the incident it relates to, with a clear chain of custody.