Doberman

How long businesses keep CCTV footagewhere 31 days comes from, and what your licence really says

No UK statute sets a CCTV retention period for any sector. The 31 days businesses keep hearing about comes from licensing and police model conditions, imposed premises by premises. Here is what those documents actually say.

The quick answer

The number that actually appears in UK documents is 31 days, not 30, and it is not a law. It comes from the model conditions licensing authorities and police forces publish for licensed premises, and it is imposed premises by premises. Statute sets no retention period for CCTV in any sector at all. So the useful question for a business is not how long am I required to keep it but what does my licence say, and what period can I justify.

What this guide covers

  • Where 31 days comes from, and why it differs from the 30 everyone quotes.
  • What licensing conditions actually say, quoted from the published documents.
  • Why two authorities can require different things from identical pubs.
  • The immediacy duties that catch businesses out more often than retention does.
  • Why buying a bigger drive can make you less compliant, not more.
  • How to set and defend a retention period for your own premises.

This is general guidance for businesses, not legal advice. Retention sits under UK data protection law and can be tightened by a sector regulator or a licence condition, so check your own premises licence and the current ICO guidance, or take advice, before you rely on any period here.

What the documents actually say (scan this first)

Every row below is quoted from a published source. The third column is the one that matters, because most advice on this subject presents conditions and habits as though they were law.

Any sector, by statute

Documented period
No minimum and no maximum
What kind of rule it is
There is no law. Purpose sets the period and it must be the shortest that serves it

Licensed premises, Westminster

Documented period
Minimum 31 days, and must record continually while open
What kind of rule it is
Premises licence condition, applied case by case

Licensed premises, City of London

Documented period
Minimum 31 days, plus last 2 days viewable immediately on request
What kind of rule it is
Premises licence condition, applied case by case

Licensed premises, Essex Police model

Documented period
Minimum 31 days. No continual-recording requirement
What kind of rule it is
Police model condition, explicitly not applied as standard

Licensed premises, Dyfed-Powys Police

Documented period
31 days before over-recording, quality set to need not to storage
What kind of rule it is
Police guidance for licensed premises

What police say they want generally

Documented period
Beyond 31 days can help, but not at the cost of recent quality
What kind of rule it is
Government guidance, not a requirement

What the public is told

Documented period
Most footage deleted 30 days after recording
What kind of rule it is
GOV.UK rule of thumb for people requesting footage

By the Doberman install team

CCTV system designers & installers, Leicester

Last reviewed September 2026

Where the 31 days comes from

Ask around and you will be told CCTV is kept for 30 days. Read the documents and the figure is 31. The gap is small and it tells you something useful about where each number came from.

Thirty is the public-facing figure. GOV.UK, advising people who want a copy of footage of themselves, says most CCTV footage is deleted 30 days after it is recorded. It is a rule of thumb for requesters, telling them roughly how long they have.

Thirty-one is what appears in the conditions businesses are actually held to. Westminster City Council's model conditions require recordings stored for a minimum period of 31 days. The City of London requires recordings kept available for a minimum of 31 days. Essex Police's model condition requires recordings kept for a minimum period of 31 days. Dyfed-Powys Police require a system capable of recording and retaining 31 days of images before over-recording. Government guidance on police requirements refers to retention beyond 31 days as the thing that may sometimes be useful.

The logic is straightforward once you see it. An incident reported a calendar month after the event has to still be there, and the longest month is 31 days. Thirty would lose you the first day of a January incident reported on the last day of the month.

For the general question of how long footage lasts on any given system, and what sets that number, see our guide to how long CCTV footage lasts. This page is about what a business is expected to hold, and why.

No statute sets a retention period. Something else does

It is worth being precise about the hierarchy, because almost every article on this subject blurs it and businesses end up complying with the wrong thing.

UK data protection law prescribes no minimum and no maximum retention period for surveillance systems. What it does instead is set a test: the purpose of your processing determines the period, and the period should be the shortest one that serves that purpose. The regulator adds a pointed example, which is that footage should not be kept for six months merely because the manufacturer settings allow it. A default is not a justification.

Above that sits whatever is written on your premises licence, if you have one. That is not law in the general sense, it is a condition attached to your individual licence, and it binds you specifically. Below it sits industry habit, which binds nobody but explains most of the numbers people quote at each other.

So there are three different kinds of thing in play and only one of them is enforceable against you in particular. Knowing which is which is the whole job.

If you want proof that no standard period exists, put two licensing conditions side by side. Westminster requires recordings stored for a minimum of 31 days. Transport for London requires CCTV in taxis and private hire vehicles to overwrite automatically so images are retained for a maximum of 28 days, with longer only in exceptional circumstances such as an insurance claim or a criminal investigation. Same legal mechanism, opposite direction: one sets a floor, the other sets a ceiling. Both are correct, because both follow from a different purpose.

Need a system that holds what your licence requires?

Doberman sizes commercial systems to a retention target you have to meet, rather than to whatever the drive happened to come with.

Pubs, bars and licensed premises

This is the sector with real, written obligations, so it is worth quoting them rather than summarising.

Westminster's model condition MC01 requires that the CCTV system shall continually record whilst the premises is open for licensable activities and during all times when customers remain on the premises, and that it covers the external area immediately outside the entrance. Recordings are stored for a minimum of 31 days with date and time stamping, and viewing must be made available immediately upon request of police or an authorised officer throughout the entire 31-day period.

The City of London runs near-identical wording, and adds a staffing duty: a staff member conversant with the operation of the CCTV system must always be present when the premises is open to the public, and must be able to show police or the licensing authority recordings of the preceding two days immediately when requested.

Essex Police's model condition is a useful contrast. It requires a recordable system capable of evidential-quality pictures in all lighting conditions, coverage of entrances, exits and everywhere alcohol is sold, correct time and date stamping, and a minimum of 31 days. On the retention figure the three are identical. On what the system must do to earn it they are not, which we go into in continuous versus motion-only recording.

Two different authorities, two different obligations, same kind of premises. That is not an inconsistency to complain about, it is how the system is designed to work, and every one of these documents says as much about itself: they are guidance, not standard conditions, and the statutory guidance behind them warns that conditions should be tailored case by case and that under no circumstances should pools of conditions be regarded as standard conditions imposed automatically.

The practical consequence: do not take a retention period from an article, including this one. Read your own licence.

Shops, offices and everyone without a licence condition

If nothing is written into a licence, nothing external sets your number, and you are back to the test: what did you install the cameras for, and what is the shortest period that serves it.

That is a more useful question than it sounds, because it has a concrete answer for most businesses. Work out the longest realistic delay between something happening and somebody telling you about it. A stock discrepancy found at the next count. A customer claiming they slipped three weeks ago. A chargeback. A damage claim from a delivery driver. Whatever that longest lag is, your retention needs to outlast it, and very little beyond that is doing any work.

Around a month covers that for most small commercial premises, which is exactly why the convention landed where it did. But you should be able to say why, in a sentence, if anyone ever asks. That sentence is the justification the regulator expects, and it is the difference between a documented retention period and a drive that happens to be a certain size.

You can work out what a given period costs in storage terms with our CCTV storage calculator, and if somebody asks you for a copy of footage, the rules on responding to that request are a separate obligation with its own one-month clock.

The duty most businesses miss is not retention

Everybody focuses on the number of days. The conditions that actually catch people out are about speed and competence, not duration.

Look again at what Westminster and the City of London require. Viewing available immediately upon request, throughout the entire 31-day period. A staff member who understands the system present whenever the premises is open. The ability to show the last two days immediately, when asked.

Immediately is a demanding word. It means that when an officer walks in on a Saturday night, somebody on shift can find the right camera and the right time and put it on a screen. A system that technically holds 31 days but needs the manager, who is on holiday, and a password nobody wrote down, does not meet that condition however much footage is on the drive.

This is worth designing for rather than hoping about: who can operate it, whether they are rostered on, whether the export process has ever been tested by the person who will have to do it. If you do end up handing footage over, how to export it so it still counts as evidence matters as much as having kept it.

Why more days can mean a worse system

There is an obvious way to hit a retention target on a system that cannot really manage it, which is to turn the image quality down until the days add up. It is common and it is a bad trade.

Government guidance on police requirements addresses it head on: video quality should not be reduced to fit the available storage capacity of the system, and retention beyond 31 days should not affect the quality of the more recent recordings. Dyfed-Powys Police put the same point as a positive instruction, that image quality should be set to the operational requirement rather than to minimise storage capacity.

The test in the same guidance is the one to remember, because it is blunt enough to settle arguments: if you cannot see it, it is not fit for purpose. A month of footage in which nobody is identifiable satisfies a condition on paper and fails the only job the cameras had.

The other half of the equation is recording mode, which changes the sums considerably and is worth deciding deliberately rather than inheriting. We go through it in continuous versus motion-only recording.

Setting a period you can defend

Pulling it together, a defensible retention position for a business has four parts, and none of them is a number somebody told you in a pub.

  • Whatever your premises licence requires, if anything. That is the floor and it is non-negotiable.
  • A stated purpose for the cameras, and a period that is the shortest one serving it, with the reasoning written down somewhere you could produce.
  • A separate route for footage that matters: pulled out of the cycle and stored apart, which is also what lets you lawfully hold something longer when police ask you to preserve it for an active investigation.
  • Enough storage to hit that period at the image quality you actually need, rather than the period you get by degrading the picture.

Done that way, the question stops being how long everyone else keeps it. You can answer for your own premises, in a sentence, to whoever asks.

About this guide

Who wrote this

Written by Doberman, a CCTV system designer and installer working with homes and small businesses across Leicester and Leicestershire. Sizing a commercial system to a retention obligation is a normal part of specifying one, which is why this page is about the documents rather than about the general idea of retention.

What changed, and what we removed

An earlier version of this page carried sector figures, including retention periods for banks, supermarkets and schools, that we could not trace to any source. They have been taken out rather than dressed up. Where a sector has no documented figure, this page now says so instead of offering a number. Note also that ICO guidance on CCTV currently shows a notice saying it is under review following the Data (Use and Access) Act 2025.

Disclosure

We design and install CCTV, including for businesses with retention obligations, so we have an interest in you having enough storage. The counterweight is in the guidance above and we have not softened it: the regulator wants you keeping less, not more, and a bigger drive is not automatically a better answer.

Common questions

Is a business legally required to keep CCTV for 30 days?

No. There is no statutory retention period for CCTV in the UK at all, for any sector. Data protection law says the purpose you installed the cameras for should set the period, and that it should be the shortest period that serves that purpose. The familiar numbers come from somewhere else entirely: licence conditions, police model conditions and industry habit. None of them is a statute.

Why do licensed premises keep footage for 31 days rather than 30?

Because 31 is the figure written into the model conditions that licensing authorities and police forces publish. Westminster, the City of London, Essex Police and Dyfed-Powys Police all specify a minimum of 31 days. It is a month with the longest month covered, which is what you want if an incident is reported a calendar month later. The 30-day figure most people quote is GOV.UK guidance aimed at the public, not at licence holders.

Does every licensed premises have to record continuously?

No. It varies by authority, and your obligation is whatever is written on your own premises licence rather than anything general. Some authorities do require it and others say nothing about it at all, which is itself the answer to whether a standard exists. We set out who requires what, and why modern compression has changed the calculation, in our guide to continuous versus motion-only recording.

Is 31 days the ICO default?

No, and this one is worth correcting because installers repeat it constantly. The ICO sets no default and no number of any kind. Its position is that the purpose of your processing determines the retention period. The 31-day figure comes from licensing and police model conditions, which are a different kind of instrument imposed by a different body on individual premises. Anyone citing the ICO for 31 days has not read the ICO.

Can we just keep everything for six months to be safe?

That is the instinct and it is the wrong answer. The ICO is explicit that footage should not be kept for six months merely because the manufacturer settings allow it. Retention has to be the shortest period that serves your purpose, and you have to be able to justify the period you picked. Keeping everything indefinitely is a data protection problem, not a cautious one.

Should we buy more storage to hold footage for longer?

Only if it does not cost you image quality. Government guidance on police requirements is blunt about this: video quality should not be reduced to fit the available storage capacity of the system, and retention beyond 31 days should not affect the quality of the more recent recordings. Its test for whether a system is any good is simpler still: if you cannot see it, it is not fit for purpose. Thirty-one days of footage nobody can identify anyone in is worse than a fortnight that works.

What if the police ask us to hold something for longer?

Keep it. Retaining footage for longer than your normal period is lawful where there is a specific reason, and the ICO gives the example of a law enforcement agency investigating a crime asking you to preserve it so they can view it as part of an active investigation. Pull that footage out of the normal cycle and store it separately, so your routine overwrite does not reach it while the investigation runs.

Want a system sized to the retention you have to hit?

We visit, map the blind spots, and quote one fixed price on the spot.