Adopted: 21 September 2026 | Review Date: September 2027
Public and Premises CCTV
Based on the ICO template.
Part 1: Purpose test
To assess whether there is a legitimate interest behind the processing.
- Why do you want to process the data?
- To prevent and detect unlawful acts and contribute to security of our premises and the safety of the public.
- What benefit do you expect to get from the processing?
- Enhanced security of our premises and enhanced safety of the public .
- Do any third parties benefit from the processing?
- The general public receive a tangible benefit by this processing as it helps to create a secure environment by preventing and detecting unlawful acts.
- Are there any wider public benefits to the processing?
- The general public in the surrounding area receive a tangible benefit by this processing as it helps to create a secure environment by preventing and detecting unlawful acts.
- How important are the benefits that you have identified?
- Essential, the safety of the general public, our staff and premises users is paramount.
- The security of the premises and consequent prevention of loss, damage or theft is vital to the councils interests.
- What would the impact be if you couldn’t go ahead with the processing?
- The Public could be at greater risk of crime and anti-social behavior.
- It could allow loss, damage or theft to go undetected.
- Are you complying with any specific data protection rules that apply to your processing (eg profiling requirements, or e-privacy legislation)?
- N/A
- Are you complying with other relevant laws?
- N/A
- Are you complying with industry guidelines or codes of practice?
- N/A
- Are there any other ethical issues with the processing?
- None, this process is widely expected and understood.
Part 2: Necessity test
To assess whether the processing is necessary for the purpose identified.
- Will this processing actually help you achieve your purpose?
- Yes
- Is the processing proportionate to that purpose?
- Yes
- Can you achieve the same purpose without the processing?
- No
- Can you achieve the same purpose by processing less data, or by processing the data in another more obvious or less intrusive way?
- No
Part 3: Balancing test
To consider the impact on individuals’ interests and rights and freedoms and assess whether this overrides our legitimate interests.
Nature of the personal data
- Is it special category data or criminal offence data?
- Unlikely to record special category data unless it is already made public by the data subject
- Is it data which people are likely to consider particularly ‘private’?
- No, the data would be available to everyone in the immediate area of the data subject in question.
- Are you processing children’s data or data relating to other vulnerable people?
- It is likely that children’s data and vulnerable people’s data will be captured.
- Is the data about people in their personal or professional capacity?
- Both data captured from our premises users and members of the public will be in their personal capacity and data captured from our staff and contractors will be in professional capacity.
Reasonable expectations
- Do you have an existing relationship with the individual?
- With our staff and contractors, yes, with premises users and the general public no.
- What’s the nature of the relationship and how have you used data in the past?
- N/A
- Did you collect the data directly from the individual? What did you tell them at the time?
- Yes, the data is collected directly from the individuals.
- Signs will make clear that CCTV is in operation and give details of the data controller, the purpose and lawful basis.
- If you obtained the data from a third party, what did they tell the individuals about reuse by third parties for other purposes and does this cover you?
- N/A
- How long ago did you collect the data? Are there any changes in technology or context since then that would affect expectations?
- Data will be collected in real time and only stored for 28 Days
- Technology is accepted and expected
- There is nothing novel or innovative
- Is your intended purpose and method widely understood?
- Yes, it is widely understood and expected
- Are you intending to do anything new or innovative?
- No
- Do you have any evidence about expectations – eg from market research, focus groups or other forms of consultation?
- CCTV such as ours has been common for some decades
- Are there any other factors in the particular circumstances that mean they would or would not expect the processing?
- CCTV such as ours has been expected and accepted for several decades
Likely impact
- What are the possible impacts of processing on people?
- Minimal impact to people acting lawfully, high impact to those acting unlawfully and beneficial impact to those that are the victims of unlawful acts.
- Will individuals lose any control over the use of their personal data?
- Yes, in the event of an unlawful act the footage will be passed to law enforcement or similar competent authority and data subject rights will be restricted as per schedule 2 paragraph 2, DPA 2018
- What is the likelihood and severity of any potential impact?
- In the event of an unlawful act, a data subject that is the perpetrator will be subject to criminal proceedings.
- A data subject that is a victim of an unlawful act will benefit from evidence gathered by our processing
- Third parties to an unlawful act will have little impact.
- Are some people likely to object to the processing or find it intrusive?
- Yes, some will object and find it intrusive
- We will warn of the processing with just in time signage
- Would you be happy to explain the processing to individuals?
- Yes, this type of CCTV is widely expected and understood
- Can you adopt any safeguards to minimise the impact?
- Signs will make clear that CCTV is in operation and give details of the data controller, the purpose and lawful basis
- Data will only be retained for longer than 28 Days if requested by law enforcement or a similar competent authority.
Can you offer individuals an opt-out? No