Issuing a camera does not establish a lawful recording system. A body-worn video security programme needs a defined purpose, proportionate recording rules and clear responsibility for the footage it creates.
Businesses must handle recordings as personal data under UK data protection law, including the Data Protection Act 2018, rather than treating them as ordinary incident attachments. The practical requirements begin before a camera reaches an officer’s uniform.
Key takeaways: the pre-deployment checklist
- Define the security problem and document why body-worn video is necessary alongside existing controls.
- Record the lawful basis, complete a pre-deployment privacy assessment and justify audio separately.
- Assign controller responsibilities, footage permissions and disclosure duties between the client, security contractor and technology provider.
- Give people clear privacy information through visible notices, accessible information and appropriate verbal announcements.
- Set purpose-based retention, protect recordings and provide a working process for access requests and evidence preservation.
- Train officers, test equipment under working conditions and review whether deployment remains proportionate.
Understand what body-worn video changes
Body-worn video, usually shortened to BWV, records encounters from a camera attached to an officer’s clothing or equipment. It can capture conversations, movements and the immediate surroundings during an incident.
Its value depends on what is recorded and how that recording is handled. A camera can support an investigation, but it cannot establish everything that happened.
Close-range recording creates different privacy risks
The ICO’s body-worn video guidance explains that BWV can be more intrusive than conventional fixed cameras. It can capture audio and record people at close range in homes, shops and on public transport.
That proximity can reveal private conversations, health information and details unrelated to the security incident. The recording boundary moves with the officer.
BWV complements fixed CCTV
Fixed cameras can establish the wider sequence, whilst BWV may capture an interaction beneath or beyond their view. Neither recording necessarily provides a complete account.
Link BWV incidents to fixed-camera references, access records and officer reports. The distinction between CCTV monitoring and surveillance also matters: recording an event does not provide a response unless somebody has responsibility for acting.
Separate UK legal duties from organisational policy
Commercial BWV footage is personal data when individuals can be identified through images, voices or surrounding information. Collection, viewing, storage, export and deletion are all forms of processing.
The UK GDPR and Data Protection Act 2018 govern these activities. A camera purchased for security is not exempt because its purpose appears reasonable.
Apply the data protection framework
The organisation must identify a lawful basis, process information fairly and transparently, limit collection and keep recordings secure. People also retain rights over their personal data.
Use the current ICO video-surveillance guidance when setting policy and reviewing changes. Requirements depend on the purpose, setting, people recorded and technology involved.
Footage concerning suspected offences can engage additional rules for criminal offence data. Biometric identification introduces further requirements where biometric data is used to identify someone uniquely. Ordinary video does not automatically become biometric identification simply because a face is visible.
Understand the Surveillance Camera Code’s scope
Dartford Borough Council’s BWV policy identifies section 29(6) of the Protection of Freedoms Act 2012 as bringing BWV within the Surveillance Camera Code of Practice’s coverage.
That does not impose an identical statutory duty on every private security business. The duty to have regard to the Code applies to specified authorities within its statutory scope in England and Wales.
Its principles remain useful for private operators, including necessity, transparency, accountability and effective review. Contractual requirements may also make particular standards relevant.
Keep the distinction clear. An organisational policy, a contractual commitment and a statutory obligation have different foundations, even where they require similar conduct.
Establish lawful basis, necessity and proportionality
A broad statement such as “for security” doesn’t explain why close-range video and audio are needed. Record the actual purpose, such as protecting officers during confrontations or preserving evidence of threatening conduct.
Different purposes may require different assessments. Introducing BWV for incident evidence doesn’t automatically justify routine employee performance monitoring.
Document the lawful basis
For many private businesses, legitimate interests may be appropriate. The assessment should identify the interest, explain why recording is necessary and balance that interest against the effects on people recorded.
Consent isn’t automatically required for BWV. It’s also often unsuitable for workplace monitoring because employees may not have a genuine choice.
Public authorities may rely on public task where the processing supports a task grounded in law. The correct basis depends on the organisation and purpose, rather than the camera model.
Keep that decision with the surveillance records. The ICO’s surveillance data-protection principles connect lawful processing with collection limits, the period for keeping recordings and accountability.
Show why the intrusion is justified
Assess incident reports, existing fixed-camera coverage, officer duties and less intrusive measures. Better lighting, revised staffing or clearer access procedures may address part of the problem without additional recording.
Compare the expected benefit with the privacy impact. Recording a specific confrontation is different from recording every conversation throughout a shift.
Give extra attention to children, vulnerable people, residential premises and sensitive locations. A measure proportionate at a commercial entrance may require different controls inside someone’s home.
Record the conclusion and its limits. A documented decision should explain where BWV is authorised, when it’s activated and what remains outside scope.
Complete the DPIA before deployment
A Data Protection Impact Assessment, or DPIA, identifies how a proposed system may affect people and what controls will reduce those risks. It should influence the equipment and operating rules before purchase.
Complete one before introducing BWV, particularly where audio will be recorded. The ICO’s BWV guidance expects organisations to complete an assessment, but the statutory requirement applies where processing is likely to create a high risk to people’s rights and freedoms.
Assess the complete recording process
Describe activation, pre-event buffering, upload, storage, review, disclosure and deletion. Include live streaming, remote access and any automatic analysis that the proposed system permits.
Assess audio separately. A device that captures clear conversations can collect information that a silent image would never reveal.
Identify risks involving accidental recording, lost devices, unauthorised exports, recordings kept for too long and failure to locate requested footage. Record the safeguards, responsible roles and remaining risks.
Consult the data protection officer where one is appointed. Where high residual risks cannot be reduced, prior consultation with the ICO may be required.
Make the assessment affect deployment
A DPIA that records risks without changing anything provides little operational protection. Its findings should determine default settings, permissions, retention and officer instructions.
The assessment may support incident-triggered video but reject continuous audio. It may also restrict recording in particular rooms or require stronger export controls.
Revisit it when purposes, locations, software functions or access arrangements change. Adding facial recognition or live streaming is not simply a routine equipment upgrade.
Include a review date and an owner. The assessment remains relevant only while it describes the system actually being used.
Assign responsibilities and address SIA licensing
The business commissioning security, the guarding contractor and the camera platform provider may all handle footage. Their responsibilities depend on what each organisation decides and does.
Equipment ownership does not settle the matter. Neither does a contract that labels every external organisation a processor.
Name the controller and footage owners
The controller determines why and how personal data is processed. A contractor following documented instructions may be a processor, whilst another arrangement may involve separate or joint controllers.
Record the actual arrangement and put appropriate contractual terms in place. Assign responsibility for privacy information, access requests, deletion, incident preservation and breach response.
A shared estate also needs clear boundaries. Tenants do not gain unrestricted access to footage of other occupiers merely because they contribute towards security costs.
Name a lead and a deputy for urgent preservation requests. Footage should not disappear because the only authorised administrator is unavailable.
Match licences to the work performed
DWP policy 17 states that guards providing a licensed service must hold a licence under the Private Security Industry Act 2001. The relevant requirement depends on the security activity and circumstances.
Wearing a body camera does not itself create a blanket requirement for a separate BWV licence. Guarding, door supervision and public-space surveillance activities can involve different licensing requirements.
Do not assume that every licence covers every monitoring role. Reviewing footage for security purposes may raise licensing questions beyond simply wearing the device.
Use the officer’s actual duties when setting deployment requirements. The practical distinctions in security guard licensing and vetting belong alongside the BWV operating instructions, not in an unrelated procurement file.
Make recording visible and privacy information useful
Overt recording requires more than a camera attached to a uniform. People need a reasonable opportunity to understand that recording may occur, who is responsible and why.
Use layered information. Entrance signs, visible device markings, verbal announcements and a fuller privacy notice perform different functions.
Provide readable signs and accessible information
DWP policy 18 requires clearly visible, readable signage identifying the organisation, stating the purpose and giving a contact point. Where audio is used, that fact must be stated explicitly and prominently.
Those are DWP policy requirements, rather than a universal prescribed sign template. They also provide a practical model for transparent deployment.
Position notices before people enter the relevant area where possible. Include a usable route to fuller privacy information, rather than relying entirely on a small label on moving equipment.
The fuller notice should explain the controller, purposes, lawful basis, the period for keeping footage, likely disclosures and individual rights. Give staff appropriate information before deployment.
Give a clear verbal announcement
An officer should explain that recording has started when circumstances permit. A short statement such as “I am recording video and audio for everyone’s safety” can communicate the immediate position.
The wording must match the actual settings and approved purpose. An announcement about video alone is inadequate when conversations are also being recorded.
Safety takes priority during an immediate threat. If an announcement cannot safely be given, the officer should record that reason in the incident report and provide information when practicable.
A recording light supports transparency but does not replace privacy information. People may not recognise the device or understand what its indicators mean.
Set clear rules for activation and audio
The operating policy should describe the circumstances that justify recording, when recording ends and how exceptions are documented. Officers need instructions they can apply during an incident.
Leaving decisions entirely to personal preference produces inconsistent collection. Recording continuously to avoid those decisions creates a different problem.
Define the start and stop points
Authorise recording for defined circumstances consistent with the assessed purpose. The rules should address threatening behaviour, escalating confrontations, relevant incident attendance and other approved situations.
Start early enough to capture the relevant interaction where practicable. Keep recording while the incident continues, then stop when the purpose no longer requires it.
Explain how officers should handle private conversations, welfare situations, toilets, changing facilities and entry into residential accommodation. These settings require stronger consideration of necessity and intrusion.
Record reasons for missed activation, interruption or unexpected recording. Supervisors need that information to distinguish equipment faults, safety decisions and departures from procedure.
Control audio independently where possible
Where a camera allows audio and video to be recorded separately, treat them as separate data streams. Activate only the information necessary for the purpose.
Audio should not remain enabled simply because it is available. Its justification must account for private conversations, bystanders and information unrelated to the incident.
Pre-event buffering also needs assessment. Establish whether the device temporarily captures video, audio or both before activation, and whether that material becomes part of the saved recording.
A video-only operating rule is ineffective if the device still saves buffered audio when recording begins.
Live streaming needs its own justification, access permissions and response arrangements. A remote viewer should have an assigned operational role, not access merely because the platform supports it.
Officers should never promise that recording will stop solely because somebody objects. They should explain the process and refer the objection appropriately while following the lawful operating policy.
Set retention by purpose, not by habit
UK data protection law does not set one universal period for keeping commercial BWV footage. Recordings must be kept no longer than necessary for the stated purpose.
Set the routine deletion period before deployment. Explain how it reflects the time normally needed to identify incidents, receive complaints and preserve relevant material.
Understand the two 30-day policy examples
The DWP Body Worn Video Policy states that footage must be kept no longer than 30 calendar days from the recording date. Any decision to keep footage for longer under that policy must be reviewed at least annually.
Dartford Borough Council states that information is deleted automatically after 30 days unless required for evidential purposes.
These are named organisational policies, not a statutory 30-day limit covering every UK business. Copying the number does not establish that it meets another organisation’s needs.
A shorter or longer period requires a purpose-based explanation. Storage capacity and a supplier’s default setting are not sufficient reasons.
Preserve relevant footage under controlled exceptions
Use a documented hold process when an incident, complaint, access request, claim or investigation requires preservation. Record the clip, reason, approver and review date.
Keep the relevant material rather than suspending deletion across the entire system. An incident extract does not justify retaining unrelated recordings indefinitely.
Review held footage when the underlying matter changes or closes. An annual review requirement should not become permission to retain material unnecessarily until the anniversary.
Apply deletion controls to exports, local downloads and duplicate copies as well as the main platform. Routine deletion is incomplete if old clips remain on shared drives.
Secure footage from capture to deletion
Security must cover the device, upload process, stored footage and exported copies. A protected platform can’t compensate for an unencrypted camera that exposes recordings if it’s stolen.
Choose safeguards according to the sensitivity and risks involved. BWV often records people during distress, conflict or allegations of wrongdoing.
Protect the camera and upload route
The ICO advises considering encryption for the device or storage medium. Its encryption scenarios guidance addresses BWV risks alongside other uses of portable information.
Encryption is a strong safeguard, but data-protection requirements call for appropriate security rather than one universal product. Consider whether recordings remain protected during transfer and after export.
Devices without removable memory cards reduce the risk of footage being extracted if a camera is stolen. Restrict on-device playback and deletion where the operational design permits.
Assign cameras to officers, record issue and return, and use a controlled docking location. A missing device should trigger an immediate, defined response.
Restrict viewing, administration and export
Use individual accounts, appropriate permissions and multifactor authentication where available. Separate routine review from administrator access and export approval.
Maintain records of viewing, changes, downloads and disclosures. Review permissions when staff change roles or leave, and limit supplier remote access to authorised work.
Keep devices and software maintained. Cloud storage also requires appropriate contractual terms, an assessment of access arrangements and safeguards for any restricted international transfers.
If a camera is lost, preserve logs, assess exposure and follow the breach process. Where legally required, notify the ICO within 72 hours of becoming aware of a reportable breach.
Build a working subject access process
A subject access request can cover personal data contained in BWV footage, and it need not use legal terminology. A verbal request can be valid.
Front-line staff should recognise requests and pass them promptly to the responsible team. The process must work during leave, weekends and management absences.
Locate and preserve the relevant recording
Organisations usually have one calendar month to respond, subject to the applicable rules on timing and extensions. Seek proportionate identification and enough information to locate the recording.
Useful details include the date, approximate time, location and a description of the person. Don’t turn those details into unnecessary barriers or delay.
Preserve potentially relevant footage when the request is received. A routine deletion schedule shouldn’t destroy material while the organisation assesses access.
Keep a request record covering receipt, searches, identity checks, preservation, decisions and response. If footage was already deleted routinely before the request, explain that accurately.
Protect other people without refusing automatically
A recording may include staff, customers, witnesses and other identifiable people. Their presence doesn’t automatically justify withholding the whole clip.
The ICO’s post-deployment surveillance guidance describes techniques including blurring, masking and other ways to protect third-party identities. Audio may also need editing where voices disclose third-party information.
Assess the relevant rights, exemptions and circumstances. Depending on the position, a redacted copy or suitable viewing arrangement may address access without exposing unrelated people.
Test redaction before deployment. A system that exports video but cannot protect bystanders can create substantial work when a request arrives.
Keep the original protected and work on a separate disclosure copy. Record what was removed and why.
Preserve evidence and control external disclosure
BWV can support an investigation, but footage isn’t automatically conclusive. The camera angle, timing, obstruction and missing context can affect what it establishes.
An allegation recorded on camera remains an allegation. Human review and supporting records are still required.
Keep the original and the incident record connected
Preserve the original recording and its associated metadata, including the device identity and recorded time. Use a separate working copy for editing or disclosure.
Link the footage to the incident report, officer identity and relevant CCTV references. Record activation delays, equipment problems and any known time discrepancy.
The report should describe observations and actions factually. Avoid treating an incomplete recording as proof of motive or events outside its view.
Maintain a clear history of handling and export. That record helps explain whether the material has remained intact and who has accessed it.
Assess police and third-party requests
A police request doesn’t remove the organisation’s data protection responsibilities. Establish the requester, purpose, relevant legal position and scope before disclosure.
The ICO’s law-enforcement data-sharing guidance explains how the applicable data-protection framework supports appropriate sharing.
Record who requested footage, what was released, who approved it and how it was transferred. Apply similar discipline to insurers, solicitors, landlords and other third parties.
Use secure transfer methods and disclose only relevant material. Staff messaging groups, personal email accounts and social media aren’t acceptable substitutes for a controlled disclosure process.
Choose between a camera and an evidence platform
A body worn camera addresses capture. It doesn’t necessarily provide secure upload, search, masking of third-party details or reliable deletion.
Assess the complete workflow before comparing device prices. The right system depends on officer numbers, sites, incident volume and the organisation’s ability to administer recordings.
Compare the operating models
A self-contained camera may suit a limited deployment if secure transfer, storage and administration are properly controlled. Manual handling still takes staff time and creates responsibilities.
A managed platform can bring device assignment, access controls and evidence handling into one system. Motorola Solutions’ VideoManager is an example of evidence-management software used with BWV.
Neither model is automatically compliant. A platform with broad permissions or poorly configured deletion can create the same problems as unmanaged files.
These differences affect daily administration.
| Decision | Self-contained camera workflow | Managed evidence platform |
|---|---|---|
| Upload | More manual handling may be required | Docking or managed upload may be available |
| Retrieval | Depends on organised files and records | Search and incident tagging may assist |
| Permissions | Depend on storage arrangements | Role-based controls may be provided |
| Ongoing cost | Hardware plus internal administration | Hardware, software and service commitments |
The stronger option is the one that consistently supports the required controls, rather than the one with the longest feature list.
Include the full cost of operation
Budget for mounts, docks, spare equipment, storage, software and replacement batteries where applicable. Include training, administration, redaction and disclosure work.
Live streaming adds connectivity costs and requires somebody to receive and act on the stream. Without that responsibility, the feature adds collection without a clear response.
Supplier access, export restrictions and service termination also matter. The organisation needs a controlled way to retrieve evidence and complete deletion when a contract ends.
Match camera specifications to the shift
A 12-hour shift doesn’t necessarily require 12 hours of continuous recording. It requires sufficient power and storage for the approved recording pattern, with a margin for delays and incidents.
Assess performance using the intended settings. Resolution, audio, buffering, wireless functions and live streaming can all affect endurance.
Prioritise usable footage and reliable operation
Interconnective’s buyer guidance recommends IP65 as a minimum for security officers and notes IP67 options amongst higher-end brands. These are supplier recommendations, not legal requirements.
An IP rating indicates dust and water protection. It doesn’t establish image quality, impact resistance or battery endurance.
Interconnective also describes 32GB as common standard storage and discusses 720p or 1080p operation for long shifts. Those figures are market guidance, not a universal specification.
Usable recording depends on compression, lighting, motion and audio quality as well as resolution. A larger image is of limited value if movement obscures the relevant action.
Fit the mount to the officer’s work
A high chest position is a common option, but suitability depends on uniform, body shape, protective clothing and duties. The lens needs a stable, unobstructed view.
Assess the mount whilst the officer walks, bends, uses a radio and wears outer clothing. Lanyards, jackets and carried equipment can block the lens.
Test the complete setup in relevant lighting and background noise. Include gloves where officers use them, and confirm that activation is clear without repeated attention to the device.
Manufacturer battery life claims are a useful starting point. Test the camera using the deployment’s actual operating configuration.
Train officers and review the deployment
Training should cover decisions and handling, rather than only the activation button. Officers need to understand why recording is authorised and where the limits apply.
A Body Worn Video Security Policy should also explain faults, missed recordings, objections, access requests and lost equipment. Supervisors need corresponding review duties.
Make recording part of the incident procedure
At issue, establish camera assignment, available charge, time settings, mount condition and the correct operating mode. At return, confirm upload completion and report faults.
An illuminated dock doesn’t necessarily establish that footage has reached the evidence system. Include an upload confirmation that somebody owns.
Use one agreed incident form across the site or estate. Connect the camera reference to the incident record and flag relevant footage for preservation promptly.
For shops, these controls should sit within wider retail security planning, alongside customer treatment, evidence handling and manager review. An alert or recording should never substitute for a factual assessment.
Train staff not to make informal copies or show clips to colleagues out of curiosity. Access requires a work purpose.
Review outcomes and operational failures
A controlled pilot can expose practical weaknesses before wider issue. Include privacy notices, activation, upload, retrieval, masking third-party identities and deletion in the assessment.
Review whether officers capture relevant incidents, whether unnecessary recording occurs and whether footage can be located within required timescales. Record battery failures, blocked views and disclosure difficulties.
Assess complaints and staff concerns alongside incident outcomes. A reduction in reported incidents alone doesn’t prove that cameras caused the change.
Give the deployment a named review owner and a schedule proportionate to its risks. Changes in staffing, premises or incident patterns may require earlier review.
Retain the system only while its purpose and controls remain justified. Cameras should remain part of an accountable security operation.
Frequently asked questions about body-worn video security
Can a UK security guard legally wear a body camera?
Yes. Commercial use must comply with applicable data protection law, and the officer must hold the appropriate SIA licence where the duties require one.
Wearing the device does not create police powers or remove privacy responsibilities. The organisation still needs a lawful purpose, proportionate operation, suitable information and controlled footage handling.
Is consent needed before recording an incident?
Not necessarily. An organisation may rely on another appropriate lawful basis, such as legitimate interests, where its assessment supports that basis.
An announcement provides privacy information; it is not automatically a request for consent. Officers should follow the approved procedure when someone objects, rather than making an unsupported promise to stop or delete recording.
Must every business delete footage after 30 days?
No. Thirty days is used in the named DWP and Dartford policies, but UK data protection law does not impose that period on every commercial BWV system.
Set a justified routine period and preserve relevant material through a controlled hold process. Review held recordings and delete them when the continuing purpose ends.
Can footage be used to monitor employee performance?
A security deployment does not automatically authorise unrelated performance monitoring. Any additional purpose needs a lawful basis, fairness assessment, appropriate information and consideration of compatibility with the original purpose.
Routine review of employees can create different privacy risks from incident investigation. Managers should not expand access or use simply because recordings are already available.
What happens if a camera containing footage is stolen?
Report the loss immediately through the organisation’s security and data-breach process. Establish what recordings were present, whether they were encrypted and whether access was possible.
Preserve relevant records and assess the consequences for people recorded. Regulatory notification and communication to affected individuals depend on the applicable breach thresholds.
Make the recording system accountable
Body-worn video is useful when recording decisions, evidence handling and privacy controls work together. A visible camera alone does not establish any of those things.
Give the deployment a named owner, a justified purpose and operating rules that officers can apply. Test the complete process, including retrieval, redaction and deletion, before treating the equipment as ready for service.
The standard is controlled, explainable recording that supports the security task without collecting or exposing more than that task requires.
0 Comments