This Code of Practice has the dual purpose of assisting operators of CCTV systems to understand their legal obligations while also reassuring the public about the safeguards that should be in place. It sets out the measures which must be adopted to comply with the Data Protection Act 1998, and goes on to set out guidance for the following of good data protection practice.

The standards which must be met if the requirements of the 1998 Act are to be complied are based on the eight Data Protection Principles which say that data must be:

• Fairly and lawfully processed
• Processed for limited purposes and not in any manner incompatible with those purposes
• Adequate, relevant and not excessive
• Accurate
• Not kept for longer than is necessary
• Processed in accordance with individuals' rights
• Secure
• Not transferred to countries without adequate protection

This checklist is designed to help operators of small CCTV systems comply with the legal requirements of the Data Protection Act 1998 and it details the main issues that need to be addressed when operating a CCTV system. When used as part of a regular review process it should help to ensure that the CCTV system remains compliant with the requirements of the Act.

It is important that the Data Protection Act is complied with because failure to do so may result in action being taken under this Act. Failure to comply with Data Protection requirements will also affect the police’s ability to use the CCTV images to investigate a crime and may hamper the prosecution of offenders.

If you use a CCTV system in connection with your business you should work through the checklist and address all the points listed. This will help to ensure that your CCTV system remains within the law and that images can be used by the police to investigate crime.