Every camera your firm operates is a data processing activity under UK GDPR. Processing CCTV footage without a documented legal basis, a completed DPIA, compliant signage, a retention schedule, and a data subject rights framework isn't a technicality — it's a breach. For FCA-regulated firms, inadequate surveillance governance is simultaneously a data protection failure and a SYSC systems and controls concern. The FCA doesn't wait.
What's included:
Legal basis and DPIA: UK GDPR framework, legitimate interests assessment, ICO Code of Practice compliance, and proportionality review
Signage and transparency: content requirements, design and visibility standards, strategic placement, and privacy notice integration
Full data subject rights: Articles 15/16/17/18/21 with communication procedures for each right
Data retention and deletion: retention schedule, automated deletion, secure disposal, and legal hold provisions
Access, security, and image quality: access controls, authentication, image quality standards, and technical safeguards
Breach management: ICO 72-hour notification, data subject notification, and investigation and remediation
Ready-to-use appendix: CCTV System Assessment Form with full assessment criteria and completion notes
+ much more
Who is this for?
Data Protection Officers, Compliance Officers, Facilities Managers, and senior management at FCA-regulated firms operating CCTV.
How it works
Step 1 — Read it. Every section exists for a reason, grounded in a specific regulatory obligation.
Step 2 — Understand it. Map the content against your current practices. Identify where you're strong and where gaps exist.
Step 3 — Make it yours. Tailor the language to reflect how your organisation actually operates. A policy that sounds like your firm is a policy your people will follow.
Step 4 — Take ownership. Assign clear accountability — Board approval, named SMF holder, designated policy owner. A policy without an owner is a liability, not an asset.
Step 5 — Operationalise it. Embed the policy into your governance calendar, training programme, and annual review cycle. This is where compliance becomes culture.
Or, get this free with RegTechPRO
Access this alongside the full compliance policy library — SM&CR, COBS, AML, Consumer Duty, GDPR, and more — for a fraction of the cost of consultancy.
View RegTechPRO pricing and packages →
Every camera your firm operates is a data processing activity under UK GDPR. Processing CCTV footage without a documented legal basis, a completed DPIA, compliant signage, a retention schedule, and a data subject rights framework isn't a technicality — it's a breach. For FCA-regulated firms, inadequate surveillance governance is simultaneously a data protection failure and a SYSC systems and controls concern. The FCA doesn't wait.
What's included:
Legal basis and DPIA: UK GDPR framework, legitimate interests assessment, ICO Code of Practice compliance, and proportionality review
Signage and transparency: content requirements, design and visibility standards, strategic placement, and privacy notice integration
Full data subject rights: Articles 15/16/17/18/21 with communication procedures for each right
Data retention and deletion: retention schedule, automated deletion, secure disposal, and legal hold provisions
Access, security, and image quality: access controls, authentication, image quality standards, and technical safeguards
Breach management: ICO 72-hour notification, data subject notification, and investigation and remediation
Ready-to-use appendix: CCTV System Assessment Form with full assessment criteria and completion notes
+ much more
Who is this for?
Data Protection Officers, Compliance Officers, Facilities Managers, and senior management at FCA-regulated firms operating CCTV.
How it works
Step 1 — Read it. Every section exists for a reason, grounded in a specific regulatory obligation.
Step 2 — Understand it. Map the content against your current practices. Identify where you're strong and where gaps exist.
Step 3 — Make it yours. Tailor the language to reflect how your organisation actually operates. A policy that sounds like your firm is a policy your people will follow.
Step 4 — Take ownership. Assign clear accountability — Board approval, named SMF holder, designated policy owner. A policy without an owner is a liability, not an asset.
Step 5 — Operationalise it. Embed the policy into your governance calendar, training programme, and annual review cycle. This is where compliance becomes culture.
Or, get this free with RegTechPRO
Access this alongside the full compliance policy library — SM&CR, COBS, AML, Consumer Duty, GDPR, and more — for a fraction of the cost of consultancy.
View RegTechPRO pricing and packages →
Image 1 of 9
Image 2 of 9
Image 3 of 9
Image 4 of 9
Image 5 of 9
Image 6 of 9
Image 7 of 9
Image 8 of 9
Image 9 of 9
