CCTV Data Protection Impact Assessment (DPIA)

1. Purpose of this DPIA
This assessment explains why CCTV is used at IDC College, how footage is handled, and
the steps taken to protect the privacy of children, learners, visitors, and customers.

2. Why CCTV Is Used
CCTV is used for two clearly defined purposes:

• Safeguarding and safety in the classroom — supporting safe use of sewing equipment, evidencing
accidents or incidents, and protecting children and vulnerable learners.
• Crime prevention and security in the shop — deterring theft, protecting stock and equipment, and
ensuring the safety of visitors and staff.

CCTV is not used for staff performance monitoring.

3. What the System Records
• Video footage only (no audio).
• Classroom/workshop area.
• Retail shop area.
• Entry and exit points. No cameras are placed in private areas such as toilets or changing spaces.

4. Lawful Basis for Processing
CCTV is operated under the Data Protection Act 2018, UK GDPR, and the Surveillance Camera Code of Practice.
Lawful basis:
• Legitimate interests (Article 6(1)(f)) — safeguarding, safety, and crime prevention.
These interests are necessary, proportionate, and cannot be achieved through less intrusive means.

5. Necessity and Proportionality
Why CCTV is necessary
• The school operates with a single adult present.
• Children use needles, scissors, irons, and sewing machines.
• The shop contains stock and cash.
• CCTV provides objective evidence in the event of an accident, allegation, or security incident.
Measures to reduce privacy impact
• No audio recording.
• Clear signage and communication with parents and customers.
• Limited retention period (14–30 days).
• Restricted access to footage.
• Cameras positioned only in appropriate areas.
• Footage used only for safeguarding or security purposes.
6. Risks to Individuals
Potential risks include:
• Feeling monitored.
• Unauthorised access to footage.
• Footage being kept longer than necessary.
• Children’s data being more sensitive due to age and vulnerability.
Overall risk level: Low, due to strong mitigation measures.

IDC College
CCTV Data Protection Impact Assessment (DPIA)

7. How Risks Are Managed
• Secure, password-protected storage.
• Access restricted to the owner (Sarah).
• Automatic deletion after 14–30 days.
• No audio recording.
• Clear policies and signage.
• Annual review of necessity and proportionality.
• Footage shared externally only when legally required.

8. Who Footage May Be Shared With
Footage may be shared only with:
• Police (for crime or safeguarding investigations).
• Safeguarding partners where required.
• Individuals requesting footage of themselves or their child, where lawful and appropriate.
Footage is never shared for marketing or training.

9. Retention
• Standard retention: 14–30 days.
• Extended retention only when footage is needed for an active safeguarding or security
investigation.
• Clear deletion procedures in place.

10. Consultation
• Parents and customers are informed through policies and signage.
• Children are informed in age-appropriate language.
• No external consultation required unless the system changes significantly.

11. Review and Accountability
• DPIA reviewed annually or when the CCTV system changes.
• Owner responsible for compliance: Sarah Hamblett, Data Controller.
• Records kept of any incidents requiring footage review.

12. Conclusion
CCTV use at Golden Rose Sewing School is necessary, proportionate, and justified for safeguarding,
safety, and crime prevention. Strong privacy measures ensure that risks to individuals remain low

 

This Policy was adopted by: IDC College

Date: 9th June 2026

To be reviewed: 9th June 2026

Signed: B. Killigrew