CCTV Data Protection Impact Assessment (DPIA)

1. Purpose of this DPIAThis assessment explains why CCTV is used at IDC College, how footage is handled, andthe steps taken to protect the privacy of children, learners, visitors, and customers.

2. Why CCTV Is UsedCCTV is used for two clearly defined purposes:

• Safeguarding and safety in the classroom — supporting safe use of sewing equipment, evidencingaccidents or incidents, and protecting children and vulnerable learners.

• Crime prevention and security in the shop — deterring theft, protecting stock and equipment, andensuring the safety of visitors and staff.

CCTV is not used for staff performance monitoring.

3. What the System Records

• Video footage only (no audio).

• Classroom/workshop area.

• Retail shop area

• Entry and exit points.

No cameras are placed in private areas such as toilets or changing spaces.

4. Lawful Basis for Processing

CCTV is operated under the Data Protection Act 2018, UK GDPR, and the Surveillance Camera Code of Practice.

Lawful basis:

• Legitimate interests (Article 6(1)(f)) — safeguarding, safety, and crime prevention.

These interests are necessary, proportionate, and cannot be achieved through less intrusive means.

5. Necessity and Proportionality

Why CCTV is necessary

• The school operates with a single adult present.

• Children use needles, scissors, irons, and sewing machines.

• The shop contains stock and cash.

• CCTV provides objective evidence in the event of an accident, allegation, or security incident.

Measures to reduce privacy impact

• No audio recording.

• Clear signage and communication with parents and customers.

• Limited retention period (14–30 days).

• Restricted access to footage.

• Cameras positioned only in appropriate areas.

• Footage used only for safeguarding or security purposes.

6. Risks to Individuals

Potential risks include:

• Feeling monitored.

• Unauthorised access to footage.

• Footage being kept longer than necessary.

• Children’s data being more sensitive due to age and vulnerability.

Overall risk level: Low, due to strong mitigation measures.

7. How Risks Are Managed

• Secure, password-protected storage.

• Access restricted to the owner.

• Automatic deletion after 14–30 days.

• No audio recording.

• Clear policies and signage.

• Annual review of necessity and proportionality.

• Footage shared externally only when legally required.

8. Who Footage May Be Shared With

Footage may be shared only with:

• Police (for crime or safeguarding investigations).

• Safeguarding partners where required.

• Individuals requesting footage of themselves or their child, where lawful and appropriate.

Footage is never shared for marketing or training.

9. Retention

• Standard retention: 14–30 days.

• Extended retention only when footage is needed for an active safeguarding or security investigation.

• Clear deletion procedures in place.

10. Consultation

• Parents and customers are informed through policies and signage.

• Children are informed in age-appropriate language.

• No external consultation required unless the system changes significantly.

11. Review and Accountability

• DPIA reviewed annually or when the CCTV system changes.

• Owner responsible for compliance: Sarah Hamblett, Data Controller.

• Records kept of any incidents requiring footage review.

12. Conclusion

CCTV use at IDC college is necessary, proportionate, and justified for safeguarding, safety, and crime prevention. Strong privacy measures ensure that risks to individuals remain low