State a limited purpose
Write the intended purpose in terms the responsible organisation can review. Ask whether less intrusive measures could meet it and what area really needs to be covered. This is a commissioning record, not permission to monitor staff, neighbours or visitors. Keep the actual security layout private. A camera purchased for one purpose should not silently become a source of unrelated behavioural or productivity analysis.
Identify responsibility before features
Record the organisation responsible for the information, the people allowed to view it and the route for questions or requests. Ask the appropriate privacy professional about applicable requirements, notices and any required assessment. As a UK example, ICO surveillance guidance discusses necessity, transparency, minimisation and access controls. The ICO also says this guidance is under review following the Data (Use and Access) Act; check its current position for an actual deployment.
Give retention a reason
Do not select a period simply because a recorder has enough storage. ICO explains that UK GDPR and the DPA 2018 do not prescribe one minimum or maximum period for all surveillance systems; purpose determines what is necessary. Record the reason for the proposed period, who approves it and how routine removal and any justified exception are checked. Do not publish sensitive footage in a planning record or invent a universal 30-day rule.
Check the operational handover
Ask who maintains the system, handles access changes and verifies the agreed settings. A monitoring contract must distinguish receiving an alert from deciding and carrying out a response. Keep the actual hours and escalation arrangements explicit. A test of an agreed function should record its date, conditions and observation; ownership of cameras does not prove that every alert will receive a particular emergency-service response.
Read the drawing as text
Purpose leads to a justified retention decision, approved access and a removal check. The recorder’s storage capacity does not decide how long information is needed.
Work through an example
A fictional organisation records the purpose as investigating a reported access incident. Its worksheet lists restricted viewing roles and leaves the retention period pending a documented purpose-based decision. A sales proposal offering six months of storage is not copied into the retention row. No camera is installed and no person is recorded for the example.
Illustrative example; figures, people and organisations in the worked record are fictional.
The example record
Purpose
- Question to answer
- Why capture this information?
- Evidence
- Documented need and alternatives
Access
- Question to answer
- Which named roles need it?
- Evidence
- Approved access arrangement
Retention
- Question to answer
- Why this period?
- Evidence
- Reason and review, not disk size
Operation
- Question to answer
- Who checks and responds?
- Evidence
- Actual service scope and test record
Download blank worksheet (.csv) ↗Download worked example (.csv) ↗
Keep your own record
Use the result within its scope
Use the law and authority relevant to the actual location. This is not a compliance certification, surveillance installation guide or permission for covert recording. Resolve privacy and security questions before commissioning the real system.
Reference sources
Earlier articles on this subject
- Four Ways to Use Surveillance Cameras ↗ — 2021-01-12, Maria Baldwin.
- Why Is It Important To Select The Right Security Camera Systems! ↗ — 2021-02-10, Maria Baldwin.
- Choosing A Commercial Intruder And Duress Alarm System ↗ — 2021-02-26, Maria Baldwin.
- Characteristics Of A Professional Home Security Company In Australia ↗ — 2020-12-23, Maria Baldwin.