Form

Self assessment tool (accessible)

Updated 25 August 2026

How well does your organisation comply with the 12 guiding principles of the Surveillance Camera Code of Practice? Complete this easy-to-use self-assessment tool to find out.

Using this tool

This self-assessment tool has been prepared by the Biometric and Surveillance Camera Commissioner (BSCC) to help you and your organisation identify if you’re complying with the Surveillance Camera Code of Practice (the Code). It should be completed in conjunction with the Code and can help to show you how well you comply with each of its 12 guiding principles for all the surveillance camera systems your organisation owns.^{[footnote 1]}

It is possible to be largely compliant with some principles and to fall short against others. As a result, you will note that at the end of the questions against each principle there is a space to include an action plan. This is so you can put actions in place over the next year to improve your compliance to that principle. These boxes can also be used to make a note of what evidence you could produce if required to show your compliance to that principle.

The template contains a combination of open and closed questions. For the open questions, there is a limit on how much you can write within the template, so please feel free to include any additional notes as an annex to the document – there are additional blank pages at the end of the tool to help you to do so.

Remember that your organisation may operate more than one surveillance camera system/VSS, with a scope that extends across several purposes and many geographical locations. So, before you start, clarify the scope of the system(s) you propose to self-assess for compliance against the Code. You may choose to complete a separate self-assessment for each surveillance system/VSS, such as CCTV, BWV or ANPR, or you may choose to complete a single comprehensive self-assessment covering all of your surveillance system/VSS. In either case, you should clearly identify the system or systems to which the assessment relates.

Is this tool for me?

The self-assessment tool is aimed primarily at relevant authorities under Section 33 of the Protection of Freedoms Act 2012 that have a statutory duty to have regard to the guidance in the Code. In general terms, this means local authorities and the police in England and Wales.

If you work within any other organisation that operates surveillance camera systems/VSS, the Commissioner encourages you to adopt and follow the principles of the Code on a voluntary basis. If you decide to do so, then using this tool will be of benefit to you.

As a relevant authority under Section 33, if you are considering the deployment of a new surveillance camera system/VSS or considering extending the purposes for which you use an existing system, you may find the more detailed three stage passport to compliance document a valuable planning tool. It can guide you through the relevant principles within the Code and inform you of the necessary stages when planning, implementing and operating a surveillance camera system/VSS to ensure it complies with the Code.

If you are from any other organisation operating a surveillance camera system/VSS you may find this template useful in reviewing your use of surveillance, or may want to use other OBSCC online tools such as the Data Protection Impact Assessment guidance or the Buyers Toolkit to help decide whether your surveillance is necessary, lawful and effective.

What should I do next?

The self-assessment is for you to satisfy yourself and the subjects of your surveillance that you meet the 12 principles and to identify any additional work necessary to show compliance. Think about realistic timescales for completion of your action plans, with a view to achieving full compliance with the Code before undertaking your next annual review.

The BSCC does not want you to submit your completed self-assessment response to him. However, in the interest of transparency, he encourages you to publish the completed self-assessment tool template on your website.

While it is not a requirement to send OBSCC completed templates (we would rather organisations publish them on their public-facing website), do email us to let us know you have completed the self-assessment, and let us know your comments and feedback on the user experience with this template.

Name of organisation:

Scope of surveillance camera system/VSS:

Senior Responsible Officer:

Position within organisation:

Signature:

Date of sign off:

Principle 1

Use of a surveillance camera system/VSS must always be for a specified purpose which is in pursuit of a legitimate aim and necessary to meet an identified pressing need.

1. What is the problem you face and have you defined a purpose in trying to solve it? Have you set objectives in a written statement of need?

2. Have you considered an alternate solution to your problem other than using a surveillance camera system/VSS?

3. What is the lawful basis for your use of surveillance?

4. What is your justification for surveillance being necessary?

5. What is your justification for surveillance being proportionate?

6. Is the system being used for any other purpose other than those specified? If so, please explain.

7. Have you identified any areas where action is required to conform more fully with the requirements of Principle 1?

Action Plan:

Principle 2

The use of a surveillance camera system/VSS must take into account its effect on individuals and their privacy, with regular reviews to ensure its use remains justified.

8. Has your organisation registered with the Information Commissioner’s Office with regards to the surveillance system/VSS?

9. What is your ICO registration number?

10. Has your organisation informed the ICO of the appointment of a Data Protection Officer (DPO), where the DPO reports to the highest management level within your organisation?

11. Do you use automatic facial recognition software?

12. Are you able to document that any use of automatic facial recognition is both necessary and proportionate in meeting your stated purpose?

13. Have you carried out a Data Protection Impact Assessment (DPIA)?

There is a surveillance camera specific DPIA template on the Biometrics and Surveillance Camera Commissioner’s website:  

https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras

14. Within your DPIA, were you or your Data Protection Officer (DPO) able to sign off that privacy risks had been mitigated adequately?

Please state ‘n/a’ if the answer is ‘No’.

15. Do you update your DPIA regularly, and whenever fundamental changes are made to your system?

16. Is your DPIA published and publicly available on your organisation’s website?

17. Have you taken any necessary steps to reduce the impact on individuals’ privacy (such as using privacy zones etc.)?

18. How have you documented any decision that a DPIA is not necessary for your surveillance activities together with the supporting rationale?

19. Have you identified any areas where action is required to conform more fully with the requirements of Principle 2?

Action Plan:

Principle 3

There must be as much transparency in the use of a surveillance camera system/VSS as possible, including a published contact point for access to information and for making complaints.

20. Has there been proportionate consultation and engagement with the public and partners to assess whether there is a legitimate aim and a pressing need for the system?

21. Have the results of the consultation/engagement exercise been published on a public facing website?

22. Does your Privacy Notice signage highlight the use of a surveillance camera system/VSS and the purpose for which it captures images?

23. Does your signage state who operates the system and include a point of contact for further information?

24. If your surveillance camera systems/VSS use body worn cameras, do you inform those present that images and sound are being recorded whenever such a camera is activated?

Add ‘n/a’, if not applicable

25. If your surveillance system/VSS uses recognition technology (such as facial recognition or ANPR), do you have clear signs telling people this technology is being used or when it’s active?

Add ‘n/a’, if not applicable

26. Does your organisation publish information regarding the surveillance camera systems/VSS on their public-facing website?

27. What are your procedures for handling any concerns or complaints?

28. Have you identified any areas where action is required to conform more fully with the requirements of Principle 3?

Action Plan:

Principle 4

There must be clear responsibility and accountability for all surveillance camera system/VSS activities including images and information collected, held and used.

29. What governance arrangements are in place to ensure accountability for the surveillance camera systems/VSS; these arrangements may include documenting policies and procedures, maintaining appropriate records, and managing logs and audit trails, among other arrangements?

30. Do your governance arrangements include a senior responsible officer?

31. Have you appointed a single point of contact within your governance arrangements, and what steps have you taken to publicise the role and contact details?

Guidance on single point of contact: https://www.gov.uk/government/publications/introducing-a-single-point-of-contact-guidance-for-local-authorities/introducing-a-single-point-of-contact

32. Are all staff in your surveillance system control room aware of the roles and responsibilities relating to the surveillance camera system/VSS, including their own?

33. Has your staff received specialist training in using FRT?

34. Please specify what specialist training you have undertaken with your operators?

35. Where the surveillance camera system/VSS serves more than one purpose, is there an identified responsible person(s) accountable for each operation/purpose?

36. How do you ensure the lines of responsibility are always followed?

37. If the surveillance camera system/VSS is jointly owned or jointly operated, is there a completed and agreed arrangement in place, such as the Framework Service Level Agreement, that clearly states what each partner organisation is responsible for and what the individual obligations are?

The Framework Service Level Agreement can be found on the Biometrics and Surveillance Camera Commissioner’s website:
https://www.gov.uk/government/publications/framework-service-level-agreement

38. Have you identified any areas where action is required to conform more fully with the requirements of Principle 4?

Action plan:

Principle 5

Clear rules, policies and procedures must be in place before a surveillance camera system/VSS is used, and these must be communicated to all who need to comply with them.

39. Do you have clearly documented policies and procedures in place to support the lawful deployment and use of your surveillance camera system/VSS? If so, please specify

40. Are the rules, policies and procedures part of an induction process and/or refresher training for all staff?

41. How do you ensure continued competence of system users especially relating to relevant operational, technical, privacy considerations, policies and procedures?

42. Do you have documented procedures for handling errors or mistakes?

43. Have you considered occupational standards relevant to the role of the system users, such as National Occupational Standard for CCTV operations or other similar?

44. If so, how many of your system users have undertaken any occupational standards to date?

45. Do you and your system users require Security Industry Authority (SIA) licences?

46. If your system users do not need an SIA licence, how do you ensure they have the necessary skills and knowledge to use or manage the surveillance system/VSS?

47. Have you completed operational requirements for your VSS, as set out in the Buyers tool kit, for your systems? Please specify for each type of system; these may include but not limited to; public space surveillance, ANPR, BWV, FRT, drones and/or vehicle borne video systems.

https://www.gov.uk/government/publications/surveillance-camera-commissioners-buyers-toolkit

48. If you deploy surveillance cameras using drones, have you obtained either Standard Permission or Non-Standard Permission from the Civil Aviation Authority and what is your CAA SUA Operator ID Number

Add ‘n/a’, if not applicable

49. Have you identified any areas where action is required to conform more fully with the requirements of Principle 5?

Action plan:

Principle 6

No more images and information should be stored than that which is strictly required for the stated purpose of a surveillance camera system/VSS, and such images and information should be deleted once their purposes have been discharged.

50.0How long is the period for which you routinely retain images and information?  Please list the retention periods for each surveillance system (such as CCTV, BWV, drones, etc.) and explain why this period is proportionate to the purpose for which they were captured?

51. Is information about these retention periods made publicly available/published on your web pages?

52. Please explain the reasons for the differing or similar retention periods applied to the various surveillance systems you have listed above, if that is the case.

53. Is this reasoning formally documented in your policies, procedures, or retention schedules?

54. Is this reasoning made available to the public?

55. What arrangements are in place for the automated deletion of images?

56. When it is necessary to retain images for longer than your routine retention period, are those images then subject to regular review?

57. Are there any time limits or procedural deadlines (after which images and information would be deleted) in the event of a law enforcement agency not taking advantage of the opportunity to view the retained images?

58. Do you quarantine all relevant information and images relating to a reported incident until such time as the incident is resolved or all the information and images have been passed on to the enforcement agencies?

59. Have you identified any areas where action is required to conform more fully with the requirements of Principle 6?

Action plan:

Principle 7

Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.

60. How do you decide who has access to the images and information retained by your surveillance camera system/VSS?

61. Do you have a written policy on the disclosure of information to any third party?

62. How do you ensure that data shared with third parties is transferred securely? Please include the data transfer methods and formats used, and whether the data is encrypted.

63. What are your procedures for handling Subject Access Requests (SARs) where a data subject asks for copies of any images in which they appear?

64. Do your procedures include publication of information explaining how individuals can submit a SAR?

65. Do you have image redaction capabilities to hide or mask identifiable third parties in images before they are released to the requester?”

66. What procedures do you have to document decisions about the sharing of information with a third party and what checks do you have in place to ensure that the disclosure policy is followed?

67. Have you identified any areas where action is required to conform more fully with the requirements of Principle 7?

Action plan:

Principle 8

Surveillance camera system/VSS operators should consider any approved operational, technical and competency standards relevant to a system and its purpose and work to meet and maintain those standards.

(There are lists of relevant standards on the Surveillance Camera Commissioner’s website: https://www.gov.uk/guidance/recommended-standards-for-the-cctv-industry)

68. What approved operational, technical and competency standards relevant to a surveillance system/VSS and its purpose does your system meet?

69. How do you ensure that these standards are met from the moment of commissioning your system and maintained appropriately?

70. Have you gained independent accreditation against the approved standards? For example, BS7958, BS7858, BS8593, Police vetting and/or others.

71. Please specify what standards you have accredited against

72. Have you identified any areas where action is required to conform more fully with the requirements of Principle 8?

Action plan:

Principle 9

Surveillance camera system/VSS images and information should be subject to appropriate security measures to safeguard against unauthorised access and use.

73. What security safeguards exist to ensure the integrity of images and information?

74. If the system is connected across an organisational network or intranet, do sufficient controls and safeguards exist?

75. How do your security systems guard against cyber security threats?

76. What documented procedures, instructions and/or guidelines are in place regarding the storage, use and access of surveillance camera system/VSS images and information?

77. What safeguards are in place to guard against misuse of information and images?

78. In the event of a drone mounted camera being lost from sight, what capability does the pilot have to reformat the memory storage or protect against cyberattack by remote activation? What, if any, encryption mechanisms are in place?

Add ‘n/a’, if not applicable

79. In the event of a re-deployable or mobile camera being lost or stolen what safeguards are in place to protect against theft and/or misuse of the recorded data? What, if any, encryption mechanisms are in place?

Add ‘n/a’, if not applicable

80. In the event of a body worn camera being lost or stolen, what safeguards exists to ensure data cannot be viewed or exported by unauthorised persons?

Add ‘n/a’, if not applicable

81. In reviewing your responses to Principle 9, have you identified any areas where action is required to conform more fully with the requirements? If so, please list them below.

Action plan:

Principle 10

There should be effective review and audit mechanisms to ensure legal requirements, policies and standards are complied with in practice, and regular reports should be published.

82. How do you review the use and deployment of your surveillance system, including specialist technologies, to ensure it remains necessary and proportionate in meeting its stated purpose?

83. In relation to the previous question, how frequently is your surveillance camera system/VSS reviewed?

84. Have you identified any camera locations or integrated surveillance technologies that do not remain justified in meeting the stated purpose(s)?

85. Have you conducted an evaluation in order to compare alternative interventions to surveillance cameras? (If so please provide brief details)

86. How do your system maintenance arrangements ensure that it remains effective in meeting its stated purpose?

87. Have you identified any areas where action is required to conform more fully with the requirements of Principle 10?

Action plan:

Principle 11

When the use of a surveillance camera system/VSS is in pursuit of a legitimate aim, and there is a pressing need for its use, it should then be used in the most effective way to support public safety and law enforcement with the aim of processing images and information of evidential value.

88. Are the images, footage and information produced by your system of a suitable quality to meet requirements for use as evidence?

89. Have the images, footage or information produced by your system been used as evidence in investigations, legal proceedings, or prosecutions?

90. How do you verify this?

91. Have any concerns or challenges been identified regarding the quality of images, footage or information provided by your surveillance systems for evidential purposes in the last 12 months?

92. How do you monitor or record these instances?

93. During the production of the operational requirement for your system, what stakeholder engagement was carried out or guidance followed to ensure exported data would meet the quality requirements for evidential purposes?

94. Have you adopted and used the Framework Service Level Agreement (or an equivalent arrangement) to support effective operation with third parties?

95. Do you have safeguards in place to ensure the forensic integrity of the images and information, including a complete audit trail?

96. Is the information in a format that is easily exportable?

97. Does the storage ensure the integrity and quality of the original recording and of the meta-data?

98. Have you identified any areas where action is required to conform more fully with the requirements of Principle 11?

Action plan:

Principle 12

Any information used to support a surveillance camera system/VSS which compares against a reference database for matching purposes should be accurate and kept up to date.

99. What use do you make of integrated surveillance technology such as automatic number plate recognition (ANPR) or automatic facial recognition technology (FRT)?

ANPR:

FRT:

100. How do you decide whether and in what circumstances a vehicle or individual should be included in a reference database?

101. Do you have a policy in place to ensure that the information contained on your database is accurate and up to date?

102. Do you have a process for correcting inaccurate or outdated entries on the database?

103. What policies are in place to determine how long information remains in the reference database?

104. Are all staff aware of when surveillance becomes covert surveillance under the Regulation of Investigatory Powers Act (RIPA) 2000?

105. Have you identified any areas where action is required to conform more fully with the requirements of Principle 12?

1. The term “Surveillance Camera Systems”, as used in the Protection of Freedoms Act 2012 (PoFA), is increasingly being replaced in contemporary usage by “Video Surveillance Systems (VSS)”. For the purposes of consistency and clarity, both terms have been used in this document, and they refer to surveillance systems such as public space CCTV, Automatic Number Plate Recognition (ANPR), use of facial recognition technologies, Body Worn Videos (BWV), Unmanned Aerial Vehicles (UAV or Drones) and vehicle-born video systems. ↩