Body-worn video has become standard-issue on UK private security operations over the last five years. Door supervisors on Friday nights, event security across the summer festival calendar, retail loss-prevention officers, mobile patrol crews in Sussex, close protection teams, and increasingly the daytime static officer on a construction gate — all now routinely carry a body-worn camera clipped to the front of their uniform. The reasons are good ones. BWV reduces confrontation, evidences use-of-force decisions, protects officers from unfounded complaints, defends clients against false claims, and produces court-quality material when an incident escalates.
None of that removes the fact that a body-worn camera on an SIA-licensed officer is a piece of continuous surveillance kit generating personal data every second it's turned on — and every second of that footage sits squarely inside the UK GDPR framework, the Data Protection Act 2018, the Data (Use and Access) Act 2025, and the ICO's guidance on video surveillance. Get the compliance right and BWV is one of the most powerful risk-reduction tools a security firm has. Get it wrong and it's a data-protection breach walking down the pavement on your officer's chest.
The Camera On Their Chest
Is Personal Data.
Body-worn video sits inside UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025. Here's what UK security operators must comply with — and how to run BWV correctly.
This article is general information, not legal advice. UK data protection compliance for body-worn video is enforced by the Information Commissioner's Office and continues to evolve under the Data (Use and Access) Act 2025. Always check the latest guidance at ico.org.uk. For fixed CCTV compliance, see our earlier piece on CCTV and UK GDPR for small businesses — the frameworks overlap substantially but body-worn video carries additional considerations set out below.
The Short Answer
Yes, body-worn video is legal in UK private security — provided the operator complies with UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and ICO guidance.
Compliance means: a documented lawful basis, a completed Data Protection Impact Assessment (DPIA), clear notification to the public (signage and officer body-worn indicator), a defined retention policy, secure storage with controlled access, a Subject Access Request (SAR) procedure, and staff training on when to record.
Most private-security BWV should not be continuously recording — the standard model is event-based recording, activated when an incident is reasonably likely, with an audible or visible indication to those being recorded.
Why Body-Worn Video Has Become Standard On UK Security Operations
Five practical reasons that all point in the same direction.
It de-escalates. A visible camera on an officer's chest is one of the most consistent de-escalation tools in modern security. Confrontations that would otherwise escalate frequently end the moment the participant registers that they're being recorded.
It evidences use-of-force decisions. When force is used — reasonable, proportionate, lawful — BWV footage protects the officer and the firm against later complaints, and supports police and prosecution in serious incidents. The reasonable-force framework we set out in our piece on what a security guard can and cannot do is meaningfully easier to defend with footage.
It reduces vexatious complaints. Complaints against SIA-licensed officers — whether founded or not — take time and money to investigate. BWV closes many of them within an afternoon.
It supports insurers and clients. Public liability, employer liability and contract-specific claims are all easier to defend with contemporaneous footage. Increasingly, client procurement specifications require BWV as a standard for higher-risk contracts.
It aligns with the industry direction. The SIA and the wider industry — including UK insurers, ACS auditors and major end-clients — are increasingly treating BWV as a professional-standard baseline for higher-risk security work. It is no longer optional at the top end of the market.
"The best body-worn video is the footage nobody ever needs to watch. The value isn't in the recording — it's in the fact the camera is visible."
The Legal Framework — In Plain English
Body-worn video in UK private security sits at the intersection of several overlapping regulatory regimes. Each one adds a specific obligation.
UK GDPR and the Data Protection Act 2018
The core framework. BWV captures personal data — recognisable images and, where audio is enabled, voices — meaning the operating security firm is a data controller. The full duties of a controller apply: lawful basis, transparency, proportionality, retention limits, security of storage, and data-subject rights including Subject Access Requests.
The Data (Use and Access) Act 2025
The 2025 reforms modified parts of UK data protection law but left the substantive obligations on BWV broadly intact. The Information Commission (as the ICO is formally now known under DUAA) remains the regulator. Recognised legitimate interests and refined DPIA requirements are the areas most likely to affect BWV operators — worth reviewing your policy against the current published guidance rather than relying on the pre-2025 framework.
The Surveillance Camera Code of Practice
Issued under the Protection of Freedoms Act 2012, the Code applies primarily to relevant public authorities but is widely referenced as best practice across the UK private security industry. The twelve principles of the Code — including proportionality, transparency, effectiveness and accountability — are the framework any professional BWV programme should be able to demonstrate against.
BS 8593
BS 8593 is the UK British Standard covering body-worn video deployment in security applications. Alignment to the standard is a strong indicator of a professionally-run programme and provides a defensible reference point for auditors, insurers and end-clients.
Employment and human rights law
The officer wearing the camera is also a data subject. BWV footage records them, their working practice, their interactions and their voice. Employment law obligations, the Human Rights Act 1998 (Article 8, right to respect for private life) and the Regulation of Investigatory Powers Act framework all sit alongside the data protection regime.
The Core Compliance Obligations
Different deployments carry different specifics, but every UK BWV programme must satisfy the same core spine.
1 · Lawful basis
You must identify and document a lawful basis under UK GDPR before turning a body-worn camera on for work purposes. For most private security applications this is legitimate interests (preventing and detecting crime, protecting staff and the public, evidencing incidents). A documented legitimate-interests assessment (LIA) must exist — considering the purpose, the necessity and the balance against the rights of the data subjects.
2 · Data Protection Impact Assessment (DPIA)
Body-worn video is systematic monitoring of individuals in a way that meets the threshold for a required DPIA under UK GDPR Article 35. The DPIA must be completed before deployment, must identify the risks, and must set out how those risks are mitigated. This is not optional. It is the single most common compliance gap in UK private-security BWV.
3 · Transparency and notification
The public must know they may be recorded. That means visible signage where BWV is in operation, a clearly-visible camera on the officer's uniform, and a verbal notification where the situation allows ("I need to let you know I am now recording"). Where BWV is deployed at a client site, the client's own public-facing privacy notice should reference the practice.
4 · Continuous vs event-based recording
The ICO's guidance and the wider proportionality principle strongly favour event-based recording — the camera activated when an incident is reasonably likely or has begun — over continuous recording. Continuous recording is very rarely justifiable under a proportionality test in a private-security context. Most professional deployments use event-based recording with audible and visible activation indicators.
5 · Retention
Footage must be kept only as long as necessary for the stated purpose. For routine unused footage — a shift where no incident occurred — typical retention is around 28 to 31 days, mirroring the industry practice for fixed CCTV. Footage related to a specific incident may be retained longer if justified for a defined purpose (an ongoing investigation, an insurance claim, an anticipated legal case). Indefinite retention is not permitted.
6 · Storage security and access controls
BWV footage must be stored securely — encrypted at rest and in transit, on access-controlled systems, with named-user accounts and audit logs of every access. Cloud storage is common and acceptable provided it is professionally administered and subject to a data processing agreement with the platform provider. USB downloads to personal devices are a straight compliance breach.
7 · Subject Access Requests
Any individual captured on BWV has the right to request a copy of footage that contains their image. You generally have one calendar month to respond. Third-party redaction is often required to protect the rights of other individuals in the footage. This is the obligation most private-security firms discover the first time a member of the public files a SAR against them.
8 · Audio recording
Audio capture carries a higher bar of justification than video alone. It should be enabled only when the operator can specifically defend its necessity, and where subjects are appropriately notified. Many professional deployments have BWV video-only as standard, with audio activated only in defined circumstances.
9 · Sharing with police and other third parties
Sharing footage with police under a formal request is a defined regime with its own procedures. Ad-hoc sharing with third parties — including the client, the client's legal team, social media, or media outlets — must be assessed against the lawful basis and the proportionality principle. Casual sharing is one of the fastest routes to an ICO complaint.
10 · Officer training
Every officer deploying BWV must be trained on when to record, how to notify subjects, how to handle the footage after a shift, and what their own data-protection obligations are. Untrained officers are the single largest source of BWV compliance failures.
The Anatomy Of A Compliant BWV Operation
A well-run programme runs through the same recognisable five-stage sequence — from setup through to every individual shift.
Assess
DPIA completed. Lawful basis documented. Deployment scoped against a defined purpose. Signage and notification designed.
Train
Officers trained on when to record, how to notify subjects, and what happens to the footage after their shift. Written policy signed.
Deploy
Camera worn visibly. Event-based recording with clear activation indicator. Public and client notified through appropriate signage and privacy notices.
Store
Footage uploaded to secure, encrypted, access-controlled storage. Named-user access only. Retention clock started. Audit log maintained.
Review
Retention enforced. SARs responded to within a month. DPIA reviewed annually and after any material change. Compliance audited.
Continuous Recording Is Almost Never Justifiable
The single most common misconception in UK private-security BWV is that the camera should be on all the time. Under UK GDPR and ICO guidance, continuous recording will very rarely pass a proportionality test — it captures far more personal data than is necessary for the stated purpose. Event-based recording, activated when an incident is reasonably likely and clearly indicated to those being recorded, is the standard. If your current policy or your provider's policy is continuous recording by default, it needs reviewing.
Is The Compliant
Default Model
Common Mistakes UK Security Firms Make
The same handful of compliance failures show up across BWV audits time after time.
No DPIA
The single biggest compliance gap. Cameras deployed without a documented Data Protection Impact Assessment on file. The ICO regards a DPIA as mandatory for systematic BWV — the absence of one is itself a breach.
Continuous recording by default
Cameras running throughout every shift, capturing hours of routine interactions that had no realistic need to be recorded. Rarely defensible under proportionality.
Audio enabled without specific justification
Video plus audio treated as identical to video alone. Audio recording of conversations carries a materially higher bar and should be enabled deliberately, not by default.
Retention drift
Footage kept indefinitely because "it might be useful later" or because nobody has set the platform to auto-delete. Both breach the retention limit principle.
Casual sharing
Footage sent to a client via WhatsApp. A short clip posted internally in a team chat. Distribution to a friendly journalist. Every one of these is a lawful-basis assessment the firm hasn't done.
USB downloads to personal devices
Officers or supervisors moving footage onto personal laptops or phones "to review". A straight security breach and, in most cases, a straight compliance breach.
No officer training
Cameras handed out at induction with a two-minute technical explanation. No policy signed, no scenario training, no clear guidance on when to activate. The single most fixable failure category.
No SAR procedure
The first Subject Access Request lands and the firm discovers it has no process, no redaction capability, and no way to identify the specific footage in the requested time window.
Non-Compliant vs Compliant BWV Deployment
Here's how the two positions stack up on the operational checklist.
Six Pillars Of A Proper BWV Programme
Whether you're running a small door-supervision team or a national manned-guarding operation, the building blocks are the same.
Documented Lawful Basis
A written legitimate-interests assessment for every deployment — purpose, necessity, and the balance against subject rights.
DPIA On File
Completed before deployment, reviewed annually, updated after any material change. Available for regulator, client or insurer review on request.
Compliant Signage & Indicators
Client-site signage referencing BWV use. Visible cameras on uniform. Recording indicator lights active. Verbal notification where the situation allows.
Event-Based Recording Policy
Cameras activated when an incident is reasonably likely — not continuously across every shift. Written policy signed by every officer.
Secure Storage, Controlled Access
Encrypted cloud or on-premise storage, named-user access, MFA, audit logs, defined retention period with auto-delete enforcement.
SAR-Ready Procedure
Documented process for receiving, verifying and responding to Subject Access Requests within one month — with redaction of third parties where required.
The Practical Checklist For Security Firms And Their Clients
Work through this before deploying BWV — or as an audit of an existing programme.
1 · Complete a DPIA before deployment
Use the ICO's published template as a starting point. Involve the Data Protection Officer where the organisation has one. Document the risks, the mitigations and the residual risk position.
2 · Document your lawful basis
A written legitimate-interests assessment covering purpose, necessity and the balancing exercise. Keep it on file, reviewed annually.
3 · Update policies and privacy notices
Your organisation's data-protection policy, employee-facing BWV policy, and any client-facing privacy notice all need updating before deployment.
4 · Train every officer before their first shift
When to record. When not to record. How to notify subjects. What to do with the footage after the shift. Written policy signed. Refresher training annually.
5 · Set retention and enforce it
Typically 28–31 days for unused footage. Longer only for specifically-identified incidents with a defined justification. Configure the storage platform to auto-delete.
6 · Lock down storage
Encryption at rest and in transit. MFA on user accounts. Named-user access only. Audit logs of every access and every download. No USB transfers to personal devices.
7 · Build the SAR process before you need it
A written procedure covering receipt, verification, footage identification, third-party redaction and response — within one calendar month.
8 · Put data processing agreements in place
With the BWV hardware provider, the cloud storage provider, any monitoring or reviewing third party, and any client sharing arrangements.
9 · Review the whole programme annually
DPIA, policy, training records, retention logs, SAR handling, access audits, incident reports. The annual review is the discipline that keeps drift out of the operation.
How Advance Guarding Runs Body-Worn Video
Every deployment of manned guarding, mobile patrols, event security or key holding and alarm response across Sussex, Northamptonshire and the wider UK is backed by a written BWV programme aligned to UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025, ICO guidance and BS 8593.
Every officer is SIA-licensed and vetted to BS 7858 before deployment. Every BWV camera is worn visibly, with active recording indicators, and operated on an event-based recording model. Every piece of footage is stored on an encrypted, access-controlled platform under a documented data-processing agreement. Every officer has signed the BWV policy and completed the training. SAR procedures are in place before deployment, not after the first request.
For clients — venue operators, developers, portfolio managers, event organisers, retail estate managers, family offices — that means the BWV question that increasingly appears in your own risk and compliance conversations has already been resolved on our side. The camera is on the officer's chest, the footage is compliant, and the audit trail is available if anyone ever needs to see it.
BWV Cover You Can Actually Stand Behind.
Talk to us about SIA-licensed security cover with BS 8593-aligned body-worn video across Sussex, Northamptonshire and the wider UK. Every deployment DPIA-assessed, event-based, encrypted, retention-controlled and SAR-ready before the first shift.
Arrange A Conversation →