CCTV, Surveillance & Physical Security Systems Schedule

This Schedule allocates legal, operational and technical responsibility for CCTV, recording, remote viewing, access control and related physical-security systems.

1. Client as system operator and controller

Unless expressly agreed otherwise, the Client selects the surveillance purpose, camera locations, recording settings, access, disclosures and retention. The Client is therefore normally the controller of footage and related personal data.

The Client is responsible for:

• documenting a lawful purpose and lawful basis;
• completing any required legitimate-interests assessment or data protection impact assessment;
• providing clear and appropriately placed signage and privacy information;
• registering with and paying any required data protection fee to the ICO;
• setting a proportionate retention period;
• restricting and auditing access;
• responding to subject access, erasure, objection, police and insurer requests;
• lawful monitoring of workers, customers, neighbours and public areas; and
• consulting landlords, employees, unions, local authorities or neighbours where required.

2. Camera positioning and privacy

The Client approves final fields of view. We may recommend privacy masking, restricted angles or signage, but the Client must verify that cameras do not capture unnecessary private property, toilets, changing areas or other intrusive locations.

Camera coverage can change because of vegetation, stock, vehicles, furniture, lighting, weather, lens movement, building work and later equipment changes. The Client must review coverage periodically.

3. Audio, analytics and biometric functions

Audio recording, facial recognition, biometric categorisation, ANPR, behaviour analytics and worker monitoring carry elevated legal risk and are disabled unless expressly ordered and technically available. The Client must obtain specific legal advice and complete appropriate assessments before enabling such functions.

We may refuse to enable a feature where we reasonably believe the proposed use is unlawful, disproportionate, misleading or unsafe.

4. Retention and storage

No universal statutory CCTV retention period applies. The Client must select the shortest period necessary for its documented purpose and ensure automatic overwrite or deletion operates correctly.

Recording duration estimates depend on scene complexity, resolution, frame rate, motion, codec, storage health and camera count. An estimated number of days is not guaranteed. Storage may fail or become unavailable without warning.

5. Evidence and exports

Footage quality may be affected by lighting, distance, motion, weather, compression, angle, obstruction and device capability. We do not guarantee that footage will identify a person, number plate or event or be accepted as evidence.

The Client must preserve relevant footage promptly after an incident. Routine overwrite may continue unless footage is exported or protected. Export, redaction, format conversion and forensic assistance are chargeable unless included.

6. Remote access and cybersecurity

Remote viewing depends on internet, cloud services, apps, DNS, firewalls and vendor infrastructure. The Client must protect credentials, use MFA where available, keep authorised-user lists current and avoid shared administrator accounts.

We may disable insecure port forwarding, default passwords, obsolete protocols or compromised access. No internet-connected surveillance system can be guaranteed immune from unauthorised access.

7. Detection and response limitations

A camera is not a guarantee of security and does not replace locks, lighting, staffing, alarms, insurance or risk management. Unless a licensed monitoring service is expressly contracted, nobody is watching cameras continuously and no automatic police or emergency response is provided.

Motion detection, line crossing and analytics can generate false positives and miss events. Notifications depend on local power, network, apps, push services and device settings.

8. Power, network and environment

The Client must provide suitable power, surge protection, network capacity, secure equipment location, ventilation and internet. External cameras may require maintenance because of weather, insects, condensation, dirt, vandalism or movement.

Wireless links and mobile connectivity are variable and should not be treated as equivalent to a properly designed wired system unless risks are accepted.

9. Maintenance and health checks

The Client must arrange periodic checks of recording, time synchronisation, camera view, storage, user access, firmware and exports. A managed maintenance plan does not guarantee continuous operation between checks.

Consumables, cleaning, damaged cable, vandalism, vegetation clearance, access equipment and replacement hardware are chargeable unless expressly included.

10. Disclosures and subject requests

The Client decides whether and how footage is disclosed to police, insurers, individuals or third parties. It is responsible for identity verification, lawful disclosure, redaction and record keeping. We may assist only on documented instruction and at the applicable rate.

11. Existing systems and third-party equipment

We do not warrant compatibility, security or remaining life of existing or third-party equipment. Taking over a system does not mean we certify its original design, installation, legal compliance or historic recordings.

12. Indemnity

The Client will indemnify us against third-party claims and regulatory action arising from the Client’s surveillance purpose, camera positioning, signage, retention, monitoring, disclosure or access decisions, except to the extent directly caused by our breach of this Schedule or negligence.