The Data (Use and Access) Act 2025 changes how UK data protection law applies to CCTV, but it does not remove the rules. Since 5 February 2026, preventing and detecting crime is a “recognised legitimate interest”, searches for footage only need to be reasonable and proportionate, and you can pause the clock while you clarify a request. Since 19 June 2026, you must also give people a way to complain to you directly.
Last reviewed: 18 October 2026. This is general information for businesses and organisations in Northern Ireland, not legal advice.
What is the Data (Use and Access) Act 2025?
The Data (Use and Access) Act 2025, often shortened to the DUAA, received Royal Assent on 19 June 2025. It amends the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) rather than replacing them, and it applies across the UK, including Northern Ireland.
Its changes are coming in in stages. The main data protection changes took effect on 5 February 2026, and the duty to handle complaints followed on 19 June 2026.
Key dates
- 19 June 2025: the Act receives Royal Assent.
- 5 February 2026: most of the UK GDPR, Data Protection Act and PECR changes come into force.
- 19 June 2026: organisations must have a process for handling data protection complaints.
What has not changed for CCTV
If your CCTV captures identifiable people, the core duties are the same as before. You still need a lawful basis and a clear purpose, visible signs, sensible retention periods, secure storage, and control over who can view and share footage. Most organisations using CCTV still need to pay the data protection fee to the Information Commissioner’s Office (ICO).
People can still ask for copies of footage of themselves, and the normal response time is still one month.
Five changes that matter if you use CCTV
1. Crime prevention is now a recognised legitimate interest
The Act adds a list of “recognised legitimate interests” to the UK GDPR. One covers processing that is necessary “for the purposes of detecting, investigating or preventing crime, or apprehending or prosecuting offenders”. If that is genuinely why your cameras are there, you no longer need to carry out the full balancing test against people’s interests for that purpose. The recording must still be necessary and proportionate, and it does not stretch to other uses, such as monitoring staff performance.
2. Sharing footage with the police
Another recognised legitimate interest covers disclosing information to a public body that asks for it and states that it needs it for its public tasks. When the PSNI requests footage for an investigation, that gives you a clearer basis to hand it over. Keep a log of each request, what you shared and when.
3. Requests for footage: reasonable searches and pausing the clock
When someone asks for footage of themselves, you only need to carry out reasonable and proportionate searches. If you genuinely need more information to find it, such as the date, time and camera location, or to confirm who is asking, the one-month deadline is paused until they reply. You still need to protect other people in the footage, which usually means blurring or redacting them before release.
4. You must handle complaints yourself
Since 19 June 2026, organisations must make it easy to complain about how they use personal information, for example with an online form, acknowledge each complaint within 30 days and respond without undue delay. That includes complaints about CCTV, so your CCTV policy and signs should tell people how to raise a concern.
5. Automated decisions and AI video analytics
The Act relaxes the rules on decisions made solely by automated means, but keeps tighter limits where special category data is involved. Facial recognition relies on biometric data, which is special category data. If your system uses analytics to make significant decisions about people, check the safeguards with your provider and record your assessment.
A practical checklist for Northern Ireland businesses
- Review the lawful basis in your CCTV policy, and record crime prevention as a recognised legitimate interest where it genuinely applies.
- Update your privacy notice and signs to explain why you record, who to contact and how to complain.
- Set up a process for requests for footage: what to ask the requester, how to search, and how to redact other people.
- Put a complaints route in place, acknowledge complaints within 30 days and keep a record.
- Log every disclosure of footage to the PSNI or another public body.
- Check that your organisation appears on the ICO register of fee payers.
- If you use video analytics or facial recognition, carry out or update a data protection impact assessment.
Is your organisation on the ICO register? Our free checker searches the Northern Ireland entries of the ICO register of fee payers, updated every week.
Cookies and higher fines for websites
The Act also changes PECR. Some low-risk cookies, such as those used only for website statistics, can now be set without consent, provided people are told and can easily opt out. The ICO can also fine PECR breaches at the same level as the UK GDPR, up to £17.5 million or 4% of global annual turnover. If your website collects personal information, it is worth reviewing your cookie banner at the same time.
Questions businesses ask
Does the Data (Use and Access) Act 2025 apply in Northern Ireland?
Yes. It amends UK-wide data protection law, so it applies to businesses and organisations in Northern Ireland in the same way as in the rest of the UK.
Do I still need CCTV signs?
Yes. People must still be told that CCTV is in use, who is responsible for it and how to contact them. Clear signs at the entrance to the area being recorded remain the simplest way to do that.
Does the Act change how long I can keep footage?
No. There is still no fixed period in law. Keep footage only for as long as you need it for your purpose, and delete it routinely. For many businesses that means around 30 days, unless an incident needs to be kept for longer.
How long do I have to respond to a request for footage?
One month from receiving the request. That can be extended by up to two further months if the request is complex or you receive several from the same person, and the clock is paused while you wait for information you reasonably need to find the footage or confirm the requester’s identity.
Need help bringing your CCTV up to date?
We review CCTV systems, signs and policies for businesses and public bodies across Northern Ireland, and provide CCTV video redaction when you need to release footage.
Related: CCTV compliance, CCTV policy development and CCTV video redaction.