Privacy Notice - Individuals captured by CCTV

Durham University's responsibilities under data protection legislation include the duty to ensure that we provide individuals with information about how we process personal data. We do this in several ways, one of which is the publication of privacy notices. This privacy notice provides a general description of the broad range of processing activity; in addition, there are tailored privacy notices covering some specific processing activity.

Data Controller

The Data Controller is Durham University. If you would like more information about how the University uses your personal data, please see the University’s Information Governance pages or contact:

Email: info.access@durham.ac.uk

Information Governance Unit also coordinate responses to individuals asserting their rights under the legislation. Please contact the Unit in the first instance.

Data Protection Officer

The Data Protection Officer is responsible for advising the University on compliance with Data Protection legislation and monitoring its performance against it. If you have any concerns regarding the way in which the University is processing your personal data, please contact:

Andrew Ladd, email: info.access@durham.ac.uk 

Why and how we use your data

You have the right to be provided with information about how and why we process your personal data. We will only process data where we have a lawful reason to do so. Our main reasons are as follows:

Lawful Basis	Purpose of Processing
Legitimate Interests	Community safety Crime detection and reduction Implementing University regulations, policies and procedures

Where you have the choice to determine how your personal data will be used, we will ask you for consent. Whenever you give your consent for the processing of your personal data, you receive the right to withdraw that consent at anytime

In addition, we may provide you with a privacy notice in relation to specific uses of your data where this is appropriate. A privacy notice is a verbal or written statement that explains how we use personal data.

How we collect your data

Durham University has a network closed circuit television system, both digital and analogue. Cameras are located in various areas of the campus, both external and internal. Those cameras that are recording collect images of students, staff and visitors to its estate.

Data handling

CCTV data is securely stored on University hard drives and is only accessed in accordance with the ICO's guidance on CCTV and video surveillance. In the event of an incident of crime or suspected crime, an infringement of Durham University’s regulations, policies or procedures or the requirement to investigate an incident, then specific areas of data may be searched and retained. Access to that data is regulated in accordance with the Durham University Closed Circuit Television (CCTV) Policy and Procedures.

Retention

The University keeps personal data for as long as it is needed for the purpose for which it was originally collected. Most of these time periods are set out in the University Records Retention Schedule.

Data is stored for a maximum of 28 days.

In the event of data being required for storage longer than that period, it will be reviewed every three months to ensure that retention is no longer required.

Right of access

Applications for access to CCTV data will be given consideration on an individual basis. Applications must be made in writing to the University and will be considered in line with Data Protection Legislation.

Schedule 2 of the Data Protection Act 2018 entitles the Police or similar agency, Local Authority and government departments to make application to access personal data for the purposes of:

• The prevention or detection of crime and
• The apprehension or prosecution of offenders.

You have the right to be told whether we are processing your personal data and, if so, to be given a copy of that data.

You can find out more about this right on the University’s Subject Access Requests webpage.

Right to rectification

If you believe that personal data we hold about you is inaccurate or incomplete, you have the right to request that it is corrected or completed.

Once we have considered your request, we will contact you to let you know the outcome.

Right to erasure

You can ask us to erase your personal data in certain circumstances, including where:

• We no longer need the personal data for the purpose it was originally collected
• You withdraw your consent (where consent is the lawful basis) and there is no other legal basis for the processing
• You object to the processing and there are no overriding legitimate grounds for the processing
• The personal data has been unlawfully processed
• We are required to erase the data to comply with a legal obligation

Once we have considered your request, we will inform you of our decision.

Right to restrict processing

You can ask us to restrict the processing of your personal data in the following circumstances:

• You believe that the data is inaccurate and you want us to restrict processing until we determine whether it is indeed inaccurate
• The processing is unlawful and you want us to restrict processing rather than erase it
• We no longer need the data for the purpose we originally collected it, but you need it to establish, exercise or defend a legal claim
• You have objected to the processing and you want us to restrict processing until we determine whether our legitimate interests in processing the data override your objection.

Once we have determined how we propose to restrict processing of the data, we will contact you to discuss and, where possible, agree this with you.

Right to data portability

Where processing is based on your consent or on a contract, and carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format. You also have the right, where technically feasible, to request that we transfer this data directly to another organisation. This right only applies to personal data that you have provided to us.

Right to object

You have the right to object to the processing of your personal data where:

• the processing is based on legitimate interests or public task
• the processing is for direct marketing purposes

Once you have objected, we will assess whether we have compelling legitimate grounds to continue processing your data.

Rights in relation to automated decision-making

You have the right not to be subject to a decision based solely on automated processing (including profiling) where that decision produces legal effects or similarly significant effects on you, unless an exception applies.

Where such processing takes place, you have the right to:

• obtain human intervention
• express your point of view
• contest the decision

Making a complaint

If you are dissatisfied with the way we process your personal data, we ask that you contact us at info.access@durham.ac.uk so that we can try and put things right. If you remain unhappy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). 

The ICO can be contacted at:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: +44 (0)303 123 1113

Website: Information Commissioner’s Office

(Updated June 2026)