CCTV in nurseries

The rule today: CCTV is a provider's decision

No law or statutory framework requires a nursery in England to have CCTV. The Department for Education minister Olivia Bailey set out the position in a written answer on 23 February 2026, UIN 110645 on nurseries and CCTV: “Decisions about installing and using CCTV are for individual providers, subject to safeguarding and data protection requirements. While CCTV can support safeguarding, it is most effective when combined with strong safeguarding cultures, supported by training, supervision and effective oversight.” She repeated the position on 7 April 2026 in UIN 123429: “Decisions about using monitoring and recording equipment are for individual providers, subject to safeguarding and data protection requirements.”

The requirements a nursery works to are the Department for Education's, in the EYFS statutory framework for group and school-based providers, in force from 1 September 2026; Ofsted registers and inspects settings against it. Paragraph 3.6 says safeguarding policies must include “How mobile phones, cameras and other electronic devices with imaging and sharing capabilities are used in the setting.” A nursery that has CCTV therefore needs it covered in its safeguarding policy, alongside phones and tablets.

The position is under review, and the timetable has moved:

• December 2025. The Secretary of State for Education announced an expert advisory panel to review how digital devices and CCTV are used in early years settings.
• 7 January 2026. A letter from Baroness Smith to Lord Storey, deposited in Parliament, said the panel would “inform guidance for the sector on the effective and safe use of CCTV and digital devices” and that “The guidance will consider the question of whether CCTV ought to be mandated”.
• 4 February 2026. The minister set out the panel's scope in a Westminster Hall debate on CCTV in nurseries and early years providers, and said it would meet monthly. On 23 February the minister said its first meeting would take place in early March.
• 7 April 2026. UIN 123429: the panel “has been appointed and is working at pace”, and the guidance it is informing “will consider whether CCTV should be mandated and will set out best practice, technical advice and clear expectations. It will be published in summer 2026.”
• 22 June 2026. The Department's press release Safer nurseries with 3,000 more surprise Ofsted visits said: “An independent expert panel is also examining the use of digital devices and CCTV in childcare settings, with ministers committed to publishing its findings and considering all recommendations.”
• 15 October 2026. The Leader of the House, Sir Alan Campbell, said at Business of the House on 15 October 2026: “The Department for Education has established an expert advisory group on safeguarding, which is looking at the use of CCTV and digital devices in early years settings; it will report before Christmas.”

On 28 October 2026 a search of GOV.UK found nothing published by the Department for Education on CCTV since that statement. The summer 2026 date has passed without guidance; CCTV has not been made mandatory, and it has not been ruled out. When the group reports, this guide will be updated.

What the expert group is considering

In the 4 February 2026 debate the minister listed the questions the panel would consider, “including, but not limited to, whether CCTV should be mandated in early years settings, CCTV's role as part of a setting's wider safeguarding measures, how CCTV and digital devices should be managed to ensure that children's privacy is protected alongside their safety, and what systems, training and safeguards are necessary to address concerns such as cyber-security and the possible misuse of images.”

She said the panel would include representatives of the Department for Science, Innovation and Technology and the Home Office, “along with relevant bodies such as the Information Commissioner's Office and the Office of the Children's Commissioner. In addition, the National Police Chiefs' Council will be invited”. She also told the debate: “nothing is off the table for me as I think about how to keep our children safe.”

The Department has been careful about what cameras can do on their own. The 7 January 2026 letter said: “Sadly, past incidents have shown that the presence of CCTV has not prevented harm.” It added that “where it is used, CCTV is always a part of a broader focus on improving safeguarding awareness, training and practice”, and that “The panel will consider effective management of risks, and questions regarding the oversight of digital devices in settings, including cyber security where settings do hold footage of children.”

For a nursery deciding now, that has two practical consequences. First, cameras do not replace the things the EYFS already requires: supervision of staff, safer recruitment, a designated safeguarding lead and a culture in which concerns are raised. Second, any CCTV system installed now has to meet the data protection law that already applies, set out in the next three sections, and the decision should be reviewed when the group's report and any guidance are published.

Before you install: purpose, lawful basis and a DPIA

CCTV that captures identifiable children, parents and staff is processing personal data under UK GDPR, and the nursery is the controller. The regulator's guidance is the ICO's Video surveillance (including guidance for organisations using CCTV), in particular its page “How can we comply with the data protection principles when using surveillance systems?”. The office of Information Commissioner was abolished on 30 September 2026 by section 118 of the Data (Use and Access) Act 2025, and the regulator is now the Information Commission, still known as the ICO; its CCTV guidance carries the banner “Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change.”

The steps before the first camera goes up:

1. Write down the purpose. Safeguarding children, the security of the building, or both. The purpose decides where cameras go, who may view footage and how long it is kept, and the ICO says footage can be used for a new purpose only if that purpose is compatible with the original one, the individuals consent, or there is a clear obligation or function set out in law.
2. Choose and document a lawful basis. The ICO says “For any use of surveillance systems, you need to identify and document a lawful basis under Article 6 of the UK GDPR”, and that “In practice, it is often difficult to obtain genuine consent from individuals for processing their personal data in public spaces”, so “it is likely the appropriate lawful basis will be either legitimate interests, or a reliance on public task”. A private, voluntary or independent nursery will usually rely on legitimate interests; a maintained school nursery will usually rely on public task. The Department for Education's guidance for schools, Taking and using photos and videos, and using CCTV in schools (a section added to Data protection in schools on 23 March 2026), is blunter: “Unlike for photos, consent is not appropriate as a lawful basis for CCTV”.
3. Carry out a data protection impact assessment (DPIA). The ICO's page on What are our responsibilities in terms of accountability? says a DPIA before processing “is a legal requirement and applies in most cases relating to video surveillance given the inherent privacy risks involved in the use of these systems.” If a setting decides not to do one, “you need to document your reasons and be prepared to justify why the processing is not of a type likely to result in high risk.” A system recording young children all day will rarely clear that bar.
4. Test necessity and proportionality. The DPIA should ask whether a less intrusive measure would meet the purpose – better sight lines, door entry control, more senior presence in rooms – and which rooms genuinely need a camera. The ICO's own example of cameras in school toilets concludes that “Given the potential level of intrusion, this use is unlikely to be proportionate in most circumstances.”
5. Consult the people it will record. The same DfE guidance says a school that decides to install CCTV must “consult with pupils, parents or carers and staff”, “explain where the cameras will be” and “explain what the footage will be used for”. It is written for maintained schools and academies; for a nursery, including one run by a school, it is the clearest official benchmark available.

Staff are data subjects too. A camera in a playroom records the practitioners working there for most of their day, and the DPIA and the staff privacy notice should say so plainly, including whether footage could be used in a disciplinary process and in what circumstances. The DPIA guide for schools sets out the method and what a template holds.

Where cameras go, signs, audio and remote viewing

Nappy-changing areas and toilets are the hardest places to justify. The ICO says that in public toilets and changing rooms “the use of visual or audio recording would not be expected and often difficult to justify. If you are considering surveillance systems in these environments, you should only use them in the most exceptional circumstances, where it is necessary to deal with very serious concerns.” The same reasoning applies with more force to a nursery's toilets and nappy-changing areas. Paragraph 3.88 of the EYFS group framework adds that providers must ensure “Children's privacy is considered and balanced with safeguarding and support needs when changing nappies and toileting.” A nursery that wants assurance about intimate care will usually get it from layout, open doors, staffing and supervision rather than a lens.

Everyone must be told. The ICO says: “In any case, you must let people know when they are in an area where a surveillance system is in operation.” In practice that means signs at the entrance and in each covered area, backed by the privacy notices for parents and for staff, because Article 13 of UK GDPR requires people to be told when their data is collected. The DfE schools guidance adds: “You must ensure there are clearly visible signs in place to inform people that CCTV is in use and explain its purpose.”

Turn the sound off. The ICO's checklist reads: “We only use audio recording where there is an evidenced and justified need” and “Any audio capabilities in our system are switched off by default.” Its guidance says “You should not normally use surveillance systems to directly record conversations between members of the public. This is highly intrusive and unlikely to be justifiable in most circumstances”, and the DfE schools guidance says “You should not use CCTV to record conversations.” Check whether each camera has a microphone and how it is set, rather than assume.

Remote and app viewing is processing as well. The ICO treats live streaming over the internet as processing even where nothing is saved, and its checklist expects a controller to have considered “the data protection implications of using other functions, such as audio recording, live streaming and cloud storage” and documented them in the DPIA. Where footage is stored in the cloud, “You need to ensure that this system is secure.” A system that lets parents watch rooms on their phones streams pictures of other people's children to devices the nursery does not control; the DPIA must address that directly, and the minister's list of the panel's questions names cyber security and misuse of images.

The CCTV section of the safeguarding policy, the paragraph 3.6 policy on devices with imaging and sharing capabilities, should then say:

• the purpose of the system and the lawful basis relied on;
• where each camera is, what it covers and confirmation that audio is off;
• who may view live and recorded footage, from where, and how each viewing is logged;
• the retention period, and who may preserve footage beyond it and why;
• how requests from parents, staff, the police and the local authority designated officer (LADO) are handled;
• that staff may not copy, photograph or share footage on personal devices;
• how staff are trained in the policy, including recognising a request for footage and saving footage after an incident;
• when the DPIA and the policy will next be reviewed, including when the Government's guidance is published.

Keeping, viewing and releasing footage

There is no legal retention period for CCTV footage. The ICO says “The UK GDPR and the DPA 2018 do not prescribe any specific minimum or maximum retention periods which apply to surveillance systems or the personal data you may process. Rather, it is the purpose of your processing that should determine your retention period.” It warns that “footage from a surveillance system shouldn't be kept for six months merely because the manufacturer's settings on the surveillance system allow retention for this length of time”, and the DfE schools guidance says the period “should be set for the shortest period that meets your purpose” and “should not be determined by the storage capacity or the manufacturer's settings”. A nursery sets its own period, writes the reason in its DPIA and retention policy, and configures the recorder to match.

Specific footage can be kept longer for a reason. The ICO gives the example of a law enforcement agency that “is investigating a crime and asks for you to preserve it”. The same applies when an incident is reported, or a concern about a member of staff or an injury to a child is raised: the footage covering that time has to be found and saved before the recorder overwrites it, and the decision to save it, who made it and where the clip is now should be written down.

Viewing should be limited. The ICO's checklist for limited CCTV systems asks a controller to confirm: “We securely store images from this system for a defined period and only a limited number of authorised individuals may have access to them.” The ICO does not say who; in most nurseries a sensible choice is the manager and the designated safeguarding lead, with each viewing recorded.

Footage can be given to the police. The ICO's Governance post-deployment page says “it is still acceptable to disclose information to law enforcement agencies, if relevant”, and warns that “You should approach any other requests for information with care, as wider disclosure may be unfair on the individuals concerned.”

Parents and staff can ask for footage of themselves or, for a parent, of their young child, through a subject access request. The ICO says “You must provide information promptly and within one month of receiving the request” (extendable by two months for a complex request; the linked SAR guide covers when the clock starts and pauses), and that “Your obligations under the UK GDPR are to provide a copy of the information about the requester rather than a complete version of footage.” Because nursery footage almost always shows other children and staff, the ICO's guidance on information about other people in a SAR applies: disclose their information only where “the other person has consented to the disclosure; or it is reasonable to disclose the information without their consent.” The nursery is “not obliged to ask for consent”, and an employee may not be able to give it freely. Often the answer is a clip with other people blurred or masked, techniques the ICO names for redacting footage. Keep a log of each request and how it was dealt with; the ICO's checklist expects one. The subject access request policy guide covers the clock, identity checks and exemptions.

The decisions about footage are made by message

The camera records the room. What happens to that recording is decided somewhere else. A room leader messages the manager at half past four: can you save room 2 from 10:15 before it overwrites, there's a mark on a child's arm. The manager replies from home that she has saved it and told the DSL. A parent texts the key person asking to see what happened at lunch. The owner, off site, messages back that the parent can see a clip once the other children are blurred.

Those messages are the record of whether footage was preserved, who looked at it, who was told and why a request was answered as it was. If the concern becomes an allegation, a LADO referral or an Ofsted enquiry, they are the evidence of what the setting knew and when. In some nurseries they sit in a WhatsApp group on staff phones, where the setting cannot search them, keep them or show who saw them, and where they leave with the person who resigns.

ComplyChat is not a CCTV or video system and does not store footage. It provides channels for staff work conversations, with everyone added told the channel is on the record, and a mobile number verified by SMS as the identity, so practitioners without a work email account can be in the same channel as the manager. Messages are recorded on the server as they are sent, and on paid plans, once the setting's Microsoft 365 tenant is connected, conversations are kept there, under the retention schedules the setting already runs.

A question for the next leadership meeting: if footage were needed tomorrow, where would the request to keep it, the decision to keep it and the record of who viewed it be written down?

Questions people ask

Is it a legal requirement to have CCTV in a nursery?

No. Ministers have said “Decisions about installing and using CCTV are for individual providers, subject to safeguarding and data protection requirements” (23 February 2026, and in similar words on 7 April 2026). An expert advisory group is considering whether CCTV should be mandated; guidance promised for summer 2026 has not appeared, and on 15 October 2026 the Government said the group will report before Christmas. No requirement had been made on 28 October 2026.

Do nurseries have to tell people they have CCTV?

Yes. The ICO says “you must let people know when they are in an area where a surveillance system is in operation”, usually by clearly visible signs backed by the privacy notice, because Article 13 of UK GDPR requires people to be told when their data is collected.

How long can a nursery keep CCTV footage?

There is no fixed legal period. The ICO says UK GDPR and the Data Protection Act 2018 “do not prescribe any specific minimum or maximum retention periods” for this footage, and the purpose decides it. Set the shortest period that meets the purpose, not the recorder's default, and preserve specific footage when a concern is raised or the police ask.

Is CCTV in a nursery a breach of GDPR?

Not in itself. CCTV that records identifiable people processes personal data, so it needs a defined purpose, a documented lawful basis (often legitimate interests for a private nursery, or public task for a maintained school nursery), a DPIA in most cases, signs, a set retention period and access controls. The ICO says genuine consent is often difficult to obtain for cameras in public spaces, and DfE says consent is not appropriate for school CCTV.

What are the new laws regarding CCTV in the UK?

No new CCTV law applies to nurseries. The Data (Use and Access) Act 2025 changed parts of UK GDPR, and the ICO says its CCTV guidance “is under review and may be subject to change” as a result; the regulator itself has been the Information Commission since 30 September 2026.

Can parents see nursery CCTV footage?

A parent can make a subject access request for footage of their child, which must be answered within one month, extendable by two months for a complex request. Footage that also shows other children or staff is their personal data too, so the nursery must decide whether they consent or whether it is reasonable to disclose without consent, and will usually blur or withhold those parts.

Official guidance and your next step

The primary sources are the ICO's Video surveillance (including guidance for organisations using CCTV), read with its accountability and governance pages; the EYFS statutory framework for group and school-based providers, paragraphs 3.6 and 3.88; and, as a benchmark, the Department for Education's CCTV section of Data protection in schools. For the Government's review, the most recent dated statement is Business of the House, 15 October 2026. Quotations are from those pages as published on 28 October 2026.

This guide is a summary for group early years providers in England, not legal advice about a particular system, request or concern. The GDPR for nurseries guide covers the wider data protection duties, and the EYFS safeguarding and welfare requirements guide maps section 3 of the framework.

Then do one thing: open the recorder's settings and write down three facts – how many days it keeps footage, whether any camera has its microphone on, and who has a login. If the answers are the manufacturer's default, yes, and nobody is sure, start the DPIA there.