A DFR programme produces a lot of data: live video, recorded footage and material that may become evidence. How a force handles that data is central to public trust and to staying within the law. This guide sets out the main areas UK forces need to cover. It is general guidance rather than legal advice, and the regulatory picture changes, so confirm the current position with your data protection and legal teams.
Why data governance sits at the centre
DFR works only if the public accepts it. That acceptance rests on being able to show what data is collected, why, who can see it, and how long it is kept. Treating data governance as an afterthought is the fastest way to lose confidence in a programme, so it belongs in the plan from the start.
UK data protection
Aerial video that captures identifiable people is personal data, so UK GDPR and the Data Protection Act 2018 apply. In practice that means having a clear lawful basis for what you collect, collecting no more than you need, and completing a Data Protection Impact Assessment (DPIA) before you operate. The DPIA is where you work through the privacy risks and how you reduce them, and it is something the regulator and the public may expect to see.
Surveillance and oversight
Police use of overhead cameras also engages surveillance camera guidance and the wider oversight regime. The exact bodies and codes in this space have changed in recent years, so check the current arrangements rather than relying on older guidance. The underlying expectation is steady: use must be necessary, proportionate and transparent.
Handling footage as evidence
When footage becomes evidence, the bar rises. You need to be able to show:
- Integrity. The footage has not been altered.
- Chain of custody. Who handled it and when, from capture to disclosure.
- Redaction. A way to protect uninvolved people when material is shared or disclosed.
- Retention. Clear rules for how long footage is kept and when it is deleted.
These are easier to meet when they are built into the system rather than handled manually after the fact.
Where the data lives
For public sector buyers, where data is stored and who controls it is a real procurement question. Being able to evidence that information is handled under UK frameworks matters to many forces. This is part of why we built IDI around UK data handling, and it is worth raising with any vendor you assess. For how this fits the wider buying decision, see our platform comparison.
A note on CJIS
You may see CJIS compliance mentioned in DFR discussions. CJIS is a United States criminal justice information standard. It is relevant context if your systems or partners touch US requirements, but UK forces work to UK frameworks. Do not assume a US standard substitutes for UK data protection obligations.
FAQs
Do we need a DPIA for DFR?
In almost all cases, yes. DFR involves capturing personal data in public places, which is exactly the kind of processing a Data Protection Impact Assessment exists to cover. Complete it before you operate.
Who can access DFR footage?
That is for your force to define and control, and being able to show it is part of maintaining trust. Access controls and an audit trail should be part of the system.
Is CJIS compliance required in the UK?
CJIS is a US standard. UK forces follow UK data protection law. CJIS may be relevant context in some setups, but it does not replace UK obligations.
How long should footage be kept?
Long enough to meet operational and evidential needs, and no longer. Set clear retention rules and delete in line with them.
