Compliance Policy Guidance
Version 5 – Supersedes Version 4 in its entirety – 15/02/2022
We provide a compliance support service to controllers for whom we act as processor. It is not a means of outsourcing legal compliance or regulatory liability to us, although we may be liable if we were to give incorrect guidance.
A controller is in principle liable for the actions of its processors, such as security service and software as a service (SaaS) providers, who may also be liable in the event of a breach of instructions given by you. With this in mind it is important that you have a comprehensive Data Processing Agreement in place with your processors.
This is a living online document. Its guidance is based on current interpretation of UK legislation and best practice, both of which we keep under regular review. It is advisable to check the version number of any printed copy against the current online version to ensure you are referring to the latest version.
We aim to update this document from time to time to cover developments in the law and changes in accepted best practice affecting surveillance and security systems. We may also update the scope of service from time to time to reflect changes in law and best practice.
- Key Definitions
- 1. Data Privacy Impact Assessment
- 2. Privacy Policy & Privacy Notice
- 3. Legitimate Interest Assessment
- 4. Data Management Hierarchy & Responsibilities
- 5. Data Protection Principles & Penalties
- 6. Purposes of Data Processing
- 7. Data Breach Reporting
- 8. Rights of the Individual
- 8.1. Data Subject Access Request
- 8.2. Right to be Informed
- 8.3. Right to Erasure
- 8.4. Right to Rectification
- 8.5. Right to Withdraw Consent
- 8.6. Complaints Procedure (Surveillance)
- 9. Security of Access
- 9.1. Password Protection Management
- 9.2. Security Control Room
- 9.3. Destruction and Deletion of Personal Data
- 9.4. CCTV Monitoring
- 10. SIA Public Space Surveillance
- 11. Data Viewing & Release
- 12. System Specific Guidance to Rights and Processes
- 12.1. CCTV
- 12.2. Body Worn Cameras
- 12.3. Dash Cameras
- 12.4. Automatic Number Plate Recognition
- 12.5. Biometric Recognition Technology (FRT)
- 12.6. Persons of Interest Images
- 12.7. Drones
- 12.8. Voice Recordings
- 12.9. Covert Surveillance
- 12.10. Electronic Access Control
- 12.11. Visitor Logging Pass Badges
- 12.12. Daily Occurrence Log Entries
- 12.13. Cloud Computing
- 12.14. Lost Property
- 12.15. Accident Book
- 12.16. Key Register
- 12.17. Controlled Media Register
- 12.18. Miscellaneous Data Storage
- 13. Record Keeping & Archiving by Data Processors
- 14. Data Sharing
- 15. Information Signage
- 16. VeriFi Management Documentation
- 17. Data Processing Agreement
- 18. VeriFi Data Subject Access Request Process
- 19. Frequently Asked Questions
- 20. Secure File Sharing + CCTV Evidence Download Service
- 21. VeriFi Framework Agreement
- 22. VeriFi Appointment Form
- 23. Transition to Online Data Compliance Management
- 24. Version Register