Privacy Notice: CCTV

Dumfries & Galloway College (the College) is providing you with this information to comply with data protection law to ensure that you are fully informed and that we are transparent in how we collect and use your personal data.

Your privacy and trust are very important to us and this Privacy Notice provides essential information about how the College handles your personal data and the rights you have in relation to how we use your data. The College is committed to complying with all applicable Data Protection legislation.

Who are we?

Dumfries & Galloway College is the ‘Controller’ and is responsible for looking after the personal data that you provide.

Registered office:

Dumfries & Galloway College
Bankend Road

For any queries or concerns about how your personal data is being processed you can contact the Data Protection Officer (DPO) at

This privacy notice relates to the following process:

Recording and sharing of CCTV footage on Dumfries and Galloway College sites.

Purpose for processing – why do we collect information about you?

We collect and use your information for the following purposes:

  • To assist in securing premises and ensuring safety and security of students, staff and visitors.
  • To facilitate the identification, apprehension and prosecution of offenders in relation to crime, if footage is requested by relevant authorities.

Our lawful bases (reasons) for processing your information are:

  • Use is necessary for us to comply with a legal obligation: Health and Safety at Work etc. Act 1974
  • Use is necessary for performing a task in the public interest or under official authority vested in us: safety and security of staff, students and visitors and security of property.

The data being used includes special category (sensitive) data. Our legal reason for using this sensitive data is/are:

  • Processing is necessary for reasons of substantial public interest and is authorised by domestic law proportionate to the aim pursued.  Data Protection Act 2018, Schedule 1, Part 2 (10) – preventing or detecting unlawful acts (when sharing footage with relevant authorities).

What information do we collect about you?

We collect footage and images.

How do we collect it?

Digital recordings are made using digital video recorders operating in time lapse mode. Incidents may be recorded in real time.

Who do we share your information with?

Disclosure of recorded material will only be made to third parties in strict accordance with the purposes of the system and is limited to the following authorities:

  • Law enforcement agencies where images recorded would assist in a criminal enquiry and/or the prevention of terrorism and disorder.
  • Prosecution agencies.
  • Relevant legal representatives.
  • The media where the assistance of the general public is required in the identification of a victim of crime or the identification of a perpetrator of a crime.
  • People whose images have been recorded and retained unless disclosure to the individual would prejudice criminal enquiries or criminal proceedings.
  • Emergency services in connection with the investigation of an accident.

Details of data transfers to any third countries or international organisations

Your information will not be shared outside of the UK.

How do we look after your information and how long do we keep it for?

We will take all reasonable steps to prevent the loss, misuse or alteration of information you give us. Your personal information will be stored securely and will only be accessed by authorised staff, agents, contractors and other organisations who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality and must comply with data protection law.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Images will normally be retained for eighteen days from the date of recording, and then automatically over written and the Log updated accordingly. Once a hard drive has reached the end of its use it will be erased prior to disposal and the Log will be updated accordingly.

In some instances, a longer retention may be required where a law enforcement body is investigating a crime as part of an active investigation. In this instance, a new retention date will be fixed for the footage.

Automated decision making processes, including profiling

We do not use any automated decision-making about you.

Your rights

Under Data Protection laws you have certain rights in relation to how the College manages and uses your personal information:

  • The right to be informed (this is the Privacy Notice)
  • The right to access your personal data
  • The right to rectification if the personal data we hold about you is incorrect
  • The right to restrict processing of your personal data

In addition the following rights apply only in certain circumstances:

  • The right to withdraw consent at any time (if consent is our lawful basis for processing your data)
  • The right to object to our processing of your personal data
  • The right to request erasure (deletion) of your personal data
  • The right to data portability
  • The right not to be subject to automated decision making including profiling.

For more information about your rights please see

Contact us

If you have any issues about this notice or the way the College has handled your personal information, please contact our Data Protection Officer in the first instance:


Telephone: 01387 734 364 or write to:

Data Protection Officer
Dumfries & Galloway College
Bankend Road

Complaints to UK Information Commissioner’s Office (ICO)

If you are dissatisfied with the response from the College you have the right to lodge a complaint with the Information Commissioner’s Office about our handling of your data:

You can do this online: ICO Online

By telephone: 0303 123 1113

Or write to:

Information Commissioner’s Office
Wycliffe House
Water Lane