Self Storage Security and CCTV in the UK: What the Crime Data and the Rules Say

As at 18 October 2026, we found no official England and Wales crime statistic that counts self storage. The nearest police category, “Non-residential burglary”, recorded 69,490 offences in 2025/26. On 18 October 2026 we found nothing that makes CCTV compulsory at a self storage site. Cameras that record people come under the UK GDPR, and the ICO’s guidance on them carries an under-review banner. This guide keeps law, regulator guidance, police policy and scheme rules apart.

This guide covers data protection law and the Information Commissioner’s Office (ICO) guidance for the United Kingdom, the crime statistics and the Surveillance Camera Code for England and Wales, and the police alarm policy for England, Wales and Northern Ireland. We did not check Scottish or Northern Irish crime statistics, or planning policy outside England. It is general information, not legal advice. A count of recorded offences is not a rate or a risk for any one site.

The Home Office police recorded crime tables print “Next scheduled update: October 2026”, ONS names 22 October 2026 as its next release, and the ICO’s video surveillance guidance carries a banner saying it is under review.

How many burglaries at business and community premises do the police record?

Police recorded crime for England and Wales counted 69,490 offences in the offence subgroup “Non-residential burglary” in 2025/26, the year ending March 2026. On 18 October 2026 we found no official statistic that counts self storage.

That is 31.1% of the 223,456 burglaries of every kind recorded that year (our calculation). “Recorded” means offences the police recorded, not every offence committed. ONS names police recorded crime the primary source for non-residential burglary, and says the data are official statistics, not accredited official statistics, and miss offences not reported to or recorded by the police.

On 18 October 2026 we found no self storage word or category in the Home Office police recorded crime pages, tables and counting rules, in the ONS crime bulletin, user guide and related-data pages, or in any sheet of the ONS appendix tables workbook.

The Home Office table labels its main code “Burglary Business and Community” (30C): 60,043 of the 69,490 offences, or 86.4% (our calculation). The other two codes, “Attempted Burglary Business and Community” (30D) and “Aggravated Burglary Business and Community” (31A), are 8,891 and 556. The counting rules for 30C take in buildings used solely for business, or otherwise entirely outside the residential class, “such as a place of worship”.

On 18 October 2026 the table has no field for the kind of premises. Our reading, an inference, is that a burglary at a storage site is counted with every other business or community building.

From April 2017, ONS says, residential and non-residential subcategories replaced domestic and non-domestic burglary, and residential burglary took in all buildings or parts of buildings within the boundary of, or forming part of, a dwelling. ONS also says meaningful comparison over time is not currently possible for the subcategories, and that there were “no changes made to burglary in commercial or community buildings”.

The count was 206,198 in 2016/17 under the label “Non-domestic burglary” and 127,770 in 2017/18 under “Non-residential burglary”, a fall of 38.0% in the year of the change (our calculation).

On 18 October 2026 we found no source that says how much of the fall from 206,198 in 2016/17 to 127,770 in 2017/18 the April 2017 change explains.

The figure draws only the nine years of “Non-residential burglary” from 2017/18. The count fell from 115,225 in 2019/20 to 71,582 in 2020/21, a fall of 37.9% (our calculation), and was 69,490 in 2025/26, the lowest of the nine. That is 11.7% below 2024/25, 18.3% below 2022/23 and 45.6% below 2017/18 (our calculation from the counts in the figure).

The yearly counts are our sums of four quarters over 44 force names, the 43 territorial forces and the British Transport Police, from a Home Office table that shows “Updated: 23 July 2026”. Our sums for five burglary series match the ONS appendix table in 72 of 72 cells.

What does the Commercial Victimisation Survey say about burglary at businesses?

On 18 October 2026 the Home Office’s Commercial Victimisation Survey published burglary for eight sector groupings of business premises in England and Wales, and none of them was self storage.

The grouping that holds transport and storage, “Transport, accommodation, and food” (sections H and I of the Standard Industrial Classification), had 11% of premises as victims of burglary, including attempts, in the previous 12 months. That is the combined 2022 and 2023 estimate, with a 95% interval of 8 to 15, from 558 premises asked.

On 18 October 2026 we found no self storage word or category in the survey’s pages, tables or technical reports, and no storage or warehouse word in the eight sector groupings its burglary tables use; the nearest label, “Transportation and Storage”, appears only in the two technical reports, with no burglary figure.

The survey asks a sample of premises about crime in the previous 12 months. The sample leaves out businesses run from domestic properties or mobile vehicles, and is likely to miss some recently formed and small companies.

The survey is paused. The collection page, last updated 9 May 2024, says so, and lists the 2023 survey (bulletin published 9 May 2024, last updated 11 September 2024) as its newest bulletin.

For all premises, burglary including attempts was 9% in 2022 (interval 7 to 10) and 8% in 2023 (6 to 9). For “Transport, accommodation, and food” it was 13% (7 to 18) on 283 premises in 2022 and 10% (6 to 15) on 275 in 2023.

The bulletin says small samples mean most individual sectors cannot be analysed, and that direct comparison between most sectors is not possible. The grouping’s burglary interval overlaps those of five of the other seven groupings in the combined table, but not the other two (our calculation from the printed limits), and overlapping intervals do not always show a lack of statistical significance. This guide ranks no grouping.

The data tables print the grouping as “Transport, accomodation and food”, their own spelling; the figure uses the bulletin’s.

Is CCTV required at a self storage site?

On 18 October 2026 we found no Act, regulation, code or England’s national planning text that requires cameras at a self storage site. What sets conditions for cameras, in the sources we read, is a police crime prevention scheme and some individual planning permissions.

On 18 October 2026 we found no result of the legislation.gov.uk text search for self-storage, or for “self storage”, that concerns cameras or crime, no title among its 121 results for CCTV that names a storage business, and no instrument in both lists.

The four titles among the 121 that name closed circuit television are slaughterhouse regulations, one for each nation, headed “Mandatory Use of Closed Circuit Television in Slaughterhouses”. We read titles, not the instruments.

Section 33 of the Protection of Freedoms Act 2012 puts a duty on a “relevant authority” to have regard to the Surveillance Camera Code, and says a failure to act in accordance with the Code does not of itself make a person liable to criminal or civil proceedings. Our guide to licences, registrations and duties holds section 33, the data protection fee, the ICO banner and the keyholder summary.

The amended Code was laid before Parliament on 16 November 2021 and took effect on 12 January 2022, and the 2013 Code was withdrawn on 17 February 2022. It says operators that are not relevant authorities “do not have to have regard” to it, though it is still considered best practice. The ICO says the Code applies only to relevant authorities in England and Wales.

On 18 October 2026 we found no self storage word in the amended Surveillance Camera Code of Practice, the page for the 2013 Code, the page announcing the update or the Biometrics and Surveillance Camera Commissioner’s page.

SSA UK’s page for its annual industry report 2026 lists “90.8% of Stores Use Monitored CCTV” among its key takeaways, and we do not read it as a share of all UK stores. On 18 October 2026 we found no sample size, number of respondents, base or definition of “monitored” within 400 characters of the 90.8% figure on either page that prints it, and no 90.8 on the report’s interactive page.

The Home Office survey’s 2023 table of protection measures, for premises of every sector, gives “CCTV looking at the road or grounds outside” at 61% (base 996), “Burglar alarm” at 73% (970) and “Security lighting including sensor / timed lights” at 64% (996). The figures come from a half sample, and respondents could give more than one answer.

On 18 October 2026 we found no use of the word “sector”, or of the grouping names “Construction”, “Manufacturing” or “Transport”, in those tables.

Which data protection rules apply to cameras that record people?

The UK GDPR and the Data Protection Act 2018 apply to all organisations that process personal data across the UK, and the ICO’s video surveillance guidance says what the ICO expects of cameras that record people. On 18 October 2026 all 9 captured pages of that guidance carried the banner “Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change”.

On 18 October 2026 the banner was also on the small-organisation CCTV page, and not on the CCTV landing page or the 4 captured lawful basis pages. On 18 October 2026 only the governance page of the guidance printed a date, “Last updated 24 January 2024”.

This is regulator guidance, not law. The ICO’s brief guide to subject access says “must” refers to legislative requirements or binding case law and “should” to what it expects unless there is a good reason, an approach it applies only where indicated. What the video surveillance guidance says, as read on 18 October 2026:

• Scope: public and private systems, from traditional CCTV to facial recognition. It does not cover “dummy” or non-operational cameras, because no personal data is likely to be processed.
• Lawful basis: the ICO says an organisation needs to identify and document a lawful basis under Article 6 of the UK GDPR, and adds that consent is often hard to obtain in public spaces, so legitimate interests is likely, or public task for a public authority.
• Signs: the ICO says an organisation must tell people when a surveillance system is in operation, and suggests signs before the entrance to the field of view, reinforced inside, giving the operator, the purpose and who to contact. It says a website alone “is not enough to comply”.
• Impact assessment: the full guidance calls a data protection impact assessment “a legal requirement and applies in most cases relating to video surveillance”, and says one must be performed for any processing likely to result in a high risk to individuals. The small-organisation page says one is needed if CCTV “is likely to result in a high risk to people”.

On 18 October 2026 we found no mention of self storage on the 24 ICO pages we captured, and the ICO’s site search for the quoted phrase “self storage” returned no results.

The ICO’s plans page says it has started work on new guidance because of the Act and has withdrawn some planned guidance. On 18 October 2026 we found no CCTV, video surveillance or camera item on the six ICO plans pages we captured. We did not capture the plans sub-pages on direct marketing, children’s information and freedom of information.

What changed with the Data (Use and Access) Act 2025?

Three changes may bear on cameras: a new lawful basis, recognised legitimate interest, with a crime condition; new time rules for answering requests; and a new regulator in law, the Information Commission. The dates, as legislation.gov.uk gives them on 18 October 2026:

• Section 70 and Schedule 4 (recognised legitimate interest): in force on 5 February 2026, so far as not already in force, by regulation 2 of S.I. 2026/82.
• Section 76 (time limits for requests): in force on 5 February 2026, and by regulation 4 not for a request the controller received before that date.
• Section 78 (a reasonable and proportionate search): treated as in force from 1 January 2024 and recorded by legislation.gov.uk as in force at Royal Assent.
• Sections 118 and 119 (the Information Commission): in force on 30 September 2026, by regulation 2 of S.I. 2026/1015.

Section 70(2)(b) inserts point (ea) into Article 6(1) of the UK GDPR: processing “necessary for the purposes of a recognised legitimate interest”, which applies only if it meets a condition in Annex 1. The crime condition is met where processing is necessary for detecting, investigating or preventing crime, or for apprehending or prosecuting offenders.

On 18 October 2026 we found no mention of CCTV, cameras, surveillance, premises or property in the text of section 70 or Schedule 4 of the Data (Use and Access) Act 2025, and none of CCTV, cameras or surveillance on the ICO’s recognised legitimate interest page. We found no mention of recognised legitimate interest on the 11 ICO video surveillance and small-organisation CCTV pages we captured on 18 October 2026.

Our reading, an inference: on those sources, whether cameras that record people to prevent crime meet the crime condition is an open question for the ICO or an adviser. The ICO’s page, dated 23 March 2026, says an organisation whose purpose is covered by the crime condition “must decide if using personal information is necessary for that purpose”.

On 18 October 2026 we found no entry on surveillance cameras, CCTV or the Biometrics and Surveillance Camera Commissioner in the contents list of the Data (Use and Access) Act 2025, which does have entries on biometric data.

Section 76 adds Article 12A: one month from the “relevant time”, which a controller can extend by two further months by notice. The days between asking for further information it reasonably requires and receiving it do not count.

On legislation.gov.uk, section 33 of the Protection of Freedoms Act 2012 already reads “the Information Commission”. On 18 October 2026 we found no use of that name on the 24 ICO pages we captured, so this guide says “the ICO” for the published pages.

How long can footage be kept and who can ask for it?

On 18 October 2026 the ICO’s guidance said the UK GDPR and the Data Protection Act 2018 do not prescribe any specific minimum or maximum retention period for surveillance systems, and that the purpose of the processing should determine it.

The ICO says personal data held for too long is by definition unnecessary, and the period should be the shortest for the purpose. It says the period should not be set simply by the system’s storage capacity or merely because of the manufacturer’s setting, and that a longer hold may be needed when a law enforcement agency asks for footage to be preserved. A small organisation, it says, should record the period in its CCTV policy and privacy information.

Secured by Design’s Commercial Design Guide 2025 says “Images should be stored for as long as is necessary, but the system should have the capacity to store images for at least 30 days”. Our reading, an inference: 30 days is a capacity figure, not a retention period, because the ICO says capacity should not simply set retention.

Our guide to customer records retention covers the general rules for keeping personal data and the clocks for requests.

The person filmed can ask for a copy. The ICO’s footage page, last updated 24 January 2024, says an organisation must respond promptly and within one month, and can extend by two further months if the request is complex or there are a number of requests.

On 18 October 2026 that page gave the one-month period and the two-month extension without the clock-stopping and search wording of the ICO’s brief guide to subject access, last updated 16 July 2026. Our reading, an inference: the two were not written against the same text.

For the copy, the ICO says an organisation must supply it in a permanent form or, if the person agrees, allow viewing, because a transcript or a still may not do. The ICO says there is no longer a standard fee, and that an organisation may refuse a request or charge a reasonable fee if the request for footage is manifestly unfounded or excessive.

On disclosure to the police, the ICO says it is in most cases appropriate when the purpose of the system includes preventing and detecting crime, and that it is not a legal requirement unless a court order applies. Its checklist asks that each disclosure be recorded with the date, who received it and why.

The ICO says other requests need care, because some disclosures may be an offence under section 170 of the 2018 Act if made knowingly or recklessly without the controller’s consent.

Do audio and number plate cameras change the rules?

The ICO asks for more with audio and number plate cameras: it says recording conversations between members of the public is “highly intrusive and unlikely to be justifiable in most circumstances”, and that a vehicle registration mark is personal data in most circumstances.

On audio, the ICO says an organisation should switch off by default any capability to record it, and should turn off an independent sound facility unless its use can be clearly justified and evidenced. The ICO says audio should be used only where a particular need is evidenced, less intrusive methods have been considered and audio is the only way, with extra steps to make clear that it is being recorded.

On number plate recognition, the ICO says it is more commonly used by law enforcement but is also used by privately-owned car parks and other businesses. The ICO says that, regardless of sector, an organisation should do a data protection impact assessment before deployment, showing that the use is necessary and proportionate. Its checklist includes clear signage and the line “We comply with the Surveillance Camera code of practice where required”.

What does the police response policy ask of a monitored alarm?

It is police policy, not law: the National Police Chiefs’ Council says its document sets the technical and procedural requirements for gaining a police response to a monitored alarm. The 20 minutes in it is the keyholder’s time to attend after being notified, not a police attendance time.

The requirements page lists “Police Requirements for Security Systems (Updated: 03/06/2026)”, and the cover shows February 2026 and a review date of April 2027. That is the version we read. The cover says the Council agreed to it being circulated to, and adopted by, forces in England, Wales and Northern Ireland, with operational choices made locally.

The only npcc.police.uk address we found holds an April 2018 text, with a review date of April 2019. Its keyholder and false-call numbers match the 2026 text in the sections we compared (our comparison), and one verb differs.

Police Scotland told an information request in December 2023 that the policy applies to England, Wales and Northern Ireland only, and that it uses its own policy of 2002. The Police Service of Northern Ireland says it has adopted the document with variations and states aims of 15 minutes for emergency calls and 60 for priority calls; its keyholder requirements, last modified in September 2022, say it keeps no keyholder database.

The figure sets out the conditions for Type A, a system that meets the document’s requirements; any other is Type B. Two more points from the document:

• Companies: each force keeps a list of “compliant companies”, and “Inclusion on the list does not infer that the company or its work has been inspected by the police”.
• Cameras: a remote detector-activated CCTV system gains a police reference number only if installed to BS 8418, which we did not read. Adding CCTV to a Type B system does not make it Type A.

On 18 October 2026 we found no self storage word in the National Police Chiefs’ Council security systems page or document, and no number of minutes in the police attendance aim of its Appendix A template, which reads “(?) minutes”.

The requirements page also has a sentence about research on intruder alarms, which we do not repeat. On 18 October 2026 we found no study, author, journal or year within 350 characters of the sentence on that page that begins “Academic research shows”.

A site with nobody on it raises other questions, which our guide to automated self storage covers: monitoring, cameras on an empty site and lone working. An intruder alarm is not a fire alarm, and the “alarm” fields in our guide to self storage fire statistics are about fire and smoke alarms.

The requirements document says customers who employ a commercial keyholding company must be aware of the Security Industry Authority’s licensing regulations. We did not check whether any licence applies to a storage site.

What do crime prevention schemes and planning policy say about security?

Secured by Design (SBD) is a crime prevention initiative operated by the police services of the UK, and a planning permission can attach security conditions to one site; neither is an Act that makes cameras compulsory.

The SBD Commercial Design Guide 2025, Edition 1, applies to SBD applications made after 1 March 2025. For self-storage centres (paragraphs 58.4 to 58.9) it says individual units “shall be connected to a monitored intruder alarm system”, with locks to named standards that we did not read.

The guide also sets a minimum of 25 frames per second for any video system, says an electronic access control system “is required” for all pedestrian and vehicular entrances, and asks for a perimeter fence at least 1.8 metres high. These are the scheme’s conditions for SBD approval, not law.

On 18 October 2026 we found no guide titled for self storage on the Secured by Design design guides page; its Commercial Design Guide 2025 has a section headed “Self-storage centres”.

For England only, the National Planning Policy Framework, published 17 August 2026 and last updated 29 September 2026, names natural surveillance in policy DP3. Policy P5 says proposals should anticipate and address possible malicious threats in relation to their occupiers and users, “especially where particular groups may be vulnerable to crime, or to the fear of crime”.

The practice guidance “Healthy and safe communities”, last updated 7 August 2022, says security as part of design “can help achieve places that are safe as well as attractive”. Its crime paragraphs 009 to 012 carry 2019 reference dates.

On 18 October 2026 we found no camera, CCTV, self storage, storage unit or warehouse wording in the National Planning Policy Framework’s index page and chapters 14, 16 and 17, or in the planning practice guidance pages we read, and no “surveillance” other than “natural surveillance”.

We found no “Design and Placemaking” entry on the planning practice guidance collection page on 18 October 2026, although policy DP3(4) of the Framework refers to guidance of that name.

Of 21 self storage appeal decision letters found by name in our planning appeals evidence, not a sample of all appeals, decided from 5 May 2022 to 5 October 2026, 4 have camera, CCTV or surveillance wording in their schedule of conditions, 4 have Secured by Design wording and 9 have lighting wording (our count). These are conditions on one site, not a rule.

In appeal 3275294, decided 5 May 2022, the Inspector set a condition for a “Final External Lighting and Security Surveillance Equipment Strategy”.

This guide gives no cost of cameras, fencing or lighting; our guide to the cost to build self storage lists them as build costs.

What this guide does not cover

This guide does not cover the following.

• ICO enforcement actions on cameras: on 18 October 2026 the ICO’s enforcement page did not apply our query, so we have no count.
• Camera arrangements in Scotland, where the ICO names a separate CCTV Strategy for Scotland (2011) that we did not read, and in Northern Ireland beyond what the ICO and the Police Service of Northern Ireland state, and each police force’s attendance times.
• Not checked: whether a Security Industry Authority licence applies at a storage site, security requirements set by lenders or other third parties, planning rules for lighting columns and camera masts, and employment law on monitoring staff.
• Fire and smoke alarms, which the fire statistics guide covers, and drones, body worn video, facial recognition and smart doorbells, which we did not read.

Questions to put to the ICO, the police and an adviser

These are questions to put to the people named, about a particular site.

• To the ICO or an adviser: can cameras that record people to prevent crime rely on recognised legitimate interest, and when will the guidance be revised?
• To the ICO or an adviser: does an impact assessment apply to this site’s cameras, and on what test?
• To the ICO or an adviser: what footage period can be justified for a stated purpose, and where is it recorded?
• To the installer: is the system Type A, is its police reference number current, and who are the listed keyholders?
• To the police, through the installer: which version of the requirements and which local variations apply, and what attendance aim does the force state?
• To the planning authority and the police Designing Out Crime Officer: does the permission carry camera, lighting or Secured by Design conditions?
• To a solicitor or the ICO: does the Surveillance Camera Code, or any order under section 33(5)(k), apply to this operator?
• To an adviser on security licensing: do the Security Industry Authority’s regulations apply to keyholding or guarding at this site?

Sources

All read on 18 October 2026.

• Office for National Statistics, Crime in England and Wales: year ending March 2026, released 23 July 2026, its user guide, last revised 23 July 2026, and the appendix tables dataset page.
• The Home Office police recorded crime and outcomes open data tables, last updated 8 October 2026, with the Police Force Area tables updated 23 July 2026, the user guide, and the Crime Recording Rules for frontline officers and staff, 2026/27, last updated 16 July 2026.
• The Home Office Commercial Victimisation Survey collection, last updated 9 May 2024, and the 2023 survey bulletin, published 9 May 2024, with its tables and the 2022 and 2023 technical reports linked from the survey pages.
• The ICO’s video surveillance guidance, its CCTV page for small organisations, and its recognised legitimate interest and legitimate interests pages, dated 23 March 2026.
• The ICO’s plans for new and updated guidance and its guide to subject access, last updated 16 July 2026.
• The Data (Use and Access) Act 2025: section 70, Schedule 4, section 76, section 78 and the contents list, with the commencement regulations S.I. 2026/82 and S.I. 2026/1015.
• The Protection of Freedoms Act 2012, section 33, and the Data Protection Act 2018, section 170.
• The amended Surveillance Camera Code of Practice, with the page announcing the update, last updated 3 March 2022, and the withdrawn 2013 Code.
• The legislation.gov.uk text searches for self-storage and CCTV, run on 18 October 2026.
• The National Police Chiefs’ Council security systems requirements page, hosted on policesecuritysystems.com, with the requirements document (cover February 2026, listed as updated 3 June 2026) and the April 2018 text at an npcc.police.uk address.
• The Police Service of Northern Ireland security systems page, its variations standard and keyholder requirements, and a Police Scotland reply of 7 December 2023.
• Secured by Design’s design guides page and its Commercial Design Guide 2025, Edition 1.
• The National Planning Policy Framework, published 17 August 2026 and last updated 29 September 2026, and the planning practice guidance collection with Healthy and safe communities, last updated 7 August 2022.
• SSA UK’s UK Annual Industry Report 2026 page.