PRINT-READY DATA PROTECTION IMPACT ASSESSMENT (DPIA)
Document Title: Data Protection Impact Assessment – Domestic CCTV System
Property Address: 130 & 130A High Street, Aberlour, AB38 9NY
Data Controller: Stella Taylor
Date of Assessment: 26/07/2026
Version: 1.0 (Final)
1. Purpose of this Document
This document is a Data Protection Impact Assessment (DPIA) for the security camera system installed at my holiday cottage.
The purpose of this DPIA is to:
-
Identify and minimise privacy risks to neighbours and other individuals who may be captured by the camera.
-
Demonstrate compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
-
Provide transparency to my neighbours regarding how their personal data (images) will be handled.
2. Why a DPIA is Required
The camera captures images of individuals on a shared access driveway (a joint right of way), which falls outside the boundary of my sole private property.
Because the camera captures areas beyond my own property, the domestic exemption does not fully apply. I am therefore processing personal data and have completed this DPIA to assess and mitigate any risks to the rights and freedoms of neighbours and other individuals.
3. Description of the CCTV System
| Item | Details |
|---|---|
| Camera Make & Model | Tapo C465 |
| Location of Camera | Mounted above the front door of the holiday cottage. |
| Field of View | Captures the immediate approach to the cottage and the shared driveway. It does not capture any part of the neighbours' private property (garden, windows, or doors). |
| Audio Recording | Permanently disabled (in response to neighbour requests and to minimise privacy intrusion). |
| Recording Mode | Continuous recording (24 hours a day, 7 days a week). |
| Storage Location | Cloud storage (Tapo Cloud). |
| Access Control | Footage is accessible only via a password-protected account. Only the Data Controller (myself) has the login credentials. |
| Retention Period | 30 days. Footage is automatically overwritten and deleted after this period by the cloud service. |
| Data Sharing | Footage will not be shared with any third party unless required by law (e.g., with the police in the event of a crime) or with my insurer for a legitimate claim. |
| Signage | A clear sign is displayed at eye height on the front door, directly underneath the camera, stating that "CCTV is in operation". |
4. Why is the Camera Necessary?
The camera is necessary for the following reasons:
-
The property has recently been subject to an act of vandalism.
-
The garden has also been vandalised on previous occasions.
-
As a holiday cottage, the property is unoccupied for periods of time, making it vulnerable to criminal damage.
-
The shared driveway is the primary access route for anyone approaching the property. Positioning the camera above the front door is the most effective and least intrusive location to capture anyone approaching the building.
-
Other less intrusive security measures (such as motion-sensor lights) have not prevented previous incidents.
5. Why is the Camera Proportionate?
The camera is proportionate because:
-
It covers only the shared driveway and the immediate approach to my property.
-
It does not capture the neighbours' private property (their garden, windows, or doors).
-
Audio recording is permanently disabled, which significantly reduces the privacy intrusion.
-
Footage is retained for a limited period of 30 days and then automatically deleted.
-
Footage is stored securely in the cloud with password protection, accessible only by me.
These measures achieve my legitimate security purpose while minimising the impact on my neighbours' privacy.
6. Risks and Mitigations
| Risk | Likelihood | Severity | Mitigation |
|---|---|---|---|
| Neighbours feel their privacy is invaded | Medium | Medium | Audio disabled; camera does not capture their property; clear signage is displayed; this DPIA has been shared with neighbours. |
| Footage is accessed by unauthorised persons | Low | High | Cloud account is password-protected; only I have the login credentials. |
| Footage is kept longer than necessary | Low | Medium | Automatic deletion after 30 days via the cloud service's auto-overwrite feature. |
| Neighbours exercise Subject Access Rights and I cannot respond | Low | Medium | I am aware of my obligation to respond to any Subject Access Request within one calendar month. |
| Complaint to the Information Commissioner's Office (ICO) | Low | Medium | Completion of this DPIA and adherence to all mitigations demonstrates a compliant and responsible approach. |
7. Consultation with Neighbours
| Item | Details |
|---|---|
| Have you consulted with neighbours? | Yes – I have spoken with the neighbours who share the driveway. They have expressed concerns about being recorded. |
| How have you addressed their views? | I have disabled audio recording as they requested. I have also confirmed that the camera does not capture their private property (only the shared driveway). I am sharing this completed DPIA with them to demonstrate my compliance and transparency. |
| Have you consulted any experts? | No external expert was consulted. However, I have carefully followed the official guidance published by the Information Commissioner's Office (ICO) on domestic CCTV systems. |
8. Data Subjects' Rights
Under the UK GDPR, individuals whose images are captured have the following rights:
| Right | How it applies |
|---|---|
| Right of Access | Neighbours have the right to request a copy of footage that includes their image. I must respond to any such request within one calendar month. |
| Right to Erasure | Neighbours have the right to request that footage containing their image be deleted. I will consider any such request, unless there is a legitimate reason to retain it (e.g., it has been provided to the police as evidence). |
| Right to Object | Neighbours have the right to object to the processing of their data. I have already reduced the privacy intrusion by disabling audio and limiting retention to 30 days. |
9. Record of Outcomes and Actions Taken
| Action | Status |
|---|---|
| Audio recording | Disabled permanently. |
| Camera positioning | Confirmed – does not capture neighbours' private property (only the shared driveway). |
| Data storage | Cloud storage (Tapo Cloud) – password-protected. |
| Data retention | 30 days – automatic deletion via auto-overwrite. |
| Recording mode | Continuous (24/7) – justified by recent vandalism. |
| Access control | Only the Data Controller (myself) has access. |
| Data sharing | None, unless required by law (police) or for a legitimate insurance claim. |
| Signage | Clear sign displayed at eye height on the front door, directly under the camera, stating "CCTV in operation". |
| Neighbour communication | This completed DPIA has been offered/shared with neighbours to demonstrate transparency and compliance. |
10. Sign-off
By signing below, I confirm that:
-
I have read and understood my obligations under the UK GDPR and the Data Protection Act 2018.
-
The CCTV system has been set up in accordance with the measures described in this document.
-
I will retain this document securely and review it periodically to ensure ongoing compliance.
Data Controller Name: Stella Taylor
Data Controller Signature: _________________________
Date: _26/07/2026_______________________
Check availability and book here.
Contact
Stella Taylor
mobile / WhatsApp: 07932 755 131
email: ms_stella_tayloryahoo.co.uk
