Introduction
This policy explains how Bubble Fresh (Bubblefresh Limited, company number 12691029) uses body-worn cameras during service delivery. We are a specialist cleaning and clearance company that works with vulnerable adults and council partners across Northamptonshire, Milton Keynes, Bedford, and Norfolk. Our work takes place in people's homes during sensitive and sometimes complex situations. We use body-worn cameras to record both video and audio to protect the safety of our staff and clients, to provide openness in how we deliver our services, and to protect the interests of everyone involved. The use of body-worn cameras and how we handle the data they collect is governed by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Surveillance Camera Code of Practice issued under Section 30 of the Protection of Freedoms Act 2012, and the Human Rights Act 1998. We follow the 12 guiding principles of the Surveillance Camera Code when operating our cameras. This policy should be read alongside our Privacy Policy, which sets out how we handle personal data more broadly, and our Information Security Policy, which covers how we protect all information.
Scope
This policy applies to all Bubble Fresh employees, contractors, and anyone working on our behalf who may wear or be recorded by body-worn cameras. It covers all body-worn camera footage recorded during service delivery at client properties, including both video and audio. It applies to all stages of the footage lifecycle, from recording through to storage, access, sharing, and deletion. This policy also applies to any person whose personal data is captured by our body-worn cameras, including clients, their visitors, and third parties.
Data protection officer
Our Data Protection Officer (DPO) is Lance James, who also serves as Director. We acknowledge the dual role and ensure DPO independence in line with Article 38(3) of UK GDPR: the DPO acts independently on all data protection matters, reports directly without interference on data protection issues, and cannot be overruled on data protection compliance decisions by commercial considerations. The DPO is responsible for overseeing all body-worn camera data handling, access requests, complaints, and compliance with this policy.
Data protection impact assessment
We have carried out a Data Protection Impact Assessment (DPIA) under Article 35 of UK GDPR for our use of body-worn cameras. The DPIA is required because body-worn cameras involve systematic monitoring and the recording of vulnerable individuals in their homes. The assessment covers the necessity and proportionality of recording (including both video and audio), the risks to the rights and freedoms of data subjects (including under Article 8 of the European Convention on Human Rights, as given effect by the Human Rights Act 1998, the right to respect for private and family life), and the measures we have put in place to reduce those risks. These measures include consent, access controls, retention limits, and encryption. As required by Article 35(9), we sought the views of data subjects and their representatives as part of the DPIA process. We considered whether prior consultation with the Information Commissioner's Office (ICO) under Article 36 was necessary. We concluded that the residual risk is adequately reduced by our controls. The DPIA is available on request from our DPO. We review the DPIA at least once a year, or sooner if we make significant changes to how we use body-worn cameras, if we change camera equipment or storage systems, if we become aware of new risks or vulnerabilities, or if there is a change in relevant legislation or ICO guidance. Each annual review is documented with the date, findings, any changes made, and sign-off by the DPO.
Legal basis for processing
We process body-worn camera footage under the following legal bases. For clients who give consent, we rely on Article 6(1)(a) of UK GDPR (consent). For employees who are recorded, we rely on Article 6(1)(f) (legitimate interests), supported by a documented Legitimate Interest Assessment. For council referral work, we may also rely on Article 6(1)(b) (contractual necessity) where recording is part of our agreed service terms with the council. Where footage is needed for legal proceedings or to establish, exercise, or defend legal claims, we rely on Article 6(1)(f) (legitimate interests). Where footage captures special category data (for example, information about a person's health), we process it on the basis of Article 9(2)(a) (explicit consent) or, where necessary for safeguarding, Article 9(2)(g) (substantial public interest under Schedule 1 Part 2 of the Data Protection Act 2018). Where footage is shared with law enforcement under a legal obligation, we rely on Article 6(1)(c). We periodically review whether the use of body-worn cameras remains necessary and proportionate for each purpose.
Why we use body-worn cameras
Body-worn cameras serve several important purposes. They protect staff safety by providing a factual record in case of incidents and acting as a deterrent against aggressive behaviour. They protect client belongings and interests by making sure that instructions about items not to be removed are followed. They support quality control and training by allowing us to review and improve our service. They help with dispute resolution by providing objective evidence if a complaint or concern is raised. We only use body-worn cameras where there is a clear and justified purpose. We do not use them for general surveillance or monitoring of staff performance outside of the purposes listed above.
Camera equipment standards
We use body-worn cameras that meet the following standards. All cameras have a visible recording indicator (LED light) that shows clearly when recording is in progress. Cameras are tamper-resistant, meaning staff cannot delete, edit, or overwrite footage on the device itself. Footage is stored on the camera in an encrypted format until it is transferred to our secure storage system. Each camera has a unique identifier so that all footage can be traced to a specific device and the employee who was wearing it. We check cameras before each use to make sure they are working properly, have enough battery life and storage, and that the recording indicator is functioning. We keep a register of all camera equipment, including serial numbers, assignment history, and maintenance records. We replace or repair cameras that develop faults promptly and record any periods where a camera was out of service.
Consent
We obtain clear, informed consent from all clients before using body-worn cameras on their property. We provide the consent form before our staff arrive. The form includes a link to this policy and explains the purpose of the cameras (including safety, quality assurance, and dispute resolution), what data is collected (video and audio), how it will be used and stored, how long it will be kept, who may see the footage, and the client's rights. Clients have the chance to ask questions and discuss any concerns before giving consent. Consent is entirely voluntary. Clients are under no obligation to agree to body-worn camera use, and declining will have no effect on the service they receive. We record consent through the client's signature on the consent form. We give a copy of the signed form to the client for their records. Clients may withdraw their consent at any time by contacting us, and we will stop using cameras on their property straight away. Where a client may lack mental capacity to give informed consent under the Mental Capacity Act 2005, we follow the Act's two-stage capacity test. If the client lacks capacity, we make a best-interests decision in consultation with the referring council, the client's social worker, or an appropriate adult. Where capacity is in doubt and no best-interests decision has been reached, the default position is that cameras are not used. For employees who are filmed, we rely on legitimate interests under Article 6(1)(f) of UK GDPR (with a documented Legitimate Interest Assessment), as the employment relationship means employee consent cannot be considered freely given. Employees are told about this processing through their employment terms.
How we use the data
We use footage collected through body-worn cameras for ensuring the safety and security of employees and clients, for internal training and quality assurance, and for resolving disputes or complaints if they arise. Where footage is used for training, we remove or obscure any identifying features of clients unless the client has given separate, specific consent for their footage to be used in this way. We never use footage for marketing purposes and never share it publicly. We do not use body-worn camera footage for any form of automated decision-making or profiling.
Accidental recording of third parties
We recognise that body-worn cameras may accidentally record people other than the client and our staff, such as neighbours, visitors, delivery drivers, or children present in or near the property. We take the following steps to reduce this risk. Employees are trained to pause or turn off cameras when someone other than the client enters the area being recorded, unless there is a safety reason to keep recording. If a third party is accidentally recorded, we will obscure or remove their image and audio from any footage that is reviewed, shared, or kept beyond the standard retention period, unless the footage is needed for a specific lawful purpose such as an incident investigation. Where children are accidentally recorded, we treat this with extra care. We will delete footage containing images of children as soon as we become aware of it, unless it is needed for safeguarding purposes, in which case we handle it in line with our Safeguarding Policy. If a third party contacts us to say they have been recorded, we will explain what happened, tell them what footage exists, and let them know their rights, including the right to request deletion.
Data sharing
We may share body-worn camera footage with law enforcement authorities where required by law or where we have a legal obligation or legitimate interest to do so, with the client upon their request under Article 15 of UK GDPR (with appropriate redaction of other individuals' personal data using blurring or masking where necessary to protect their rights), with insurance companies or in legal proceedings to the extent strictly necessary, with referring councils where required under our contractual obligations and with client consent, and with our secure data storage providers under strict confidentiality agreements and Data Processing Agreements that meet the requirements of Article 28(3) of UK GDPR. Where a council requests footage, we first assess the request against our contractual obligations and legal requirements, we seek client consent before sharing, we redact or obscure footage where possible to protect the identity of anyone who has not consented, and sharing is limited to what is strictly necessary for the stated purpose. We keep a written record of every disclosure of footage, including who requested it, the reason, what was shared, any redaction applied, and the date.
Council data sharing agreements
Where we work with a council partner and body-worn camera footage may be shared as part of the referral or service delivery, we put a formal Data Sharing Agreement (DSA) in place with that council before any footage is shared. Each DSA sets out the specific purposes for which footage may be shared, the legal basis for the sharing, the categories of data included, who is responsible for what under data protection law, how data subjects will be told about the sharing, retention periods and deletion responsibilities, security measures both parties must follow, what happens if there is a data breach, and how the agreement will be reviewed. We review each DSA annually or when the council contract is renewed. Where a council also acts as data controller for the individuals referred to us, the DSA makes clear the respective roles and responsibilities of both parties. We do not share footage with a council until a DSA is signed and in place.
Requests from the police and law enforcement
We may receive requests from the police or other law enforcement bodies to provide body-worn camera footage. We handle all such requests carefully. Where a request is made under a court order, warrant, or other legal compulsion, we will comply as required by law. Where a request is voluntary (not backed by legal compulsion), we assess the request on a case-by-case basis, considering whether disclosure is necessary and proportionate, the nature and seriousness of the matter under investigation, the rights of the individuals recorded, and whether the client's consent can be obtained. We will tell the client about the request unless we are legally prevented from doing so (for example, where a court order prohibits disclosure or where telling the client would prejudice a criminal investigation). We keep a record of all law enforcement requests, including the request details, our assessment, the decision made, what footage was provided, and whether the client was told. We seek legal advice where we are unsure about a request.
Who uses the cameras
Our field staff who are directly involved in service delivery at client properties wear body-worn cameras. The decision to deploy body-worn cameras is based on the nature of the task, the request of the client or council, and any risks identified in the assessment. All employees using cameras receive thorough training on camera operation, privacy considerations, data protection, when to activate and deactivate the camera, how to inform clients, how to handle accidental recordings of third parties, and the consequences of tampering with or misusing camera equipment. Training is provided during induction and refreshed annually. We keep records of all training completed. For our wider approach to staff development, see our Training and Development Policy.
Camera tampering and misuse
Employees must not tamper with, obstruct, cover, disable, or interfere with body-worn cameras in any way. This includes deliberately blocking the camera lens, muting audio recording, switching the camera off during service delivery without a justified reason, attempting to delete or alter footage, or failing to report a camera fault. Any tampering, obstruction, or misuse of body-worn cameras is treated as a serious disciplinary matter and may result in disciplinary action up to and including dismissal. If an employee believes there is a good reason to stop recording during a job (for example, if a client becomes distressed and asks for recording to stop), they must report this to their manager as soon as possible and record the reason in their job notes. We investigate all suspected cases of tampering or misuse promptly and document the outcome.
Audio recording
Our body-worn cameras record audio as well as video. Audio recording is necessary to capture the full context of interactions, including verbal instructions from clients about items to keep or remove, and any verbal incidents. We tell clients that audio is recorded as part of the consent process. The same retention, access, and deletion rules apply to audio as to video. Our cameras record audio and video at the same time; independent control of audio and video is not supported by our current equipment. We have assessed this in our DPIA and concluded that recording both together is proportionate given the need to capture verbal instructions and the full context of interactions.
Operational procedures
We activate body-worn cameras only during service delivery at the client's property. Cameras remain off during travel, breaks, and non-service interactions. Upon entering a property, employees remind the client that a body-worn camera is active. If the client asks for recording to stop at any point, the employee must turn the camera off straight away and note this in their job record. In situations where recording may be unnecessarily intrusive, employees are trained to use judgement and deactivate the camera where appropriate. All footage is handled and transferred securely (see the Footage transfer section of this policy for details). In the event of an incident, employees must note in their incident report (see our Incident Reporting Policy) that body-worn camera footage is available. Employees must not use body-worn cameras for any personal purpose, including taking photographs or recording outside of authorised service delivery. As our staff often work alone in client homes, body-worn cameras also support the safeguards set out in our Lone Working Policy.
Footage access log and audit trail
We maintain a full access log for all body-worn camera footage. Every time footage is accessed, viewed, downloaded, copied, shared, or deleted, we record who accessed it, the date and time, the reason for access, what footage was viewed or actioned, and whether any copies were made or footage was shared. Only authorised personnel may access footage. Access is granted on a need-to-know basis and is limited to the DPO, managers involved in quality control or dispute resolution, and any employee who is the subject of the footage where required for a specific purpose. The DPO reviews the access log quarterly to check for any unauthorised or unusual access. Any unexplained access is investigated. Where footage may be used as evidence in legal proceedings or law enforcement investigations, we maintain a separate chain of custody record to preserve forensic integrity, documenting every person who handled the footage, when, and for what purpose.
Data storage and security
We store footage securely in a centralised system managed by Bubble Fresh, hosted on UK-based infrastructure. All footage remains within the United Kingdom. We do not transfer footage outside the UK. We strictly control access to stored footage and limit it to authorised personnel only. We encrypt all footage during storage (AES-256) and transfer (TLS 1.2 or above). We conduct regular security audits. We perform regular backups to prevent data loss. We secure physical servers and infrastructure with appropriate access controls. Footage is separated based on its purpose and sensitivity. We keep footage used for training purposes separate from footage kept for legal or security reasons, with appropriate access controls for each. Our full approach to data security is set out in our Information Security Policy.
Footage transfer
At the end of each working day, employees transfer footage from their body-worn camera to our secure centralised storage system. Transfer takes place over an encrypted connection. Employees must not store footage on personal devices, memory cards, or any system outside our approved storage. Cameras are checked after transfer to confirm that all footage has been uploaded successfully. Once confirmed, footage on the camera is securely wiped ready for the next use. If a camera is lost or stolen before footage has been transferred, the employee must report it immediately to management. We will treat any lost or stolen camera as a potential data breach and follow the procedures set out in our Privacy Policy, including notification to the ICO where required.
Data breaches involving footage
If body-worn camera footage is lost, stolen, accessed without authorisation, or shared in error, we treat this as a personal data breach. We follow the data breach procedures set out in our Privacy Policy. This includes assessing the risk to the individuals whose data is affected, notifying the ICO within 72 hours where required under Article 33 of UK GDPR, notifying affected individuals where the breach is likely to result in a high risk to their rights, and notifying the relevant council partner without undue delay where the footage relates to a council referral. All footage breaches are recorded in our breach log and investigated to prevent recurrence. See our Privacy Policy and Information Security Policy for full details of our breach procedures.
Retention and deletion
We keep body-worn camera footage for a standard period of 2 months, after which we securely delete it unless it is needed for an ongoing legal matter, investigation, training purpose, or dispute. We document decisions to keep footage beyond the standard period, including the reason and the name of the person who approved the extension. At the end of the retention period, footage is automatically flagged for deletion. The DPO (or a manager authorised by the DPO) confirms the data can be safely deleted before it is erased. We securely erase footage from all storage media, including backups, and keep a record of deletion including the date, the footage reference, and who confirmed the deletion. These retention periods are consistent with those set out in our Privacy Policy.
Subject Access Requests for footage
Under Article 15 of UK GDPR, any person whose personal data appears in body-worn camera footage has the right to request a copy of that footage. This is called a Subject Access Request (SAR). To make a SAR, contact our DPO at puvwrrnjikcuvrhvaehicvmcyiriqz@bffquymsbsbebmyqlmvceqxffeyqrzyneviaswophswc.pcicpefomeg.nslusjdkhuc, by phone on 01933 213045, via Relay UK on 18001 then 01933 213045, or by post at Bubblefresh Limited, 6 Carnegie Street, Rushden, Northamptonshire, NN10 9SN. We will verify your identity before processing any request. We will respond within one calendar month. If your request is complex or we receive a large number of requests, we may extend this by a further two months, but we will tell you within the first month and explain why. Before providing footage, we will review it and redact (blur or mask) any images or audio of other people whose personal data appears in the footage, to protect their rights. We provide footage in a commonly used electronic format. There is no charge for a SAR unless the request is clearly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request, giving our reasons. We keep a record of all SARs received, our response, and any redaction applied. For full details of your data protection rights, see our Privacy Policy.
Your rights
Under UK GDPR, you have the right to access footage that includes your personal data (see Subject Access Requests above), to request correction of inaccurate data, to request erasure of your data (the 'right to be forgotten') subject to legal obligations, to restrict processing of your data, to object to processing, and to lodge a complaint with the ICO if you believe your rights have not been respected. Where we process your data based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. To exercise any of these rights, contact our DPO at pxecroabivnqvlyraoakcvpqyqkuqz@bupyuadlbdscbenelsghefzjfgnurvvreslfssszhynj.aswcalxopdp.fkoujydksem, by phone on 01933 213045, or via Relay UK on 18001 then 01933 213045. We will respond within one calendar month.
Complaints about camera use
If you are unhappy about any aspect of how we use body-worn cameras, you can raise a complaint with us at any time. You can contact our DPO at pmebrghliigmvlfsaabucrpoyjcsqz@bhleukzwbkvcbjqqlakjeduwfatnroczechssgzmhzoj.fnzcynmojgr.puwukiykwiy, by phone on 01933 213045, via Relay UK on 18001 then 01933 213045, or by post at Bubblefresh Limited, 6 Carnegie Street, Rushden, Northamptonshire, NN10 9SN. We will acknowledge your complaint within 5 working days and aim to resolve it within 20 working days. If we need more time, we will let you know and explain why. Complaints may relate to any aspect of camera use, including whether recording was necessary or proportionate, how footage has been handled or shared, a concern about accidental recording, a concern about staff conduct relating to cameras, or a request for footage to be deleted. We keep a record of all complaints about camera use, including the outcome and any changes we make as a result. If you are not satisfied with how we handle your complaint, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Changes to this policy
We may update this policy from time to time. Any changes will be posted on this page with an updated date. Where we make material changes that affect consent arrangements, the purposes of recording, retention periods, data sharing, or the rights of people who are recorded, we will proactively notify affected clients and council partners by email or prominent website notice before the changes take effect. We encourage you to review this policy regularly.
Contact and complaints
If you have questions or concerns about our use of body-worn cameras, contact our Data Protection Officer, Lance James, at pltsrvhwickevqgaabejcgttybgrqz@bcqyuxwmboowbtpwlkqweqmrfcusrzyveghzsoamhqaq.ukrclncowkf.cgbumooklmo, by phone on 01933 213045, via Relay UK on 18001 then 01933 213045, or by post at Bubblefresh Limited, 6 Carnegie Street, Rushden, Northamptonshire, NN10 9SN. Bubble Fresh is registered with the Information Commissioner's Office (ICO registration: ZB656998). If you are not satisfied with our response, you have the right to lodge a complaint with the ICO at ico.org.uk. You can also contact the ICO at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113.
Review
The Director, Lance James, reviews this policy annually or sooner if there are significant changes in our operations, camera technology, data protection law, or ICO guidance. Last reviewed: February 2026. Next review due: February 2027.
© 2026 Bubble Fresh. This policy is protected by copyright (Copyright, Designs and Patents Act 1988) and may not be copied, reproduced, or redistributed without our written permission. See our Terms of Use.