The new cameras are up, and the screens look sharp.
The old recorder sits on a shelf in the comms room. Nobody has switched it off, and nobody has asked what is on it.
It holds weeks of footage of staff, visitors and customers. That makes it one of the most sensitive boxes in the building.
Why security kit is a data problem
Most people think of CCTV as cameras on walls, but the real store of information is the recorder.
A DVR records footage from analogue cameras. An NVR records IP cameras over the network. Both write footage to hard drives inside the box, often for weeks at a time.
Footage that shows identifiable people is personal data under UK GDPR. That stays true after the system comes off the wall.
Access control adds another layer. Fob databases hold names, photos, card numbers and entry logs. Those records often show when each person came and went.
So treat a security system like any other data-bearing estate. The drives matter far more than the metal.
What a security system leaves behind
A full strip out produces more than most sites expect. Walk the building and list it all before anyone books a collection.
Recorders. DVRs, NVRs and any storage units attached to them. Each one holds at least one hard drive.
Cameras. Many IP cameras take a memory card for local backup. Those cards hold footage and often get missed.
Door controllers and readers. Controllers can store user lists and event logs. Card readers, keypads and exit buttons sit at every door.
Intercoms and entry panels. Video entry panels may keep call logs and stored images.
Servers and PCs. Access control software often runs on a server or an old desktop. That machine holds the full fob database.
Power supplies, monitors and cabling make up the rest. They are bulky, but they carry no data.
Removal is not disposal
Your installer will take the old kit down, but that is a different job from disposing of it.
Some installers take the recorders away. Others leave a pile in the plant room for you to sort out.
Either way, ask what happens to the kit next. Where do the drives go, and who wipes or destroys them?
Remote access needs closing down too. Remove the old recorder from any viewing app or cloud account that staff used on their phones. Change the passwords on any device that stays in service.
If the answer is vague, keep the recorders on site until you have a proper plan in place. Hand them to a disposal contractor who can certify destruction.
You stay responsible for the footage. Passing the box to a third party does not pass on that duty.
Under the Waste Electrical and Electronic Equipment Regulations 2013, the kit itself needs a proper WEEE route. You also owe a duty of care for any waste you hand over.
Destroying recorder drives
There are two honest options for a recorder drive.
Certified wiping. Specialist software overwrites the drive and checks the result. The drive can then go for reuse.
Physical destruction. A shredder cuts the drive into small pieces, so the footage cannot come back. This suits faulty drives and footage from sensitive sites.
Our guide to data wiping versus physical destruction explains the trade-off.
Some sites ask whether to keep the drives while an incident is still open. Check your retention policy and any police requests before you destroy anything.
Either way, get a certificate that lists each drive by serial number. Our guide to data destruction standards covers what a good one includes.
Our data destruction service handles recorder drives, memory cards and access control servers. We collect from sites across the UK.
Access control databases
The fob database is easy to forget, because nobody sees it.
It usually lives on a server, a desktop or the controller itself. It may hold years of entry records for past and present staff.
Export what you need to keep, then retire the old system. Wipe or destroy the drive on the host machine.
If the software ran on a shared server, plan the change with your IT team. Our guide to server room decommissioning covers how to retire that kit safely.
Collect the old fobs and cards too. They are small, but each one carries an identity number linked to a person.
Cancel any fobs that still work before the new system goes live. A lost fob on an old controller can still open a door if anyone reconnects it.
Analogue to IP upgrades leave a mountain
Moving from analogue to IP cameras clears out a whole generation of kit at once.
You lose the old cameras, the DVRs, the coaxial cable, the baluns and the power supplies. Monitors from the old control room often go too.
None of this should sit in a skip. Anything with a plug, battery or circuit board is WEEE.
Mixed security kit suits a single collection. Our mixed WEEE recycling service takes cameras, controllers, monitors and power supplies together.
Newer IP kit sometimes has resale value if you upgrade early. Our guide to IT asset recovery explains how resale can offset the cost.
Batteries in panels and UPS units
Security systems run on backup power, which means batteries in places people forget to look.
Alarm panels, access control panels and power supplies often hold sealed lead acid batteries. Many recorders and controllers also sit on a UPS.
Lead acid batteries are hazardous waste. They fall under EWC code 16 06 01* and must not go in general waste.
The Waste Batteries and Accumulators Regulations 2009 also apply. Keep batteries apart from the rest of the kit.
Tape the terminals before storage. Store damaged or swollen batteries in a fire-retardant container. Our guide to business battery fire risk covers safe storage.
Our battery recycling service collects panel and UPS batteries alongside the rest of the system.
Cabling and copper
Old cable runs come out in long, heavy coils, and both coaxial and power cable contain copper.
Loose cable stripped from walls is not usually WEEE. Most contractors treat it as construction waste, under EWC code 17 04 11.
Bag it on its own and keep it out of the WEEE containers. Ask your collector how they want it presented.
Do not let anyone take it away for cash without a waste transfer note. That leaves you with no record of where it went.
A simple checklist
Before the installer starts, list every recorder, server and panel by its serial number. Note where each one sits in the building.
On removal day, keep recorders, memory cards and the access control host together. Store them in a locked room, apart from the rest.
At collection, get a waste transfer note for the hardware. Hazardous batteries also need a consignment note in most cases.
After collection, file the destruction certificate with your data protection records. Match every serial number against your original list.
Frequently asked questions
Is CCTV footage personal data?
Yes, if it shows people you could identify. Recorder drives hold personal data under UK GDPR until someone wipes or destroys them.
Can my installer dispose of the old recorders?
They can remove them, but ask where the drives go. If they cannot give you a certificate, use a certified data destruction contractor.
Do CCTV cameras hold data?
Some do. Many IP cameras take a memory card for local backup, so check each one before collection.
Is CCTV equipment WEEE?
Yes. Cameras, recorders, monitors, controllers and power supplies are all electrical equipment, so they need a WEEE route.
What about the batteries in alarm panels?
Most panels use sealed lead acid batteries, which count as hazardous waste. Keep them apart and use a licensed battery route.
Does old cable count as WEEE?
Loose cable stripped out of walls is not usually WEEE. Keep it separate and ask your collector how to present it.
The bottom line
CCTV equipment disposal is a data job first and a waste job second.
Find every drive, memory card and fob database before the installer starts. Keep them apart from the rest of the kit.
Then wipe or destroy them, and get a certificate with every serial number. Send the batteries, cable and hardware down their own routes.
Priority WEEE collects CCTV, access control and security kit from sites across the UK. Certified destruction of recorder drives comes as standard. Book a free waste review, and we will start with the recorder on the shelf.
