It is perfectly legal for a resident to install CCTV to protect one’s own property against the threat of intruders and trespassers. Where images are contained within these boundaries, data protection laws do not apply.
However, where the system captures images of people outside the boundary of the property – for example in shared spaces, or neighbour's property then the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 into which GDPR is incorporated, will apply and the owner needs to ensure the system is used responsibly to protect the privacy of others.
Residents ( who are being captured on shared spaces by that camera ) have the right to make a Subject Access Request (SAR) – to see a copy of the images. This request can be made verbally, or in writing (writing is preferred so the date of request can be evidenced). The CCTV operators must, by law, respond within one month and give you a copy of the data.
They have the right to have footage deleted. Again, this request can be made verbally or in writing (writing is preferred so the date of request can be evidenced). The CCTV operator must respond within one month and must delete the footage UNLESS they believe there is a genuine reason to keep it, for example because of the prevention or detection of crime, or other legal dispute – in this case, they must tell you this, and they can complain to the Information Commissioner’s Office.
Compliant to to the Information Commissioner’s Office can be made online using the below weblink-