Security & Access Control

Commercial intruder and hold-up alarm systems in the UK are designed, installed and maintained to the BS EN 50131 series, the European standard adopted as British Standard. BS EN 50131-1 sets the system requirements and defines four security grades (Grade 1 lowest risk to Grade 4 highest); the grade is selected by risk assessment. PD 6662 is the UK scheme document for the application of BS EN 50131 and references companion standards including BS 8243 (confirmation of alarm conditions) and BS 8473 (alarm receiving centres). Where police response is required, the National Police Chiefs’ Council (NPCC) Security Systems Policy requires the system to be at least Grade 2 and installed by a company certificated by a UKAS-accredited inspectorate such as NSI or SSAIB. A competent installer should advise on grade selection following a documented risk assessment.

NSI Gold is the highest tier of certification issued by the National Security Inspectorate, combining technical inspection against the relevant British and European Standards (such as BS EN 50131 for intruder alarms and the BS EN 62676 series for CCTV) with ISO 9001 quality management. It demonstrates that an installer has been independently audited on both engineering competence and business processes. Under the National Police Chiefs’ Council (NPCC) Security Systems Policy, police forces in England, Wales and Northern Ireland only respond to intruder alarms installed and maintained by companies certificated by a UKAS-accredited inspectorate such as NSI or SSAIB; Police Scotland operates a separate but broadly equivalent policy. Certification is therefore effectively a procurement prerequisite where police response is required.

There is no single statutory service interval for CCTV, but the applicable standard is BS EN 62676-4 (Application guidelines for video surveillance systems), which forms part of the BS EN 62676 series that superseded BS EN 50132. It recommends planned preventative maintenance at intervals determined by risk, and industry practice is typically at least annually. Systems linked to alarm receiving centres or used for evidential purposes are commonly serviced every six to twelve months. Maintenance should cover camera alignment and image quality, recording integrity, storage retention, time synchronisation, firmware and cybersecurity updates. Documented maintenance records are also expected under the Surveillance Camera Code of Practice (the role of the Surveillance Camera Commissioner having been absorbed into the Information Commissioner’s Office) and assist in demonstrating compliance under UK GDPR.

Access control on educational sites must reconcile safeguarding, fire safety and data protection. Electronic locking on designated escape routes must comply with BS 7273-4, which governs the actuation of door release mechanisms upon operation of a fire alarm system. It defines three categories of actuation (A, B and C); Category A (critical) applies where failure to unlock would present a high risk to life and requires the lock to release on any fire signal and on loss of power to the lock. Specification of the access control system itself should follow the BS EN 60839-11 series (particularly -11-1 system requirements and -11-2 application guidelines). Escape route hardware must also comply with the Building Regulations (Approved Document B) and relevant product standards such as BS EN 179 or BS EN 1125. Safeguarding duties under the Department for Education’s Keeping Children Safe in Education guidance influence visitor management and zoning. Where biometric data is processed for pupils under 18 in schools or colleges, the Protection of Freedoms Act 2012 (Chapter 2) requires written parental consent and an alternative means of access. All credential and access data are personal data under UK GDPR and require a documented lawful basis and retention policy.

Workplace CCTV processes personal data and is regulated by the UK GDPR and the Data Protection Act 2018, overseen by the Information Commissioner’s Office (ICO). Operators must identify a lawful basis (commonly legitimate interests, supported by a documented legitimate interests assessment) and complete a Data Protection Impact Assessment where the processing is likely to result in a high risk to data subjects, which the ICO indicates includes systematic monitoring of publicly accessible areas and monitoring of employees. Clear signage informing data subjects is required. Footage must be retained only as long as necessary, with documented retention periods, access controls and an audit trail. Covert monitoring is permitted only in narrowly defined exceptional circumstances and normally requires senior sign-off. The ICO’s video surveillance guidance sets out detailed operational expectations; the Surveillance Camera Code of Practice is mandatory only for ‘relevant authorities’ under the Protection of Freedoms Act 2012 but is widely treated as best practice by private operators. Subject access requests must be responded to within one month, extendable by a further two months where the request is complex or numerous.

Local recording via a network video recorder keeps footage on site, typically giving lower ongoing cost, no dependency on internet bandwidth and simpler data residency arguments, but places responsibility for physical security, backup and cybersecurity on the operator. Cloud (or hybrid) recording offers off-site resilience, easier multi-site management and automatic firmware updates, but introduces dependency on the service provider, requires assessment of international data transfers under UK GDPR, and increases bandwidth needs. Both approaches must meet BS EN 62676-4 for operational performance and the Surveillance Camera Code of Practice. Cloud providers should be assessed against the NCSC Cloud Security Principles. Consult a competent specialist for risk-based selection.

Intruder and fire alarm systems can share infrastructure such as cabling pathways, graphical front-ends and building management interfaces, but their detection and alarm functions must remain functionally independent. BS 5839-1:2025 requires that the fire detection and alarm system is not compromised by connection to other systems and that any interface is via approved equipment that cannot inhibit fire signals. BS EN 50131 imposes equivalent integrity requirements on the intruder system. A common interface is the release of electrically held or electrically locked doors on fire alarm activation, designed in accordance with BS 7273-4. Both signals may also be routed to a single alarm receiving centre. Integration design should be carried out by competent engineers, with the fire elements installed by a company certificated under a third-party scheme such as BAFE SP203-1, and the security elements by a company certificated by NSI or SSAIB under the relevant intruder alarm scheme.