Unmanned Aerial Systems (UAS) / Drones
-
Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
Checklist
☐ We have considered whether there is a genuine need for us to use a drone, if alternative systems or methods of surveillance are not suitable to solve a particular problem.
☐ We have conducted a Data Protection Impact Assessment (DPIA) which includes the risks associated with recording at altitude, and capturing footage of individuals that are not intended to be the focus of our surveillance.
☐ We have registered our drone if the system falls within the specific criteria set by the Civil Aviation Authority (CAA). See the CAA website for further details about registration.
☐ We have robust policies and procedures in place for the use of drones, and our operators are appropriately trained, with documented credentials.
☐ We inform individuals that we are using a drone where possible, and we have an accessible privacy notice that individuals can read to learn more about our use.
☐ We comply with the Surveillance Camera code of practice where required.
What are Unmanned Aerial Systems (UAS) / Drones?
Drones are otherwise known as Unmanned Aerial Systems (UAS), Unmanned Aerial Vehicles (UAVs) and Remotely-Piloted Aircraft Systems (RPAS). They are lightweight unmanned aircraft commonly controlled by operators or onboard computers, which can also be controlled by operators. Drones can be used in many innovative ways, for example for photography, the geographical mapping of an area or searching for missing people. But they have raised privacy concerns due to their manoeuvrability and enhanced capabilities of taking photos, videos and sensing the environment. Using drones can result in the collection, use, or sharing of personal data, including information about individuals who are not the intended focus of the recordings.
Smaller models in particular, can be easily purchased online or on the high street by businesses and members of the public. There is a distinction between those individuals who can be considered as ‘hobbyists’ and are therefore generally using their device for purely personal activities, and those individuals or organisations who use the device for professional or commercial purposes.
In contrast, organisations using drones are clearly controllers for any personal data that the drone captures, and therefore are required to comply with data protection law.
Providing privacy information
A key issue with using drones is that, on many occasions, individuals are unlikely to realise they are being recorded or be able to identify who is in control. If you are a controller, you must address the challenge of providing privacy information if you decide to purchase and use such surveillance systems.
You need to come up with innovative ways of providing this information to individuals whose information is recorded, and be able to justify your approach. Or, if doing that is very difficult or would involve disproportionate effort, document this information in a way that is readily available. Some examples could involve:
- formally registering your drone with the Civil Aviation Authority (CAA);
- placing signage in the area you are operating a drone explaining its use; and
- having a privacy notice on a website that you can direct people to, or some other form of privacy notice, so individuals can access further information.
How do we record information responsibly?
The use of drones has the potential for ‘collateral intrusion’ by recording images of other individuals unnecessarily. This can therefore be privacy intrusive. For example:
- The likelihood of recording individuals inadvertently is increased, because of the height drones can operate at and the unique vantage point they afford.
- Individuals may not always be directly identifiable from the footage captured by drones, but can still be identified through the context they are captured in or by using the device’s ability to zoom in on a specific person.
As such, it is very important that you can provide a strong justification for their use. Performing a robust DPIA will help you decide if using a drone is the most appropriate method to solve a problem that you have identified.
It is important that you can switch on and off any recording or streaming system on a drone, when appropriate. Unless you have a strong justification for doing so, and it is necessary and proportionate, recording should not be continuous. You should look at this as part of your DPIA.
As always, you should consider the wider context you are using the drone in, rather than just the use of the drone itself. For example, does it connect or interface with other systems. You should also ensure that you store any data you have collected securely. For example, by using encryption or another appropriate method of restricting access to the stored information. This is particularly important if the drone is piloted beyond visual line of sight or crashes, and there is potential for the device and the data to be lost or stolen as a result. You should also ensure that you retain data for the shortest time necessary for its purpose and dispose of it appropriately, when you no longer require it.
You may be able to reduce the risk of intrusion of others by incorporating data protection by design methods. For example, you may be able to procure a device that has restricted field of vision, or only records after the drone has reached a certain altitude. You can incorporate data protection by design and default into your DPIA and it can form part of your procurement process.
The ICO’s Regulatory Sandbox has carried out some detailed work with Kestrix Ltd, a technology SME which uses drone-captured visual and thermal imaging to assess heat loss in buildings. The ICO helped this organisation to navigate privacy and data protection compliance, particularly in response to public concerns around drone use. You can read our full report on this work at Regulatory Sandbox Final Report: Kestrix Ltd.
Our Tech Horizons Report 2024 has a chapter on the Commercial Use of Drones which goes into further detail about the data protection implications of this technology.
Do I have to register my drone?
Subject to certain permissions and exemptions for certain users, there are UK requirements for people who fly or are responsible for small unmanned aircraft, including drones and model aircraft. Further information about drone registration in the UK can be found on the CAA’s Drone Safe website.
Example
A local authority wishes to deploy a drone over a seaside resort to monitor public beaches for crowd movement and littering. Naturally, any visitors to the beaches may not reasonably expect to be recorded, especially if they are swimming, sunbathing or there are children present.
The local authority needs to make a strong justification for any recording, based on the sensitivity of the processing. They should take a risk-based approach by carrying out a DPIA before using the technology. This will help assess necessity and proportionality.
If recording does occur in a manner that is compliant with individuals rights and aviation rules, the local authority is required to provide the general public with appropriate information about the recording. They would also need to include information about who is responsible, how to contact them, and how individuals can exercise their rights if needed.
Example
A building surveyor uses a drone in a residential area to inspect damage to a roof. The surveyor wishes to use a drone because the high resolution images allow for a safer and more cost effective way of working.
In keeping with the principles of data protection law, the surveyor makes a risk-based assessment prior to deployment. They assess how to fly the drone in a way that does not affect the rights and freedoms of individuals. In order to prevent the unintended filming of residents, the surveyor only begins recording at altitude, and does not record any other private property, with the focus being on the roof.
The surveyor also ensures that, where possible, they provide individuals with links to their privacy information or website via temporary signage, and that any operators are fully trained and registered in keeping with Civil Aviation Authority (CAA) requirements.