The business operator must make arrangements for the retention and storage of any images and information obtained by a CCTV system referred to in regulation 3 for 90 days beginning with the date the images or information are obtained.

The business operator must ensure that the arrangements under paragraph (1) are appropriate to maintain the integrity and quality of the images and information retained.