Organisations should have their own retention policy and only keep images for as long as necessary to meet the purpose of recording them — according to the ICO.
However, it’s common that CCTV surveillance is only kept for 30 days to avoid any prosecutions from governing officials.
If you feel as though you need to keep the footage for longer, this can be an option. However, you will be required to fill out a risk assessment explaining why. Such footage can also be requested by the police — but you must ensure that they have a written request which gives you a justifiable reason for keeping footage for a longer period of time.
Authorities such as the police will usually view the footage on your own premises, as this prevents the risk of any data breaches which could be damaging to your company.