Answering a CCTV subject access request, step by step

If your organisation runs CCTV, sooner or later someone will ask for footage of themselves. A shopper who was accused of theft. A parent after an incident at the school gate. A tenant who fell out with a neighbour in the car park. Under UK GDPR they have a right to a copy of their personal data, and a recording of their face is personal data.

The request doesn't have to be made in any particular way. It doesn't have to mention the law, go to a particular person, or be in writing. "Can I have the video of me from last Tuesday?" said to a receptionist counts. So the first job is making sure the request gets to whoever deals with it, and gets logged the day it arrives.

How long you have

You have one calendar month from the day you receive the request. If the month runs out on a weekend or bank holiday, the deadline is the next working day. You can extend by up to two further months if the request is complex, or if the same person has sent you several. You have to tell them about the extension, and why, within the first month.

In most cases you can't charge a fee. You can charge a reasonable one, or refuse, only where a request is manifestly unfounded or excessive, and the bar for that is high.

Two things can stop the clock. If you really do need to confirm who the requester is, the month starts once you have. And if you hold a lot of footage and need them to narrow the request down (which camera, which day, roughly what time), you can ask. The Data (Use and Access) Act 2025 wrote into law what the ICO had long said: your search has to be reasonable and proportionate, not exhaustive.

Step 1: pin down the footage

Most CCTV systems overwrite themselves after somewhere between 14 and 31 days. Export the relevant clip as soon as the request arrives, before it's gone, even if you haven't worked out yet whether you'll release all of it. A request doesn't let you delete footage you would otherwise have kept. And once a request is in, deliberately deleting the footage to avoid it is a criminal offence.

Ask the requester for what you need to find them: date, approximate time, location, a description or photo so you can pick them out. Keep the original export untouched. It's your evidence of what the system recorded.

Step 2: work out who else is in it

This is where CCTV requests differ from almost every other kind. The requester is entitled to their own data, not everybody else's. Anyone else who can be identified in the footage is a third party. Under the Data Protection Act 2018 you don't have to disclose information about them unless they've consented, or it's reasonable to disclose it without their consent.

In practice, for passers-by, other customers and staff who just happen to be in shot, that means blurring them. The ICO is clear that finding redaction awkward is not a reason to refuse the request. If you can't edit video yourself, you're expected to get it done.

Think about more than faces:

• Faces, obviously, of everyone except the requester
• Number plates of vehicles that aren't theirs
• Anything else that identifies someone: a name badge, a distinctive uniform with a name on it, a screen or document in shot

Step 3: redact, then watch it

Automatic detection of faces and number plates does most of the work, but no detector is perfect. Faces turned away, partly hidden or very small, and plates at steep angles, are the usual misses. Watch the redacted video end to end before it leaves the building, and cover anything that was missed by hand. That review is your judgement, not the software's, and you should record who did it.

Step 4: keep a record

For each release, keep a short log: when the request came in, which footage you searched, what you withheld and why, who reviewed the redaction, and when you sent it. If the requester complains to the ICO, that log is what shows you handled the request properly.

Step 5: send it securely

Send a copy the requester can actually play: an MP4, not a proprietary export that needs the manufacturer's player. Use a secure download link rather than an email attachment, and let the link expire.

The short version

1. Log the request the day it arrives. The month starts then.
2. Export the footage before it's overwritten.
3. Identify the requester, and everyone who isn't them.
4. Blur the others, then watch the whole thing.
5. Record what you did, and send a playable copy securely.

Most organisations get a handful of these a year, which is exactly why they're hard: nobody does them often enough to have a routine. Write yours down once, and the next request is a checklist rather than a scramble.