What to blur in CCTV before you release it, and what to leave

Redacting footage for a subject access request means removing other people's personal data while leaving the requester's intact. It sounds simple until you're forty seconds into a busy clip and trying to decide whether a reflection in a shop window counts.

This is a practical list: what usually needs blurring, what usually doesn't, and the grey areas in between.

Always blur

Faces of everyone except the requester. Customers, passers-by, patients, pupils, other tenants. If a face is clear enough that someone who knows the person could recognise them, it goes.

Number plates of other vehicles. A plate links straight to a registered keeper, so it identifies a person just as reliably as a face. Leave the requester's own vehicle visible if that's part of what they asked for.

Staff, unless there's a reason not to. Employees in shot are third parties too. Sometimes it's reasonable to leave a member of staff visible, for example where the request is about an interaction with that person and their role in it is already known to the requester. Decide case by case, and write down why.

Often blur

Name badges and lanyards. A readable name on a badge identifies the wearer even if their face is turned away.

Screens and paperwork in shot. A till display, a reception screen, a clipboard. If you can read personal information from it, so can the requester.

Distinctive clothing or features, when the face is already blurred. If the only other person in a quiet corridor is wearing a hi-vis jacket with their name across the back, blurring their face achieves nothing.

Reflections. Glass doors, shop windows and polished floors sometimes show a second, clear view of someone you've already blurred.

Usually leave alone

The requester. Obvious, but worth saying: over-redacting the person who asked is its own failure. They're entitled to see themselves.

People too small or distant to identify. A figure thirty metres away in a wide shot, at CCTV resolution, often isn't identifiable by anyone. Blurring it does no harm, but it isn't required.

The scene itself. Buildings, rooms, the layout of the car park. They aren't personal data.

The grey areas

Someone the requester already knows. If the request is about an argument with a named neighbour, the requester already knows who that person is. That doesn't automatically make it reasonable to disclose them. Their consent, or a clear reason why disclosure is fair, is what counts.

Audio. Many systems don't record sound. Most of the UK guidance on CCTV audio amounts to "you probably shouldn't be recording it". If yours does, spoken names and conversations belong to the speakers and need the same treatment as faces.

Footage the police have asked for. A police request is handled under a different lawful basis and often needs the unredacted original. Don't send a redacted copy to the police, or an unredacted one to a member of the public.

Checking your work

Automatic detection finds most faces and plates, but review is where redaction is actually done right. Watch the output at normal speed, then scrub through the busy moments frame by frame. The usual misses are:

• the first and last few frames of someone entering or leaving the edge of the shot
• faces in profile or looking down
• plates on vehicles turning across the camera

Draw over what was missed, export again, and note in your log who reviewed it. That note is the difference between "we used software" and "we checked".