Operating a commercial CCTV system in the UK allows business owners to deter crime, monitor workplace safety, and protect physical assets. However, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, any video footage capturing identifiable individuals is classified as personal data.
As a result, members of the public, employees, contractors, and visitors have the legal right to request access to CCTV recordings in which they appear. This process is known as a Subject Access Request (SAR).
Handling a CCTV SAR correctly within strict legal timeframes can feel daunting for facility managers and business owners. In this step-by-step guide, we outline the legal requirements, verification procedures, video redaction rules, and best practices for fulfilling CCTV subject access requests in full compliance with Information Commissioner’s Office (ICO) guidelines.
1. What Is a CCTV Subject Access Request?
A Subject Access Request (SAR) is a formal request made by an individual (the “data subject”) asking an organization for copies of the personal data held about them. In the context of commercial video surveillance, this means providing the requester with video footage of themselves captured on your cameras.
Key facts business owners must know:
- No Fixed Format Required: A requester does not need to fill out a specific form or mention “UK GDPR” or “Subject Access Request.” A verbal request, email, social media message, or written letter is legally binding.
- Free of Charge: In almost all cases, you cannot charge a fee for fulfilling a CCTV SAR.
- Broad Applicability: SARs can be submitted by staff members following workplace disputes, delivery drivers, customers involved in slips/trips on your site, or individuals involved in road traffic collisions near your building perimeters.
2. Key Timelines and Verification Rules
Once a SAR is received, the clock starts ticking immediately. Adhering to statutory timelines and proper verification steps is critical to avoid regulatory action from the ICO.
The 30-Day Response Window
You must respond to a CCTV SAR and provide the requested footage within one calendar month of receiving the request. If a request is received on 15th July, you must fulfill it by 15th August.
Verifying Requester Identity
To prevent data breaches, you must confirm that the person making the request is actually the individual in the footage. You can request reasonable proof of identity (such as a driving licence or passport) and specific details to help locate the footage, including:
- The exact date and time window (e.g., between 14:00 and 14:30 on Tuesday, 10th June).
- The specific camera location or zone on your site.
- A description of what they were wearing or driving to help identify them.
Asking for these details is legally permissible, provided you do not use verification as an unreasonable tactic to delay the process.
3. Protecting Third-Party Privacy: Video Redaction & Blurring
One of the most complex aspects of fulfilling a CCTV SAR is balancing the requester’s access rights with the privacy rights of other people captured in the same recording.
Under UK data protection law, you cannot disclose footage that identifies third parties—such as other employees, shoppers, or passing pedestrians—without their explicit consent or proper visual redaction.
Video Redaction Guidelines:
- Faces and Distinctive Features: You must use specialized video redaction (blurring or pixelation) software to obscure the faces, tattoos, or identifying uniform logos of all third parties in the video frame.
- Vehicle License Plates: Uninvolved vehicle registration plates visible in car park or perimeter footage must also be blurred.
- Audio Redaction: If your system records ambient sound, any background conversations from third parties must be muted or stripped from the file.
Modern IP CCTV systems often include integrated or compatible AI redaction tools, allowing facility managers to quickly auto-blur third parties rather than paying expensive third-party video editing fees.
4. Legitimate Exemptions: When Can You Refuse a SAR?
While UK GDPR strongly favors the individual’s right to access data, there are specific, narrow circumstances where a business can refuse a request or withhold footage:
- Footage Has Been Automatically Overwritten: If your system operates a compliant 30-day retention schedule and the requested footage was automatically deleted before the SAR was received, you are not required to recreate it. You simply inform the requester that the footage no longer exists.
- Active Police Investigations: If providing the footage directly to the individual would prejudice an ongoing criminal investigation or legal proceeding, police can request that you withhold the footage under statutory exemptions (Schedule 2 of the Data Protection Act 2018).
- Manifestly Unfounded or Excessive Requests: If an individual demands “all CCTV footage of me over the past 12 months” without specific dates or times, you can request that they narrow down the request. If they refuse, the request may be classed as excessive.
5. Step-by-Step CCTV SAR Workflow for Business Owners
To ensure your team handles requests smoothly and maintains legal compliance, implement this simple 5-step internal workflow:
[Step 1: Log Request] ──> [Step 2: Verify ID & Details] ──> [Step 3: Export & Preserve Raw Clip]
│
[Step 5: Secure Delivery] <── [Step 4: Redact Third-Party Data] <─────────┘
- Log the Request Immediately: Record the date received, requester contact details, and the 30-day deadline in your compliance register.
- Verify Identity & Narrow Search: Confirm ID and gather specific details (date, time, location, clothing description).
- Export and Preserve Raw Footage: Immediately back up the raw video file onto a secure drive to prevent automatic overwriting while processing the request.
- Apply Video Redaction: Run the clip through redaction software to blur all third-party faces, license plates, and identifying data.
- Deliver Securely: Provide the redacted footage to the requester via an encrypted digital link or password-protected storage drive, ensuring you keep a copy of the redacted file for your compliance records.
Streamline CCTV Compliance with AMUK Security
Handling Subject Access Requests efficient requires modern recording hardware, secure data access protocols, and intelligent video management software. Upgrading your commercial surveillance infrastructure ensures you can locate, export, and redact video evidence in minutes—protecting your business from ICO fines and operational headaches.
At AMUK Security, we supply, install, and support compliant commercial IP CCTV, access control, and smart security networks across Warwickshire and the West Midlands. Our certified engineers configure hardware to ensure full UK GDPR alignment right out of the box.
Need help ensuring your commercial CCTV setup is fully compliant with ICO rules?
Contact AMUK Security today to schedule a commercial security and compliance audit.
