Who can view your CCTV footage? Staff, police, insurers and access requests

This is general guidance, not legal advice. The ICO says its CCTV guidance is under review following the Data (Use and Access) Act 2025, so check the ICO’s current guidance before relying on any detail.

CCTV footage of people is personal data, and your business decides who sees it. The question usually comes up at a bad moment: a manager wants to check what a member of staff was doing, the police turn up after a break-in, or a customer emails asking for the clip of their car being damaged.

This guide covers each of those, from inside your business to outside it. For the wider rules, see our guide to CCTV and GDPR.

Inside the business: who should have access

The ICO’s starting point is simple: access to footage should be restricted to authorised individuals. Set out in your CCTV policy who those people are and what each can do.

The ICO also expects that:

• recorded footage is viewed somewhere private, such as a secure office, not on a screen in a shared area
• only appropriate staff can copy or export footage
• staff are trained, and know that misusing footage can be a disciplinary matter and possibly a criminal offence
• you keep an audit trail where footage may be used as evidence

Give each person their own login. A shared “admin” password makes the audit trail useless. Modern video management software, such as HikCentral or Luxriot EVO, can give every user their own account and permissions, and log each view and export.

If your cameras film staff, our guide to CCTV in the workplace covers what you must tell them and where cameras should not go.

The police

When the police investigate a crime, they normally ask you for footage, often in writing. Data protection law allows you to hand footage over for the prevention, investigation or detection of crime, or to catch or prosecute offenders, to the extent that following the usual rules would get in the way of that.

In practice:

1. Check who is asking. Take the officer’s name, collar number and the crime reference.
2. Give only what is relevant. Export the time window and cameras they need, not the whole recorder.
3. Preserve it. If they ask you to keep footage, take it off the overwrite cycle until they no longer need it. Our retention guide covers this.
4. Log it. Record what you gave, to whom, when and why.

A court order is different. If an order or a law requires you to disclose footage, you must.

Insurers, solicitors and other businesses

You can usually share footage where it is needed for legal proceedings, legal advice, or establishing or defending a legal claim. A slip in your car park or damage to a delivery van are typical examples. Share the relevant clip, not hours of recording, and log it as you would for the police.

Be more careful with requests that have no clear legal purpose. A neighbouring business that wants “the footage from last week” should explain what it is for. If the request is really from someone who was filmed, treat it as a subject access request instead.

Do not post footage online to identify someone. Even if you are trying to catch a thief, that is rarely justified and can create problems of its own. Give it to the police instead.

Subject access requests: people asking for their own footage

Anyone who can be identified on your cameras can ask for a copy of footage of themselves. This is a subject access request (SAR). It does not have to use those words or be made in writing, so make sure staff know to pass it on.

Ask for what helps you find the footage: the date, a time window, where they were, and a description or photo so you can recognise them. Then work quickly, because footage keeps overwriting. Once a request has arrived, deleting or altering footage to stop it being disclosed is a criminal offence. Take the relevant footage off the overwrite cycle while you deal with it.

Other people in the footage

Most clips show more than one person. The ICO says you must still give the requester as much as you can without identifying anyone else. Usually that means blurring or masking other faces, and sometimes vehicle number plates. ICO guidance also expects CCTV systems to be able to redact footage, so check yours can before you need it.

If you cannot separate the others out, you have two options. You can disclose with their consent. Or you can decide it is reasonable to disclose without it, weighing things like what the footage shows and how important it is to the requester. Record the reasoning either way.

Sometimes a few stills, or a written description of what the footage shows, will satisfy the request with less intrusion. Offer that if it does, but the person is entitled to a copy of their data.

Exporting footage properly

How you export matters, especially for evidence:

• Export in the recorder’s original format, with its player software if needed, as well as any common format requested.
• Check the system clock. A recorder that is twenty minutes out undermines the evidence.
• Note the cameras, times and file names, and who exported them.
• Keep exported copies in one secure place, and delete them when their purpose ends.

Exports sit outside the recorder’s overwrite cycle, so they are easy to forget. Treat them as part of your retention policy.

Checklist

• Policy names who can view, export and delete footage
• Individual logins, with viewing and export logged
• Recorded footage viewed in a private place
• Staff know how to recognise a subject access request and who handles it
• The system can blur or mask other people
• A log of every disclosure: police, insurers, solicitors and SARs
• Exports stored securely and deleted on time

Need a system that makes this easier? We set up CCTV with individual user accounts, permissions and audit logging, and a maintenance contract keeps the clock and exports working. This guide is not legal advice. Talk to us about CCTV.