How Do I Verify Someone Is Entitled to CCTV Footage Before Sharing?

A request for CCTV footage can sound straightforward: a resident wants to see what happened in the lobby, a delivery driver says a parcel was taken, or an insurer asks for a clip after an incident. But footage from a shared building may show residents, visitors, staff and passers-by who have not asked to be involved. Sharing it without checking the requester’s identity, authority and specific need can create a privacy problem — and may make an incident harder to manage.

The first question is not simply, “Can we send the clip?” It is: what security question does this camera answer, and what is the least intrusive way to answer it? In many cases, the answer is a short, supervised viewing or a carefully edited extract, rather than a copy of the full recording.

This guide sets out a practical process for building owners, property managers, residents’ management companies and on-site teams in the UK. It is operational guidance, not a substitute for advice on a particular legal request. Check your organisation’s CCTV policy and consult its data protection lead or legal adviser where the situation is unclear.

Start by identifying the type of request

Not every person who asks to see footage has the same rights or authority. Before discussing access, establish what they are asking for and in what capacity. A request may be:

A request for a person’s own personal data. Someone may be making a subject access request if they ask for footage of themselves. Their right is not automatically a right to receive an unredacted recording of everyone else in the scene.
A request connected with an incident. A resident, visitor or contractor may want evidence of a collision, theft, damage or disturbance. Their interest should be assessed, but it does not by itself entitle them to all footage.
A request from an authorised representative. A solicitor, insurer or family member may be acting for someone else. Ask for evidence of authority before treating the request as the person’s own.
A request from law enforcement or another authority. Verify the requester and the basis and scope of the request through your organisation’s procedures. Do not assume that a badge, email signature or urgent tone is sufficient verification.

Be careful not to promise access before you have checked the relevant rules. The building operator or other data controller may need to consider the requester’s rights alongside the privacy of people captured in the same footage.

Confirm requester identity and authority

Start with the information needed to confirm who is making the request. Use a proportionate method: ask for enough evidence to establish identity, but do not collect extra documents or sensitive information “just in case”. If the person is already known to the management team, record how their identity was checked rather than skipping the check entirely.

Where someone is acting for another person, verify both identities and the representative’s authority. Depending on the circumstances, that could mean written authorisation or another appropriate confirmation. For a request from an organisation, use a known contact route to check the person’s role and request. Avoid relying only on contact details supplied in a new or unexpected email.

Keep a record of the verification, but avoid storing unnecessary copies of identity documents. For example, record that identity was checked and the method used. If a copy is genuinely required under your policy, restrict access to it and apply a deletion date.

Clarify the incident and limit to relevant footage

Ask the requester for enough detail to locate the footage and assess the request:

What happened, and why is the footage needed?
What date, approximate time and location are involved?
Which person or event should the review focus on?
Is there a particular part of the recording that matters?
Is there an active police, insurance or legal process?

These questions help staff limit to relevant incident footage, rather than exporting an entire camera’s recording or a long block of activity. If the time is uncertain, start with the narrowest reasonable window and widen it only if necessary. Record why any wider search was needed.

Data minimisation starts before a clip is shared. It also applies to what is searched, viewed, exported and retained. Do not browse unrelated recordings out of curiosity, and do not ask colleagues to “have a look” unless they have a defined role in handling the request.

Check who owns and governs the CCTV decision

In a mixed-use or shared building, it may not be obvious who is responsible for footage. The camera could be operated by a managing agent, a landlord, a residents’ management company, a commercial occupier or a security contractor. Responsibility can also differ by camera or location.

Before granting access, identify who is the data controller for the relevant system and who has delegated authority to make disclosure decisions. Follow the building’s CCTV policy, management agreement and documented escalation route. An on-site team member should not make an informal promise to provide footage if they are not authorised to do so.

Governance should make clear:

who can approve access, exports and disclosures;
who operates the recording system and who can view it;
how requests are logged, assessed and answered;
how urgent requests are escalated;
how footage, exports and request records are secured and deleted.

Board or owner oversight matters, but it does not mean that a group chat or general meeting is the right place to circulate footage. Decisions should be made by the authorised people, using a consistent policy and a record of the reason for each disclosure.

Consider a supervised viewing alternative

Where the requester needs to understand what happened but does not need a copy, a supervised viewing alternative may reduce unnecessary disclosure. Arrange a secure, private viewing with an authorised staff member present. Show only the relevant time and camera view, and do not allow the requester to film the screen or access the recorder.

A supervised viewing is not automatically appropriate in every case. Other people in the footage may still be identifiable, and a viewing may itself disclose their personal data. Consider whether the requester’s purpose can be met another way, such as a written account of what the footage shows, a redacted still, or disclosure to an authorised representative. Record what was shown, when, to whom and why.

Do not describe a viewing as a way to bypass a formal rights request. If someone has made a subject access request, handle it through the organisation’s established process and applicable deadlines. Ask the data protection lead or legal adviser if it is uncertain whether the request qualifies.

Control camera placement and field of view

Good access decisions begin with good camera design. Cameras should have a defined security purpose, not be installed “just in case”. Review whether each camera is necessary, whether its field of view is proportionate, and whether it captures more than needed. A camera aimed at an entrance may also record a neighbour’s doorway, a private area or a public space. Use positioning, privacy masking or other controls to reduce incidental capture where appropriate.

Document the purpose of each camera and review the view when building layouts, access routes or uses change. A camera that once covered a loading bay may now capture a seating area. A request for a clip should not become an excuse to overlook an unnecessarily broad field of view.

Protect the clip if disclosure is approved

If a copy is justified, select only the relevant segment and use an approved, secure transfer method. Do not email raw clips around, send them through personal messaging accounts or place them in a shared folder that has no access controls or deletion date.

Before release, check whether the recording includes people or details that do not need to be disclosed. Redaction may be needed, depending on the request and circumstances. A second authorised person should check the export where practicable.

Check Examples to consider People and identifiers Faces, vehicle registration plates, name badges, access cards and distinctive clothing Private or sensitive surroundings Doorway interiors, screens, documents, visitor details or activity unrelated to the incident Security information Keypads, access codes, control-room displays, blind spots or security procedures Audio and metadata Recorded conversations, timestamps, location details and embedded information not needed by the recipient

Redaction must be effective in the exported file, not merely hidden by a removable overlay. Keep an unaltered master only where the policy and purpose justify it, and protect it separately. Record the recipient, the material provided, the approval and the secure delivery method.

Apply retention periods and routine deletion

CCTV should not be kept indefinitely because it might prove useful later. Set a retention period that reflects the system’s purpose, operational needs and applicable requirements. Apply routine deletion, and make sure the process covers both the recorder and any exported copies.

If an incident or formal request requires footage to be preserved, isolate the relevant segment and document why it is being held, who authorised the hold and when it will be reviewed. A preservation hold should be specific; it should not become a reason to retain every recording from every camera.

Ask https://dlf-ne.org/cctv-clip-shows-a-badge-and-a-screen-what-needs-to-be-redacted/ one practical question whenever a clip is exported: where does this copy end up, who can open it, and when will it be deleted? Track copies sent to a recipient or representative. Confirm how they will be securely stored and when they should be deleted, subject to any continuing legal or evidential need. A shared-folder dump without named access, an owner and a deletion date is not a controlled disclosure.

A practical decision checklist

Log the request and acknowledge it without promising access.
Confirm requester identity and, where relevant, their authority to act for someone else.
Clarify the purpose, incident, location, date and time window.
Identify the controller and authorised decision-maker for the footage.
Preserve only relevant footage if there is a justified need to prevent routine deletion.
Consider whether a supervised viewing, written response or redacted extract would meet the need.
Check third-party privacy, security details, audio and other redaction items.
Use an approved secure transfer method and record exactly what was disclosed.
Set and track deletion or review dates for retained footage and exports.
Escalate uncertain, sensitive or disputed requests to the data protection lead or legal adviser.

Do not invent a price for access

A common mistake in scraped or copied articles is to leave a line saying “No prices listed” as if it were useful guidance. It is not a price, and it does not tell a requester what will happen. Do not invent a fee or quote one based on another building’s practice. If your organisation has a lawful, documented charge policy that applies to a particular request, check it with the appropriate adviser and explain it clearly. Otherwise, focus on verifying the request, applying the relevant process and controlling disclosure.

Make the decision explainable

A sound CCTV decision should be easy to explain later: who asked, how their identity and authority were checked, what incident was relevant, who approved the response, what was shown or shared, what redactions were made, and where the copy went. If those details cannot be answered, pause before disclosing.

For a building team, the goal is neither to share everything nor to refuse everything. It is to exporting security footage safely handle a legitimate request consistently, protect other people’s privacy, and disclose only what is necessary through a controlled process.

Share this guide

Share on Facebook
Share on X (Twitter)

Replace the example.com links with the published address of this article.