A Simple Workflow for Handling Security Footage Requests, Step by Step

A request to view or obtain building security footage can arrive after a slip in the lobby, a damaged car in the garage, a parcel going missing or an incident in a lift. The request may come from a resident, visitor, contractor, insurer, police officer or solicitor. The footage may help establish what happened, but it can also reveal other people’s movements, faces, vehicle registrations and routines.

A clear process helps a building team respond consistently without turning CCTV into a casual viewing service. The aim is to answer a legitimate question, disclose no more than necessary, and record what happened to the footage. This guide sets out a practical workflow for property managers, building teams and governing bodies in the UK. It is operational guidance, not a substitute for advice on a particular legal request.

Start with the right question

Before anyone opens a camera feed, ask: What security question does this camera answer? Then ask the same of the request: what specific incident, time and location does the requester need help establishing?

That distinction matters. Cameras should not be installed “just in case”, and recorded footage should not be watched out of curiosity. A request is not permission for an unrestricted tour of a camera system. The response should be tied to a defined purpose, such as checking a reported incident or assessing a request for access to personal data.

Step 1: Set ownership and decision-making rules

Before a request arrives, document who is responsible for CCTV decisions. In a managed building, this may involve an owners’ association or management company as the data controller, a property manager, an onsite team and a contracted CCTV provider. Confirm the actual arrangements rather than assuming that the person who can access the system has authority to approve disclosure.

Write down who can:

• Receive and log requests.
• Decide whether a request is valid and what checks are needed.
• Authorise a review, redaction and release.
• Export footage and transfer the final file securely.
• Handle a complaint, law-enforcement request or legal hold.

Give staff a simple escalation route for ambiguous or sensitive cases. For example, refer requests involving children, allegations of crime, employment matters, a dispute between residents or a formal legal notice to the designated privacy lead or appropriate adviser. Governance should also cover approved viewing locations, system access, audit logs and the handling of incidents involving the management team itself.

Step 2: Use a written request intake

Ask for a written request intake, using a dedicated form or monitored email address. A phone call may be a useful first alert, but the team should capture the key details in writing before starting a search. Make the form proportionate: it should gather enough information to locate the footage, not invite unnecessary personal details.

Intake fieldWhy it helps Requester’s name and contact detailsAllows the team to respond and, where relevant, verify identity. Date, approximate time and locationNarrows the search and reduces unnecessary viewing. Description of the eventHelps identify the relevant camera and assess the purpose of the request. Requester’s connection to the eventClarifies whether they are asking about their own personal data or acting for someone else. What outcome they are seekingDistinguishes a request to preserve footage, view it, receive a copy or report an incident. Any deadline or reference numberHelps prioritise time-sensitive matters without promising an outcome.

Explain that footage may not exist, may already have been routinely deleted, or may include other identifiable people. Do not promise a copy before checking the request, the footage and the applicable rules. If the requester is acting for someone else, establish their authority in a proportionate way.

Step 3: Log the request and preserve only what is needed

Enter the request in a restricted-access log. Record when it arrived, who received it, the stated incident, the cameras and time window considered, decisions made, any response deadline and the eventual outcome. Avoid placing sensitive incident descriptions in a general-purpose shared tracker accessible to the whole building team.

Check the system’s ordinary overwrite schedule promptly. If footage may be relevant, consider whether a narrowly defined segment should be preserved while the request is assessed. Preservation is not a reason to keep an entire day, camera or building indefinitely. Record why the segment was held, who authorised it, where it is stored, who can open it and when the hold will be reviewed or ended.

If the footage is subject to a police investigation, insurance claim or legal hold, follow the applicable instructions and your organisation’s escalation process. Keep a record of the request and any transfer. Do not let an informal request silently suspend routine deletion.

Step 4: Check camera purpose, placement and field of view

Locate the camera that may answer the incident question. Check its stated purpose, position, field of view and any known blind spots. A lobby camera intended to record entry and exit should not automatically be used to monitor a resident’s day-to-day activity. A garage camera should be aimed to address a defined security risk, not to collect every adjacent space simply because the lens can reach it.

Good camera governance starts before a request is made. Review whether each camera is necessary, whether its view is proportionate and whether privacy masking can exclude areas that are not relevant. Consider neighbouring homes, changing areas, private balconies and spaces where people reasonably expect greater privacy. Restrict live monitoring as well as playback; access should be role-based and for a stated operational purpose.

When searching, use the narrowest sensible time window and the fewest relevant cameras. If the event time is uncertain, ask a focused follow-up question rather than browsing realtytimes broad periods. Record what was searched, including any camera that could not provide a view.

Step 5: Identify the request type and assess disclosure

Different requests can lead to different processes. A person asking for footage of themselves may be making a data protection access request. Someone reporting damage to their vehicle may be asking for evidence that includes other people. Police, insurers and solicitors may have separate requirements, but their involvement does not automatically make every requested clip appropriate to disclose.

Check the organisation’s privacy notice and request-handling procedure. Confirm the requester’s identity where appropriate, clarify whether they want to view footage or receive a copy, and assess whether other individuals can be identified. If the request is unclear, ask a targeted question. If it is complex or contested, involve the privacy lead or seek suitable advice.

Do not assume that a resident’s interest in an incident gives them unrestricted access to everyone visible in the recording. Consider whether a description, incident report or limited viewing can meet the need without providing a copy. Make the decision on the facts, document the reasoning and explain the outcome in plain language.

Step 6: Review and redact the clip

When authorised, review and redact clip material before any disclosure. Use an approved workstation and a controlled process. First identify the shortest segment that answers the request. Then examine it carefully, including the frames before and after the key moment, so that context is not misleadingly removed.

Redaction is not limited to faces and number plates. Use this small checklist:

• Faces, vehicle registrations and distinctive personal identifiers.
• Children and people in vulnerable situations.
• Door codes, access cards, keys or security procedures visible in the scene.
• Computer screens, paperwork, parcel labels or other personal information.
• Audio that captures private conversations, if the system records sound.
• Reflections, windows or background areas that reveal more than the incident requires.
• Metadata or file names that disclose unnecessary personal or security details.

Redact other people where required and technically feasible, while preserving enough context to make the footage meaningful. If reliable redaction cannot be achieved, consider a different response, such as a controlled viewing or a written explanation. Do not rely on a blur that can be removed or on a still image where the underlying video remains accessible.

Have a second authorised person check the redacted result where practicable. They should confirm that the right time period is included, redactions persist throughout the clip, the audio has been handled, and the exported file does not contain an unredacted layer or alternate stream.

Step 7: Export the final version only

Export final version only for delivery. Keep the original recording in the CCTV system or in its approved restricted evidence store, according to policy. Do not email raw clips around for convenience, and do not place them in a broad shared folder. Working copies, test exports and redaction drafts should be controlled and deleted when no longer needed under the organisation’s process.

Before transfer, ask: Where will the exported clip end up, and who can open it? Agree a secure delivery method, check the recipient address or identity, and use access controls or a password shared through a separate channel where appropriate. Tell the recipient how to access the file and whether onward sharing is restricted. Record the file name, export date, recipient, method of transfer and authorising person in the disclosure log.

Never send a clip to a personal email address or messaging group merely because it is quicker. If a secure transfer route is unavailable, pause and escalate rather than improvising an uncontrolled one.

Step 8: Communicate the outcome and close the record

Respond in plain language. Confirm what was searched, whether relevant footage was found, what is being provided or why the request cannot be met as asked. Where appropriate, explain that other people’s privacy or building security has been considered. Do not disclose details about unrelated individuals or internal security measures that are not needed to explain the decision.

Close the request log with the outcome, response date, any footage released, the storage location of any retained evidence and the date for review or deletion. If a copy was supplied, note how it was delivered and who authorised release. Restrict access to the log itself, since it can contain sensitive information about incidents and residents.

Retention and routine deletion are part of the workflow

Set retention periods according to the purpose of each camera and the building’s documented assessment. There is no single retention period that suits every property. Keep footage only as long as needed for its stated purpose, then arrange routine deletion or overwrite and verify that the process works. Review periods when risks, camera coverage or operational needs change.

A request to preserve a clip should create a specific, reviewable exception—not a permanent archive. Record the reason, scope, access list and review date. When the reason ends, delete the retained copy securely and update the log. Apply the same discipline to exported files, redaction drafts and duplicate copies held by service providers.

Be transparent about prices and charges

A common flaw in scraped or copied guidance is that it lists no prices and leaves readers guessing. Do not invent a standard CCTV retrieval or redaction price where none has been approved. If your organisation charges for a service that can lawfully carry a fee, publish or provide the current schedule, explain what it covers and tell the requester about any applicable charge before work begins. Data protection access requests are generally free; a fee may be permitted only in limited circumstances, such as a manifestly unfounded or excessive request, or for further copies. Check the current rules and get advice before charging. A contractor’s internal cost is not, by itself, a reason to pass a fee to a requester.

A short pre-release checklist

1. Is the request recorded and sufficiently specific?
2. Is the requester’s identity or authority checked where appropriate?
3. Was only the relevant camera and time window searched?
4. Has the clip been reviewed and redacted, including audio and background details?
5. Has an authorised person checked the final export?
6. Do we know where the exported clip will go and who can open it?
7. Are the decision, transfer and deletion or review dates logged?

A disciplined workflow protects residents, staff and the building while still allowing legitimate requests to be handled fairly. The practical test is simple: collect less, search narrowly, disclose carefully and delete on schedule.

Share this guide

Facebook share | X (Twitter) share