Can a business refuse to give CCTV footage in the UK?

A UK business can refuse some requests for CCTV footage, but it needs a valid reason. Someone asking for a recording of themselves normally has a right to their personal information through a subject access request. The usual response deadline is one calendar month, and the first copy is normally free. GOV.UK explains the business's obligations.

For a shop manager or employer, the difficult part is deciding what can be released when a recording also shows customers or staff. Start by identifying what the person is entitled to receive, then check whether anything needs redacting or withholding.

If the request has exposed problems with playback or exporting, include those in your next commercial CCTV system review.

Does a customer or employee have a right to CCTV footage?

Yes, where the recording contains their personal information. A customer asking for a clip of their visit or a worker asking for footage of an incident involving them may be making a subject access request, usually shortened to SAR.

They can ask verbally or in writing. They do not need to mention GDPR, use your form or find the right manager first. Staff on a reception desk or shop floor should know who to pass the request to. ICO guidance on recognising a SAR explains these requirements.

A right to personal information does not give someone unrestricted access to the recorder or every camera view. Keep access under your control while you assess the request.

How long does a business have to provide CCTV footage?

Respond without undue delay and normally within one calendar month. Ask promptly for any information genuinely needed to verify identity or confirm that a representative can act for the person. Only request formal identification where necessary.

An extension of up to two further months can apply to complex requests or multiple requests from the same person. Explain the extension and reasons within the initial month. Necessary identity checks and clarification can affect the calculation, so use the ICO's detailed timing guidance for those cases.

Meanwhile, find the relevant recording before routine overwrite removes it. A one-month response deadline does not mean the recorder will retain the footage for that long.

Can you refuse because other people appear in the recording?

Not automatically. You need to consider their privacy as well as the requester's access rights.

The ICO says information about another person can be disclosed with their consent, or where disclosure without consent is reasonable. Where neither applies, consider whether blurring, masking or another form of redaction would let you supply the requester's information without identifying others. The ICO's CCTV-specific advice explains why your system should support this.

For example, a customer asks for footage of themselves falling near a shop entrance. Before refusing because other shoppers are visible, assess whether those shoppers can be obscured while preserving the relevant sequence.

If your recorder cannot redact footage, you still need to assess how to comply. Identify the technical limitation and get appropriate help rather than treating it as an automatic exemption.

When can a business legitimately refuse a CCTV request?

The decision depends on the footage and the circumstances. Common issues include:

Being busy, disliking the requester or expecting a complaint is not enough on its own. The ICO specifically warns that wanting information for a legal claim does not by itself justify refusal. See its guidance on manifestly unfounded or excessive requests.

Consider exemptions individually and record your reasoning. If you refuse all or part of a request, explain the decision as far as you lawfully can, including the person's complaint rights and ability to seek a court remedy. The ICO's subject access guide sets out the process.

What if the footage is about to be overwritten?

Protect the relevant recording promptly, keep it secure and record why it is being retained. The ICO recommends preventing premature deletion of footage within a request's scope. ICO CCTV governance guidance.

If it was already overwritten before you received the request, check whether you hold another relevant copy and explain what happened. That is different from withholding a recording you still hold. Do not promise that deleted footage can be recovered.

Deliberately destroying or concealing information to prevent someone receiving information they are entitled to following an access request can be an offence under section 173 of the Data Protection Act 2018.

A CCTV request checklist for business managers

1. Record when the request arrived and who is handling it.
2. Establish the relevant location and time period. Ask for helpful identifying details if needed.
3. Locate and protect the recording before routine overwrite.
4. Check identity proportionately and verify any representative's authority.
5. Assess other people's information, redaction and any applicable exemptions.
6. Prepare a usable copy and check the recipient before transferring it securely.
7. Keep a record of the response, what you disclosed and any reasons for withholding information.

The response may also need information about how you use the person's data. Use the ICO's subject access guidance when preparing it, rather than assuming a video file alone answers every part of a SAR.

Police requests and sharing crime alerts with staff raise different questions. Our guide to sharing CCTV footage lawfully covers those situations.

Can your CCTV system produce a usable export?

Check this before a request arrives. Confirm who can find a recording, protect it from overwrite and export a copy that plays outside the recorder. Ask how you would redact other people where necessary.

FIDEC can review the technical condition of your commercial CCTV system. For equipment and handover questions, see our commercial CCTV installation guide.

For help with recording or export problems, contact FIDEC. Decisions about disputed access rights or exemptions may need specialist data protection advice.

Questions people ask