Can organisations refuse a CCTV subject access request? When GDPR Exemptions Apply
A CCTV subject access request can create a difficult balancing exercise. An individual may have a right to access footage containing their personal data, but the same recording may also show other people, contain confidential information, or relate to an ongoing investigation.
That does not mean an organisation can simply refuse a request because the footage is difficult to disclose. Under the UK GDPR, people generally have the right to access their personal data, and the Information Commissioner's Office (ICO) says organisations must only refuse access where an exemption or restriction applies. Where an exemption is relied upon, the organisation should consider the circumstances of the individual request, justify its decision, and document the reasoning.
For CCTV operators, the practical answer is often more nuanced than a simple "yes" or "no." An organisation may be able to withhold some footage, redact information about other people, restrict disclosure because of a specific legal exemption, or provide the requester with their personal data in another appropriate form.
What Is a CCTV Subject Access Request?
A subject access request (SAR) allows an individual to ask an organisation whether it is processing their personal data and, where applicable, to obtain a copy of that information. A request does not need to use the words "subject access request" or cite Article 15 of the UK GDPR to be valid. It can be made verbally or in writing, including through channels such as social media.
For CCTV, the request might be very specific: someone could ask for footage of themselves entering a building at a particular time. Alternatively, they may provide a broader timeframe and ask an organisation to locate recordings in which they appear.
The organisation should make a reasonable and proportionate search for the requested information. If relevant footage exists, the starting point is generally to provide the individual's personal data unless a valid exemption or restriction applies.
Can an organisation refuse a CCTV SAR?
Sometimes, but refusal should not be the default response.
The ICO states that exemptions can allow an organisation to refuse some or all of the information requested, depending on the specific circumstances. Exemptions need to be considered case by case, and organisations should document why they are relying on one.
There is also an important distinction between refusing the entire request and withholding particular information. If a recording contains the requester alongside several unrelated individuals, the presence of third-party information does not automatically mean that the requester should receive nothing.
Instead, the organisation should consider whether the third-party information can be removed or whether disclosure can otherwise be made without unfairly affecting those individuals.
That makes redaction a central part of many CCTV SAR workflows.
The rights of others exemption
One of the most important considerations for CCTV is information about people other than the requester.
Imagine someone asks a retailer for CCTV showing an incident in which they were involved. The recording also contains several customers walking through the store. Providing the footage without any protection could reveal those customers' personal data.
The ICO's guidance explains that an organisation does not have to provide information to the extent that doing so would reveal another person's information, unless that person has consented or it is reasonable to disclose the information without consent. This is commonly referred to as the "rights of others" or third-party data exemption.
Importantly, the organisation should not simply assume that third-party presence ends the matter. The ICO recommends considering whether consent is necessary and, where consent is unavailable, whether disclosure without consent is reasonable. Factors can include the nature of the information, any duty of confidentiality, and the potential harm caused by disclosure.
Redaction can make disclosure possible
Suppose a CCTV recording shows an individual entering a building while ten other people pass through the same area. Refusing the request outright might deny the requester access to personal data that can reasonably be separated from information about everyone else.
Redaction may provide a better route.
Faces and other identifying details belonging to unrelated individuals can potentially be obscured while leaving the requester visible. The organisation can then provide a version of the recording that contains the requested personal data without unnecessarily exposing other people.
The ICO specifically notes that where CCTV footage includes other people, organisations will probably need to redact it so those individuals cannot be identified. If redaction is not possible, the organisation may need to consider consent or balance the requester's rights against the third parties' privacy interests.
This is one reason automated video redaction can be valuable for organisations handling frequent SARs. Our team at Pimloc built Secure Redact to support these situations. The software we created automates the detection and anonymisation of visual information across video, helping teams prepare disclosure copies without manually editing every occurrence of a face or other identifiable feature. Learn more.
When the crime and taxation exemption may apply
CCTV can sometimes form part of an investigation into suspected criminal activity. That creates another potentially relevant exemption.
Under the UK data protection framework, specific rules can apply where personal data is processed for purposes including the prevention or detection of crime, or the apprehension or prosecution of offenders. The ICO explains that the crime and taxation exemption can restrict the right of access where complying with a request is likely to prejudice those purposes.
The crucial point is that this is not a blanket exemption for every recording connected with crime.
The organisation needs to consider whether disclosure would actually create the relevant prejudice. The ICO specifically warns that the exemption should not be used to deny access to whole categories of personal data where disclosure would not be likely to prejudice the relevant crime and taxation purposes.
For example, footage that forms part of an active investigation may require careful consideration before disclosure. However, an organisation should not assume that every CCTV recording associated with an incident can automatically be withheld.
What about confidential information?
CCTV footage can contain information that is confidential for reasons other than simply identifying another person.
A camera inside a healthcare facility might capture sensitive interactions. Footage from a workplace could show confidential documents or screens. Recordings from a residential setting might reveal details about someone's private life.
Confidentiality should therefore be considered alongside the identity of people appearing in the recording. An organisation should establish what information the requester is entitled to receive and whether disclosing the complete recording would expose information that should not be provided.
Where possible, separating the requested personal data from unrelated confidential material can avoid an unnecessarily broad refusal.
What if the footage is about an employee?
Employees can also make SARs for CCTV footage containing their personal data.
The ICO's employment guidance confirms that exemptions can apply to employee SARs and highlights third-party data and crime and taxation considerations among the issues employers may encounter. The same guidance emphasizes that exemptions should be applied case by case and that organisations should document their reasoning.
An employer should therefore avoid treating workplace CCTV as automatically exempt simply because it relates to employment.
If an employee asks for footage showing themselves in a workplace, the organisation should establish whether the recording contains their personal data, locate relevant material, consider other people's information, and assess any applicable exemption.
How long does an organisation have to respond?
In most circumstances, an organisation must respond to a SAR without undue delay and within one month of receiving it. The ICO says the period can be extended by up to a further two months where the request is complex or the organisation has received a number of requests from the same person.
This timeframe makes an efficient CCTV search process important.
A team may need to identify which cameras cover a particular location, locate recordings within a specified period, review hours of footage, identify the requester, protect third parties, and produce a secure disclosure copy.
If these steps are entirely manual, a relatively straightforward SAR can become a substantial administrative exercise.
A practical CCTV SAR workflow
A consistent process can help organisations avoid both unnecessary refusals and accidental disclosures.
1. Validate The Request
Confirm who is making the request and establish what information they are seeking. If the timeframe or location is unclear, the organisation may need additional information to conduct a reasonable search.
2. Locate Relevant Footage
Identify the relevant cameras, dates, times, and recording systems. Keep a record of the searches undertaken so the organisation can demonstrate that it took reasonable and proportionate steps to locate the requested data.
3. Preserve The Original
The source footage should be protected before editing begins. Create a controlled working copy for any redaction or other processing required to prepare the disclosure.
4. Identify Third-Party Information
Review the footage for other identifiable individuals and any confidential or sensitive information that should not be disclosed.
5. Redact Where Appropriate
Apply appropriate redactions to third-party information rather than automatically withholding the entire recording. Automated detection can help with large volumes of footage, but the resulting copy should still be reviewed.
6. Assess Any Exemptions
If information is being withheld, identify the specific exemption or restriction that applies and consider whether it genuinely applies to the circumstances.
7. Review The Final Copy
Check that the requester is visible where appropriate, third-party information is adequately protected, and the redactions cannot simply be removed from the exported file.
8. Disclose Securely
The ICO says organisations must take all reasonable steps to ensure that personal information is provided securely.
The final disclosure should therefore be transferred through an appropriate secure method rather than treated as an ordinary video file.
Avoiding over-redaction
Privacy protection does not mean obscuring everything.
If an organisation blurs every person in a recording, including the requester, the resulting footage may no longer satisfy the purpose of the SAR. Redaction should therefore be targeted at information that needs protection rather than applied indiscriminately.
This also matters for evidence. In some circumstances, details surrounding an event may provide important context for the requester. Removing excessive information can make footage difficult to understand and may lead to unnecessary disputes about whether the organisation properly complied with the request.
A good review process asks two questions at the same time: what information does the requester have a right to receive, and what information should not be disclosed?
Document every refusal or partial disclosure
If an organisation decides not to provide some or all of the requested information, the decision should be documented.
The record should explain what information was withheld, which exemption or restriction was considered, why it applies, and why disclosure was not considered appropriate in the circumstances. The ICO emphasizes the importance of being able to justify and document reliance on exemptions.
Good documentation also creates an internal record if the requester challenges the response or the organisation later needs to demonstrate how the decision was reached.
The process should therefore be about more than producing a video file. It should create an auditable chain from the original request through search, assessment, redaction, review, and disclosure.
The key question is not simply "can we refuse?"
CCTV SARs sit at the intersection of an individual's right to access their personal data and the privacy rights of everyone else captured by the same camera.
A third party appearing in the footage does not automatically justify refusing the entire request. An ongoing investigation does not automatically make every related recording exempt. Instead, organisations need to examine the particular circumstances and determine whether information can be disclosed safely, potentially through targeted redaction.
That approach is consistent with the ICO's guidance: organisations should aim to provide the personal data requested while considering the rights of others and any applicable exemptions.
For organisations processing substantial amounts of CCTV, automation can make that balance more manageable. Secure Redact can identify and anonymise faces and other sensitive visual information across video, helping teams create privacy-conscious disclosure copies while retaining the relevant footage for the person making the request.
Frequently asked questions
-
Yes, but only where a valid exemption or restriction applies. An organisation should assess the particular circumstances rather than automatically refusing a request because it involves CCTV.
-
No. Third-party information needs to be considered, but it may be possible to redact the other person so the requester's personal data can still be provided.
-
Generally, a person does not have to explain why they are making a SAR or what they intend to do with the information.
-
Potentially, but the relevant exemption must actually apply. The crime and taxation exemption depends on whether complying with the request is likely to prejudice the relevant crime-related purpose; it is not a blanket exemption for investigative footage.
-
The normal deadline is one month from receipt, although an organisation can extend the response period by up to two additional months where the request is complex or multiple requests have been made.
-
The original should generally be preserved, with a separate copy created for redaction and disclosure. This helps maintain the integrity of the source recording.
-
The organisation may need to consider whether third-party consent can be obtained or whether disclosure without consent is reasonable. If neither is appropriate, withholding the relevant information may need to be considered under the applicable rules.
-
Not necessarily. The right of access concerns the individual's personal data, and an organisation may need to restrict or redact information belonging to other people or information covered by an applicable exemption.