CCTV footage requests: who can get the footage and when

A customer emails asking for “the clip from Tuesday”. A detective constable rings the shop. A solicitor writes on behalf of someone who slipped in the car park. Sometimes the call lands with the installer or the alarm receiving centre that maintains the system, not with the controller who owns it. Each of these people has a different route to the footage, and in the UK the timetable changed in 2026.

Subject access requests after the 2025 Act

The basic right has not changed. Under Article 15 of the UK GDPR a person can find out whether you process their data and get a copy. GOV.UK puts it plainly for CCTV: you must usually provide the footage free of charge within one calendar month.

What changed is how the month is counted. The Data (Use and Access) Act 2025 inserted Article 12A into the UK GDPR, in force from 5 February 2026. The month now runs from the latest of three points.

• When you receive the request.
• When you receive information you asked for to confirm the requester’s identity.
• When any fee you were entitled to charge is paid.

You can extend by two further months for complex requests or a high number of them, but the notice and reasons must go out within the first month. If you reasonably need more detail to locate the data, you can ask for it and the days until the reply do not count. The Act also wrote into Article 15 that the requester gets what a reasonable and proportionate search finds, with retrospective effect to 1 January 2024.

One more change matters for the reply letter. Since 19 June 2026 the information you give must include the right to complain to the controller itself, as well as to the regulator.

The GOV.UK CCTV page still says “1 calendar month” without mentioning Article 12A. Read the two together.

The clock stops, the recorder does not

This is the trap. Say the system keeps 14 days. A request arrives on day 10 of a clip’s life, with no time given. You ask the requester for a time window, and the clock legally stops. Four days later the recorder overwrites the clip.

Your deadline is intact. The footage is gone.

The EDPB access guidelines, written for the EU but useful here as practice, say that with short retention periods the controller should organise itself so that data is not lost while a request is handled. Our advice for UK sites is the same. On receipt, save the most likely window first, then ask questions.

People in the background

Footage rarely shows only the requester. Paragraph 16 of Schedule 2 to the Data Protection Act 2018 says you are not obliged to disclose information that would identify another individual. That changes if the other person consents, or if disclosure without consent is reasonable. To judge reasonableness the Act lists the type of information, any duty of confidentiality, what you did to seek consent, whether the person can consent and any express refusal.

In practice, blurring or masking the other people is usually the cleanest answer. Then the copy contains the requester and nobody else identifiable. If your NVR cannot export with privacy masks, every request becomes manual editing work. Find that out at commissioning, not on day 28.

Police, courts and the crime exemption

Paragraph 2 of Schedule 2 disapplies listed UK GDPR provisions for data processed to prevent, investigate or detect crime, or to apprehend or prosecute offenders, to the extent that applying them would be likely to prejudice those purposes. The word “investigation” was added by the 2025 Act from February 2026. It is the provision that lets a business hand footage to officers where applying the usual rules would be likely to prejudice the investigation.

It permits; it does not compel. A court order, or a duty in another enactment, is a separate ground under paragraph 5(2).

The government’s police requirements for CCTV are blunt about the hand-over itself. Export in the native file format, at the quality stored, without extra compression. Include the replay software. An event log and the system settings help prove integrity. Someone on site should know the retention period and roughly how long it takes to export 15 minutes, 24 hours or the whole system.

For domestic systems that record beyond the property boundary, GOV.UK says data protection law applies and owners must respond to subject access requests. It tells them to ask their installer how to export footage.

Solicitors and insurers

Paragraph 5(3) covers disclosure necessary for legal proceedings, including prospective ones, for legal advice or for defending legal rights. That is the likely route for a solicitor’s letter. No source we read deals with insurers by name in the UK, so treat an insurer’s request case by case. Our position: release only the incident window, record why, and never send the full archive.

How Spain and Italy handle the same request

Spain gives the most precise rules of the three. Its data protection law treats more than one access request in six months as potentially repetitive. The AEPD guide asks the requester for a current photo of themselves, and, because it is almost impossible to give access to images without affecting someone else, allows the controller to answer with a certified written description of the data processed. The same guide is the only one of our sources that names a claim to an insurance company as a legitimate reason to request images of an incident. Footage that must be kept to prove acts against people, property or premises goes to the authorities within 72 hours of learning it exists.

Italy follows the EU GDPR month without the UK changes. Its regulator, the Garante, allows footage to be kept beyond the normal period when a court or the judicial police make a specific request for an ongoing investigation.

	United Kingdom	Spain	Italy
Deadline for the person recorded	1 month from the latest of receipt, identity, fee; plus 2	1 month, plus 2 if complex	1 month, plus 2 if complex
Pause while asking for details	Yes, in the statute, Article 12A(5)	EDPB guidance allows a pause while identity or scope is clarified	EDPB guidance allows a pause while identity or scope is clarified
Other people in footage	No duty to disclose unless consent or reasonable	Mask, or certified written answer	Mask before release
Police	Crime exemption, Schedule 2 para 2	Reasoned request; 72 hours if footage proves acts against people, property or premises	Legal obligation, where national law requires cooperation
Insurers	Not addressed by name	An individual may request footage for a claim against an insurer; incident only	Not addressed

What to set up before the next request

• Put in the maintenance contract who receives requests and who exports. Article 28 of the UK GDPR requires the processor contract to say the processor will help the controller answer them.
• Preserve the likely clip the day the request arrives.
• Send a written acknowledgement stating the date the month ends.
• Test masked export at handover and write down how long one camera-hour takes.
• Keep a disclosure log: who asked, which window, what medium, what date, on what legal ground.
• For retention periods see our guide to CCTV footage retention. Signs must tell people how to exercise their rights: CCTV signage requirements. Where staff are recorded, check the employer rules for CCTV at work.