TL;DR: UK operators rarely get caught on the sign. They get caught when someone asks for their footage. Under the UK GDPR you have one month to respond, must protect other people in the frame and must not let the footage disappear. The ICO reprimanded Greater Manchester Police after two hours of requested footage went missing. For DPOs, compliance and IT. Gallio PRO automatically blurs faces and licence plates. Check your setup with the CCTV compliance check : nine questions, your result on the page, no email needed.
Most organisations put up a CCTV sign, set a retention period and move on.
The weak point comes later, when a customer, an employee or a former detainee asks for a copy of what the cameras recorded. At that moment, three things have to work at once:
For the general legal framework, including lawful basis and fines, see our guide to CCTV rules and regulations in the UK . This article focuses on what happens when footage is requested.
The UK GDPR transparency rules (Article 13) require you to tell people about the processing when you collect their data. For cameras, that means a sign visible before someone enters the recorded area.
A sign that works should at least state:
A pictogram alone tells people they are being filmed, but not who to ask. That gap turns into delays and complaints later. Police forces and local authorities must also have regard to the Surveillance Camera Code of Practice issued under the Protection of Freedoms Act 2012.
Anyone who appears in your footage can request a copy under Article 15 of the UK GDPR. The ICO's video surveillance guidance is clear: you must respond promptly and within one month of receiving the request, extendable by two further months if the request is complex or one of several.
The ICO also points to a practical risk. Your retention period may delete the footage before you respond. It is good practice to stop footage within the scope of a request from being overwritten.
Almost every CCTV clip shows people other than the requester. Under the Data Protection Act 2018 (Schedule 2, Part 3, paragraph 16), you do not have to disclose information about other individuals unless they consent or it is reasonable to disclose without consent.
In practice, consent is rarely realistic for passers-by. The ICO guidance names the alternative: blurring, masking or using a solid fill to obscure parts of the footage. It also suggests removing metadata from footage files where necessary, and training staff to use redaction software so they can respond within the statutory timescales.
A request from the police is not a subject access request. The ICO says it is appropriate to disclose footage to law enforcement where your system is used to prevent and detect crime. Disclosure is generally voluntary unless a court order applies. Record what you disclosed, to whom and why.
For internal requests from staff and contractors, see our article on handling CCTV footage requests from employees and contractors .
On 29 May 2025, the ICO issued a reprimand to Greater Manchester Police (GMP) over its handling of CCTV footage ( source: ICO).
What happened, according to the ICO:
The ICO found that GMP failed to provide the requester's personal data without undue delay and within one month, and failed to put appropriate measures in place to protect against accidental loss of CCTV data. Staff misunderstood who was responsible for quality-checking retained footage, and there was no policy saying when checks were needed or who should do them.
The ICO's Head of Investigations said GMP "demonstrated serious shortcomings in how it handles CCTV footage". GMP has since introduced clearer retention policies and a strictly controlled process so that only authorised personnel can access footage on the CCTV server.
What the case shows:
For public bodies, the ICO often issues reprimands instead of fines. Private operators face the full fining regime: up to £17.5 million or 4% of worldwide annual turnover for breaches of principles and data subject rights, and up to £8.7 million or 2% for other infringements. The ICO has also noted that its video surveillance guidance is under review following the Data (Use and Access) Act 2025.
Gallio PRO runs as an application on Windows and macOS. For enterprise environments, an on-premise command line version is available for Linux. Footage does not have to be sent to an external cloud service.
Check | Legal basis or source | Done? |
Sign naming the operator, purpose and contact route for requests | UK GDPR Art. 13 | ☐ |
Fuller privacy notice available online or on site | UK GDPR Art. 13 | ☐ |
Documented retention period, set by purpose | UK GDPR Art. 5(1)(e) | ☐ |
Process to preserve footage as soon as a request arrives | ICO video surveillance guidance | ☐ |
Named roles for export and quality checks | UK GDPR Art. 5(1)(f) and 32 | ☐ |
Access to the CCTV server limited to authorised staff | UK GDPR Art. 32 | ☐ |
Subject access process with a one-month deadline | UK GDPR Art. 12 and 15 | ☐ |
Redaction tool and trained staff to obscure third parties | DPA 2018 Sch. 2 Pt 3 para. 16 | ☐ |
Log of every disclosure, including to police | UK GDPR Art. 5(2) | ☐ |
Yes. Anyone who appears in CCTV footage can make a subject access request under Article 15 of the UK GDPR. The operator must respond within one month, extendable by two months for complex requests.
The sign should be visible before the recorded area and state who operates the cameras, why, and how to contact them, with a route to fuller privacy information. A pictogram alone does not tell people how to exercise their rights.
You do not have to disclose other people's data unless they consent or disclosure is reasonable without consent (DPA 2018, Schedule 2, Part 3, paragraph 16). The ICO lists blurring, masking or solid fill as ways to obscure them.
There is no fixed legal period. Keep footage only as long as your purpose requires, document the period, and preserve footage that falls within a pending request.
No. Disclosure to the police follows a different route. The ICO says it is appropriate where your system is used to prevent and detect crime, and it is generally voluntary unless a court order applies.
It can be both a missed deadline and a security failure. The ICO reprimanded Greater Manchester Police in 2025 after two hours of requested footage were lost.
Up to £17.5 million or 4% of worldwide annual turnover for breaches of principles and individuals' rights, and up to £8.7 million or 2% for other infringements. Public bodies more often receive reprimands.
A sign starts the conversation, but the footage request is where UK operators are tested. Preserve the clip, protect third parties and answer within a month. The Greater Manchester Police case shows how quickly unclear responsibilities turn into a formal ICO finding.
Operating in the EU as well? National rules differ from country to country, even where the GDPR applies.
Check your setup with the CCTV compliance check : nine questions, your result on the page, no email needed.
