Can I Request CCTV
Footage of Someone Else

How CCTV footage requests work under UK GDPR

UK GDPR and the Data Protection Act 2018 govern who can request CCTV footage and what operators must do. The default position is restrictive to protect privacy. You have rights to your own data only. Third-party footage needs separate legal basis.

Your right to your own footage (Subject Access Request):

• Under Article 15 of UK GDPR, you have the right to access personal data held about you.
• CCTV footage containing your image is personal data.
• Submit a written Subject Access Request (SAR) to the CCTV operator.
• Operator must verify your identity before releasing footage.
• Response within 30 calendar days (extendable to 90 days for complex requests).
• SARs are free unless excessive or repeated.
• Operator must redact or blur other identifiable people in the footage.

What operators must do when you request footage:

• Verify your identity via passport, driving licence or utility bill.
• Identify and locate footage from the date and time you specify.
• Redact or blur other identifiable people, vehicle registration plates and any other personal data of third parties.
• Provide footage in a usable format (typically MP4 or AVI).
• Free of charge for first request.
• Document the request for compliance records.

Why third-party footage is restricted:

• Other people in the footage have their own UK GDPR rights to privacy.
• Releasing identifiable images of third parties without their consent breaches their rights.
• The CCTV operator becomes liable under UK GDPR for unlawful disclosure.
• Fines for breach can reach £17.5 million or 4% of annual turnover.
• This protects everyone whose image gets captured.

When third-party footage CAN be released:

• Police investigations. Police can request footage under the Police and Criminal Evidence Act 1984 (PACE) Section 19.
• Court orders or subpoenas. Civil and criminal courts can compel disclosure.
• Insurance investigations. Insurers investigating claims with proper authority.
• Written consent of the third party. If they agree in writing.
• Legal proceedings. Used as evidence in civil disputes (with court permission).
• Crime in progress. Operator can release to police if they witness ongoing crime.
• Substantial public interest. Rare but possible under DPA 2018 Schedule 1.

How to make a Subject Access Request for CCTV:

• Identify the CCTV operator (shop name, landlord, council, neighbour or business).
• Find their contact details. Usually a Data Protection Officer (DPO) or general inquiry email.
• Write a clear request. Include: your name, identifying details, exact date and time of footage, location of camera, copy of ID, your contact details.
• Send via email or registered post.
• Keep a copy of your request and date sent.
• Allow 30 days for response.
• If no response or unlawful refusal, complain to ICO.

Common UK scenarios and answers:

• Car parking dispute. Want shop CCTV showing your car. SAR works for footage including you. Other cars and people redacted.
• Workplace incident. Want footage showing yourself for grievance. SAR to employer. Other staff faces blurred.
• Pub or restaurant incident. SAR to venue. Footage of you released. Other patrons blurred.
• Neighbour's CCTV showing your driveway. SAR to neighbour. They must comply if their CCTV captures your image. Limited if image not clearly identifiable.
• Want neighbour's argument footage. Cannot get this. Third-party footage restricted unless police involved.
• Want footage of a fight you witnessed. Cannot get unless you're identifiable in it. Police can request as part of crime investigation.

Domestic CCTV is also covered:

• Since the 2014 Ryneš case, domestic CCTV that captures public space falls under GDPR.
• Householders running CCTV that captures public footpath or neighbour's property are data controllers.
• They must respond to SARs from people in the footage.
• They cannot refuse based on "personal use" exemption.
• This is a common UK domestic CCTV compliance gap. Many homeowners do not realise.

What to do if your request is denied unlawfully:

• Operator must give written reason for any refusal.
• Some refusals are lawful: footage already deleted (typically 30-day retention), no footage at requested time, identity verification failed.
• If refusal seems unlawful, escalate to operator's Data Protection Officer.
• If still denied, complain to ICO at ico.org.uk/make-a-complaint.
• ICO investigates and can issue enforcement notices, fines and require compliance.
• Free service to complainant.

UK domestic CCTV operator obligations:

• Display CCTV signage at boundary (best practice and increasingly expected).
• Restrict camera angles to your own property where possible.
• Inform neighbours of your CCTV.
• Have a privacy notice available describing how footage is used.
• Respond to SARs from people captured.
• Delete footage after retention period (typically 30 days for domestic).
• Register with ICO if running CCTV that captures public space (most domestic CCTV qualifies).

Knowing what CCTV footage you can request is essential UK knowledge for anyone affected by recordings. Our full CCTV Help hub covers CCTV laws, footage retention, audio recording rules and broader CCTV guidance for UK homes and businesses.