UK ICO Guidance on Video Surveillance including CCTV (2022) G.1: G.1 Disclosures: controlled, consistent with the system's purpose, logged, secure, with sharing agreements; no uploading to the internet

Any disclosure must be controlled and consistent with the system's purposes; disclosure to police is usually appropriate for crime-prevention systems and acceptable where relevant even otherwise, and is voluntary unless a court order applies. The organisation should give staff guidance on when to disclose, record the date, recipient (person and organisation) and reason, use secure delivery, and have data sharing agreements for regular sharing; other requests need care, knowingly or recklessly disclosing without the controller's consent can be a criminal offence (DPA 2018, s 170), and posting footage online to an indefinite audience is generally inappropriate. Recipients become controllers of their copy.