UK ICO Guidance on Video Surveillance including CCTV (2022)
Governance after deployment – UK ICO Guidance on Video Surveillance including CCTV (2022)
UK ICO Guidance on Video Surveillance including CCTV (2022) G.3: G.3 Subject access to footage: a permanent copy within one month, preserve footage in scope, a transcript or still is usually not enough
The organisation must provide a copy of all the requester's personal data in the footage, unless an exemption applies, as a lasting copy or, where they agree, by letting them view it, and must do what is reasonable to provide a copy if they insist; it must respond within one month (extendable by two for complex or multiple requests), may ask for details (a photo, date, time) to identify the person and locate footage, and should stop in-scope footage being deleted under routine retention. A transcript, or often a still image, will not convey the context and is usually insufficient. No fee applies unless a request is manifestly unfounded or excessive, which the organisation must be able to show.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.